Contributor paid to DPRK-cluster wallet
Sushi (SushiSwap) — v2 + v3 + Trident + BentoBox/Kashi + SushiXSwap's assessment for RD-F-122 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
MISO contractors 'Anthony Keller' / 'Sava Grujic' (AristoK3): CoinDesk Oct 2024 found that 'throughout 2021 and 2022, a blockchain address tied to Keller and Grujic sent most of its funds to DPRK-linked wallets.' These contractors were paid by Sushi DAO for MISO work; their payment wallets routed funds to DPRK-linked addresses. This constitutes a historical contributor-payment path to a DPRK cluster at ≤1 hop. Contractors no longer engaged (departed post-2021 incident). Current active team (Matthew Lilley, LufyCZ, Alex McCurry, Jared Grey advisory): no documented on-chain payment path to DPRK-linked wallets. The historical finding is factual and documented but pertains to contractors now terminated.
Sources #
- InternalJayPegs Automart Hack Database Entryhacksdatabase/hacks/jaypegs-automart.md — contractor wallet (0x3dDD8b6D092df917473680d6C41F80F708C45395) and funding chainretrieved 2026-05-17
- How North Korea Infiltrated the Crypto IndustryCoinDesk Oct 2024 — DPRK IT workers / MISO contractor payment flows to DPRK walletsretrieved 2026-05-17
Methodology #
Determine whether protocol payments to any contributor wallet have an on-chain path ≤3 hops to a known DPRK-labeled cluster.
See the full factor methodology and distribution across all protocols →