★ Deployer linked within 3 hops to DPRK/Lazarus
Symbiotic's assessment for RD-F-125 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
CRITICAL STAR FACTOR. Phase 2 deployer: 1-hop to Binance 15 (licensed CEX, non-sanctioned). Phase 1 deployer: 1-hop to unlabeled single-purpose wallet (no DPRK/Lazarus label); 2nd hop not resolvable via public Etherscan. No OFAC SDN listing found for any Symbiotic-associated address or named founder. Web search for Symbiotic DPRK/Lazarus/North Korea returned no relevant results. No Chainalysis or public cluster report links any Symbiotic address to DPRK. Note: Drift Protocol April 2026 DPRK attack used DeFi protocols as drain venues — this is attacker-use-of-protocol, not team-level contamination, and does not implicate Symbiotic team (per process-learnings U4 guidance).
Sources #
- URLUS Treasury OFAC — North Korean state-sponsored cyber groups sanctions (reference; Symbiotic not listed)US Treasury OFAC SDN list context — web search for Symbiotic DPRK Lazarus North Korea returned zero relevant resultsretrieved 2026-05-16
- From Staking to Restaking — ParadigmParadigm blog on Symbiotic — founders are Misha and Algys of Statemind (reputable audit firm); no DPRK associationretrieved 2026-05-16
- Etherscan: 0x9AbC... — clean funding chain (Binance 15)Etherscan Phase 2 deployer 0x9AbC... — Funded By Binance 15, no OFAC label at any visible hopretrieved 2026-05-16
Methodology #
Determine whether the deployer address has an on-chain path of ≤3 hops to a Chainalysis/OFAC DPRK-labeled cluster address.
See the full factor methodology and distribution across all protocols →