★ Deployer linked within 3 hops to DPRK/Lazarus
Lista DAO's assessment for RD-F-125 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL FACTOR] No on-chain path ≤ 3 hops from deployer or any multisig signer to DPRK/Lazarus cluster identified. Web search for 'Lista DAO OR Helio Protocol' + 'DPRK OR Lazarus OR North Korea' returned zero protocol-specific hits. All DPRK-related results concern the April 2026 Kelp DAO LayerZero DVN exploit (separate protocol, separate attack vector). BSCScan fetches of deployer and admin multisig show no OFAC/Lazarus labels. OFAC SDN: no Lista DAO entities. Chainalysis public proxy: no published report linking Lista DAO to DPRK cluster. U4 pre-mark strictly applied: if slisBNB appeared in any DPRK money-laundering flow as a passive intermediate venue (per Kelp DAO exploit context), this constitutes a Cat 11 (F158) signal only — it does not trigger F125 deployer-proximity finding. NO escalation to orchestrator required.
Sources #
- URLNorth Korea Stole 76% of All Crypto Hack Value in 2026 — TRM LabsTRM Labs 2026 DPRK report: Kelp DAO identified as DPRK exploit victim; Lista DAO not mentionedretrieved 2026-05-12
- U4 pre-mark application — F125 distinction from passive venueU4 pre-mark: slisBNB as passive DPRK laundering venue = Cat 11 F158 only; no F125 deployer contamination; DPRK search confirmed no Lista DAO hitsretrieved 2026-05-12
- BSCScan: Operative deployer — no DPRK labelsBSCScan: deployer 0xd7e38800... and admin multisig 0x8d388136... — no OFAC/Lazarus/DPRK labels; clean 1-hop funding sourceretrieved 2026-05-12
- North Korean hackers blamed for $290M crypto theft | TechCrunchTechCrunch: North Korea hackers blamed for $290M Kelp DAO crypto theft — Lista DAO not mentioned; U4 passive-venue distinction confirmedretrieved 2026-05-12
Methodology #
Determine whether the deployer address has an on-chain path of ≤3 hops to a Chainalysis/OFAC DPRK-labeled cluster address.
See the full factor methodology and distribution across all protocols →