Known-threat-actor cluster has touched protocol
Frax Finance's assessment for RD-F-158 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
T-09 phase-2 signal requiring curated TI feed (Chainalysis/TRM Labs). No DPRK/Lazarus cluster wallets documented as interacting with Frax core contracts in any public TI report. Frax has not appeared in Chainalysis DPRK-tracking publications. Available Etherscan data on deployer (0x36bf2289, funded from internal dev account) and sampled Comptroller signer (0x6933BCC3, funded from exchange-pattern address ~4 years ago) show no OFAC-proximity flags. Requires curated threat-actor wallet cluster list for definitive assessment.
Sources #
- EtherscanFrax Comptroller signer — EtherscanComptroller signer 0x6933BCC3 — funded 4y ago, no DPRK labels, consistent Frax ecosystem activityretrieved 2026-05-17
- FraxGovernorAlpha deployer — Etherscan funding sourceDeployer 0x36bf2289 — funded by slap.fraxdev.eth (internal Frax dev), no OFAC/DPRK labelsretrieved 2026-05-17
Methodology #
Detect whether an address from the curator-maintained threat-actor cluster (past exploiters, labeled attacker families) interacted with this protocol in the last 30 days.
See the full factor methodology and distribution across all protocols →