On June 25, 2025, Favrr’s FAVRR token DEX listing was exploited, with blockchain analysis estimating more than $680,000 stolen from the Web3 project. The analysis linked the loss to payroll and wallet flows involving suspected DPRK IT workers hired as developers, including consolidation wallets and a Gate deposit address tied to the suspected exploiter.
Table 3: DPRK Cryptocurrency Thefts, January - September, 2025. Date: 2025-06-18; Victim: Favrr; DPRK APT: DPRK IT workers; Amount ($ Million): 0.68. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."
ZachXBT traced one frequently used ERC-20 wallet address back to the $680,000 Favrr exploit in June 2025, where the project's chief technology officer and additional developers were later identified as DPRK operatives using fraudulent credentials.