★ Deployer linked within 3 hops to DPRK/Lazarus

Evidence summary #

1-hop from deployer and 3 known signers: MEXC / Bitget CEX addresses (not DPRK-linked). No OFAC SDN designation for Falcon Finance, Andrei Grachev, or DWF Labs as of 2026-05-12. No Chainalysis published DPRK attribution found. 5 of 6 Safe signers are anonymous — cluster proximity cannot be assessed for those wallets. Cannot confirm or deny DPRK absence for the anonymous signer set. No affirmative DPRK signal found; ESCALATION NOT REQUIRED, but opacity prevents all-clear.

Detail #

Deployer 1-hop is MEXC 16 (established CEX, not DPRK-linked). Safe Owner 2 1-hop is MEXC 16 (same). Safe Owner 6 1-hop is MEXC 16. Safe Owner 4 1-hop is Bitget 6 + ChangeNOW 16 (CEX/swap service, not DPRK-linked). Safe Owners 3 and 5 (0xE313dbD8693d656Fe760Ba3E766C80eB08F06734, 0x276c580545293dA6c7c0FDD12038Cc75acCBd211) — funding source not assessed; identities not disclosed. Andrei Grachev / DWF Labs: no OFAC SDN entry confirmed via sanctionssearch.ofac.treas.gov. Russian state bank connections (VEB bank, VTB-adjacent) are documented but are not DPRK/Lazarus cluster equivalents. Note: DWF Labs invested $25M in WLFI tokens; some WLFI buyers reportedly used Tornado Cash (per The Nation/Senate Banking Committee letter) — this creates an indirect 2-3-hop Tornado Cash proximity through the WLFI investor pool, not a direct interaction and not a DPRK signal. Factor scored gray rather than red because no affirmative DPRK attribution was found; scored gray rather than green because 5 of 6 signers are anonymous and cannot be cleared.

Sources #

Methodology #

Determine whether the deployer address has an on-chain path of ≤3 hops to a Chainalysis/OFAC DPRK-labeled cluster address.

See the full factor methodology and distribution across all protocols →