DWF Labs is suspected of suffering losses of at least $44 million due to a North Korean AppleJeus attack

Independent researcher tanuki42 claims that the market maker DWF Labs was allegedly infiltrated by the North Korea-linked threat organization AppleJeus in September 2022, resulting in a loss of at least $44 million, primarily in USDC/USDT. The related addresses' funds were cross-chained to Bitcoin and have remained dormant for a long time, with some recently flowing into the custodial mixing service Mixero.

The post also lists multiple associated transactions and unused BTC addresses; as of November 2025, DWF Labs has not publicly confirmed the incident.