Contributor paid to DPRK-cluster wallet
GMX v2 (GMX Synthetics)'s assessment for RD-F-122 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No contributor wallet payment traced to DPRK/Lazarus cluster found. July 2025 exploit attacker funded themselves via Tornado Cash (2 ETH, July 7, 2025) — this is attacker personal funding, not a protocol payment to a contributor. Protocol does not publicly disclose individual contributor payment wallet addresses. No Chainalysis, TRM, OFAC, or analogous public report links any GMX team payment address to DPRK cluster. Admin Safe is the protocol treasury; no adverse flag on its origin.
Sources #
- URLhttps://sherlock.xyz/post/gmx-exchange-hack-explainedretrieved 2026-05-05
- https://sanctionssearch.ofac.treas.gov/retrieved 2026-05-05
Methodology #
Determine whether protocol payments to any contributor wallet have an on-chain path ≤3 hops to a known DPRK-labeled cluster.
See the full factor methodology and distribution across all protocols →