★ Deployer linked within 3 hops to DPRK/Lazarus
PancakeSwap's assessment for RD-F-125 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL — GREEN] Deployer 0x0F9399FC81DaC77908A2Dde54Bb87Ee2D17a3373: hop-1 funder (fiowind.bnb) is a clean retail DeFi wallet with no DPRK labels. Senator Warren Dec 2025 letter (Allium research) establishes Lazarus laundered ~$263M via PancakeSwap pools from Bybit hack — this is platform-use laundering, NOT a hop-path from the deployer to the Lazarus cluster. RD-F-125 definition requires on-chain path from deployer ≤3 hops to DPRK cluster; Lazarus transacting through PancakeSwap DEX pools does not create such a path. No DPRK proximity confirmed. No DPRK escalation triggered. Confidence medium (not high) — no Chainalysis/TRM feed available for full hop analysis.
Sources #
- EtherscanPancakeSwap Deployer — no DPRK/Lazarus labels on BscScanBscScan — CAKE deployer address (no DPRK labels)retrieved 2026-04-28
- Warren Presses DOJ re PancakeSwap — DPRK use of platform as laundering venue onlyCoinEdition — Warren/Allium DPRK laundering via PancakeSwap (platform-use, not developer identity)retrieved 2026-04-28
- ZachXBT DPRK IT Workers — PancakeSwap not in list of affected protocolsZachXBT DPRK IT worker investigation — PancakeSwap not named as employerretrieved 2026-04-28
Methodology #
Determine whether the deployer address has an on-chain path of ≤3 hops to a Chainalysis/OFAC DPRK-labeled cluster address.
See the full factor methodology and distribution across all protocols →