Known-threat-actor cluster has touched protocol
Falcon Finance's assessment for RD-F-158 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Known-threat-actor wallet cluster has touched protocol | Applicable: Yes ($1.618B TVL high-value target) | No confirmed threat-actor wallet touch on Falcon contracts in public CTI reports as of 2026-05-12. Requires licensed Chainalysis/TRM feed for definitive assessment. Elevated sector-level risk (DWF Labs basis-trading model, synthetic dollar class targeted post-2025). Signal: gray.
Detail #
Signal requires a curated threat-actor wallet cluster list (Lazarus, Lazarus APT38, UNC4736, etc.) and on-chain interaction scan on Falcon core contracts. No public CTI report (Chainalysis, TRM Labs, CertiK) identifies known-threat-actor wallet interactions with USDf (0xFa2B947eEc368f42195f24F36d2aF29f7c24CeC2), sUSDf (0xc8CF6D7991f15525488b2A83Df53468D682Ba4B0), or the Admin Safe (0x1E482B60bf19Cb1cc859389e0eA3DED153f16Bd7) as of 2026-05-12. Sector note: The KelpDAO Apr 2026 Lazarus exploit ($292M) targeted a synthetic-dollar-adjacent protocol using institutional custody and off-chain settlement — similar structural class to Falcon. Indirect sector-level proximity elevated. Requires licensed feed for definitive signal status.
Sources #
- EtherscanAdmin Safe on Etherscanhttps://etherscan.io/address/0x1E482B60bf19Cb1cc859389e0eA3DED153f16Bd7retrieved 2026-05-12
- Curator note: CTI feed required for definitive assessmentRequires licensed CTI feed (Chainalysis/TRM); public-proxy: no threat-actor labels on Falcon contracts from public Etherscan tags; sector-level DPRK risk elevated post-KelpDAO Apr 2026retrieved 2026-05-12
Methodology #
Detect whether an address from the curator-maintained threat-actor cluster (past exploiters, labeled attacker families) interacted with this protocol in the last 30 days.
See the full factor methodology and distribution across all protocols →