★ Deployer linked within 3 hops to DPRK/Lazarus
BENQI's assessment for RD-F-125 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No OFAC SDN designation found for either deployer address (0x5423819B3b5bb38b0E9E9e59F22f9034e2d8819b or 0xb5d72f3e80aC24A26A164ac86234e693195c7d8b) or any Rome Blockchain Labs principal. No published Chainalysis, TRM, Elliptic, or U.S. Treasury intelligence connects BENQI deployers to DPRK/Lazarus cluster. sAVAX deployer is funded by Coinbase 7 (U.S.-regulated exchange) — the 2-hop path from Coinbase 7 does not lead toward DPRK cluster by construction. Team geography (Canada/US/Finland/Singapore) is inconsistent with DPRK-attributed developer clusters. DPRK-related Avalanche Bridge laundering reports (cryptoleaks.info) do not name BENQI. BENQI partnered with Chainalysis for incident response (X post Nov 2023) — inconsistent with DPRK affiliation. Paid 3-hop graph CTI unavailable; confidence noted as medium. No positive proximity evidence found.
Sources #
- URLChainalysis — North Korean Hackers 2022 reportChainalysis blog — DPRK/Lazarus cluster report; no BENQI mentionretrieved 2026-05-16
- Snowtrace — BENQI sAVAX deployerSnowtrace sAVAX deployer — funded by Coinbase 7 (US-regulated exchange); 2-hop path is exchange infrastructure, not DPRK clusterretrieved 2026-05-16
- BENQI Chainalysis partnership — X post Nov 2023BENQI X post — Chainalysis incident response partnership announced Nov 2023 (inconsistent with DPRK affiliation)retrieved 2026-05-16
- OFAC SDN List — U.S. TreasuryU.S. Treasury OFAC SDN list — no BENQI deployer addresses or Rome Blockchain Labs principals listedretrieved 2026-05-16
Methodology #
Determine whether the deployer address has an on-chain path of ≤3 hops to a Chainalysis/OFAC DPRK-labeled cluster address.
See the full factor methodology and distribution across all protocols →