★ Deployer linked within 3 hops to DPRK/Lazarus
Aave v3's assessment for RD-F-125 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Both deployer wallets trace hop-1 to regulated CEXes (Kraken, Binance). DPRK/Lazarus cluster proximity structurally infeasible from regulated-exchange-originated funding. Lazarus Group's April 2026 use of Aave as an exploit drain venue (89,567 rsETH deposited) is an adversarial user event scored in Cat 11 (F158) — no Aave team wallet intersects with Lazarus deposit addresses within 3 hops. No DPRK proximity for any team contributor wallet.
Sources #
- EtherscanEtherscan — deployer wallet funding trace (Kraken hop-1)Etherscan for both deployer wallets — hop-1 to Kraken and Binance respectively; T-10 §2.3.1 cluster proximity analysisretrieved 2026-04-27
- Aave Governance — rsETH Incident Report (Lazarus as adversarial user, not team)governance.aave.com/t/rseth-incident-report-april-20-2026/24580 — confirms Lazarus as adversarial user (drain venue), not team memberretrieved 2026-04-27
Methodology #
Determine whether the deployer address has an on-chain path of ≤3 hops to a Chainalysis/OFAC DPRK-labeled cluster address.
See the full factor methodology and distribution across all protocols →