Four stablecoin issuers blacklisted wallets ZachXBT linked to Lazarus

Four stablecoin issuers had blacklisted two Ethereum addresses holding approximately $4.96 million in dollar-linked tokens by September 14, 2024, according to a contemporaneous update from blockchain investigator ZachXBT. Circle had joined Paxos, Tether and Techteryx in restricting the addresses, which ZachXBT attributed to North Korea’s Lazarus Group through an investigation published in April 2024.

The development mattered because it demonstrated a consequential difference between issuer-controlled stablecoins and native blockchain assets. Although the relevant balances remained recorded at public addresses, the issuers could prevent transfers of their respective tokens through controls embedded in the token contracts. That intervention disrupted access without reversing Ethereum transactions or taking control of the addresses’ private keys.

What was frozen

The two addresses identified in the September 14 update were 0x36f2D3871edd59d5C06DB8F0b12bE928d5922A70 and 0x12ED7f6ed0491678764c2b222A58452926E44DB6. ZachXBT said their restricted balances included USDC issued by Circle, USDT issued by Tether, BUSD issued by Paxos and TUSD issued by Techteryx.

The reported $4.96 million was an aggregate dollar estimate for the stablecoins subject to issuer blacklists, not a cryptocurrency-market capitalization, trading volume or proceeds figure calculated by Coinburn. Contemporaneous reporting also identified approximately $720,000 in DAI and $313,000 in ether at the addresses as unfrozen. Those figures described the reported address holdings around the event window; token balances and dollar valuations visible on blockchain explorers can change later.

Blacklisting did not establish that victims had recovered the funds. It meant the affected centrally administered tokens could not be transferred normally from the listed addresses. Any return, forfeiture or redistribution would have required additional action not established by the September 14 record.

The investigation behind the action

ZachXBT’s April 29 investigation traced funds from more than 25 cryptocurrency hacks occurring between August 2020 and October 2023. The investigator estimated that approximately $200 million in stolen cryptocurrency had been converted into fiat through a network involving intermediary wallets, mixers, bridges, centralized services and peer-to-peer marketplaces.

That $200 million was the investigator’s cumulative tracing estimate across the stated multiyear window. It was not the amount held in the two addresses on September 14 and was not independently audited by Coinburn. The September update connected the issuer freezes to that earlier investigation but did not publish a transaction-by-transaction reconciliation of the $4.96 million.

The Lazarus attribution also requires precision. ZachXBT supplied the specific attribution for these two Ethereum addresses. Separately, the FBI had already identified Lazarus Group and APT38 as names used for DPRK-linked TraderTraitor actors and had attributed several cryptocurrency thefts to them. The FBI’s earlier findings supported the broader institutional context, but its cited public notice did not name these two addresses.

Why issuer control mattered

The coordinated restrictions showed that stablecoin settlement was neither technically nor institutionally identical to transferring ether or bitcoin. Paxos, Tether, Techteryx and Circle retained contract-level powers capable of immobilizing their issued tokens. For exchanges and compliance teams, that could limit the movement of funds attributed to sanctioned or criminal actors. For users, it also exposed dependence on an issuer’s legal process, operational response and address-attribution decisions.

ZachXBT said Circle acted approximately four and a half months after the other issuers. That interval was the investigator’s contemporaneous characterization; Circle did not provide a response in the reporting reviewed for September 14. The surviving record therefore establishes that all four issuer blacklists were in place by that date, while leaving the precise legal requests, internal decision timelines and evidentiary standards undisclosed.

One numerical limitation is material: the September update separately stated that another $1.65 million had been frozen at exchanges and described the investigation-wide total as $6.98 million. Adding $4.96 million and $1.65 million produces $6.61 million, so the stated total cannot be reproduced from those two figures alone. Coinburn therefore does not present $6.98 million as a verified total.