PANews reported on July 2 that crypto detective ZachXBT said on the X platform that his investigation found that since January 1, 2025, more than $16.58 million in payments have flowed to North Korean IT personnel hired as developers by various projects and companies, with an average of $2.76 million per month. Calculated at a monthly salary of $3,000-8,000 per person, it is equivalent to at least 345 to 920 positions being infiltrated. Among the six clusters he monitored, one cluster successfully tracked down eight North Korean information technology workers working in more than 12 projects, and the payment address funds flowed to two aggregated addresses. Through open source intelligence, it was found that Sandy Nguyen (@bullishgopher) of the cluster was photographed standing next to the North Korean flag while active in Russia. Despite the public disclosure of a large number of intrusion indicators and research materials, some people still believe that this is a conspiracy theory. After communicating with the relevant team, he also found other suspicious situations in the cluster, such as refusing to meet offline but claiming to be in the same city, recommending each other for employment, abnormal IP addresses, changing usernames, deleting accounts, paying at the same address, and failing KYC checks.