Documents from a compromised device reveal that a team of 140 North Korean IT workers has reportedly earned approximately $1 million monthly and $3.5 million in cryptocurrency since late November by using fake identities to secure developer jobs. According to NS3.AI, ZachXBT, a blockchain investigator, noted that some users on the group's payment site appeared to be connected to entities sanctioned by the U.S. Office of Foreign Assets Control. Additionally, ZachXBT traced the payment flow to Chinese bank accounts and North Korean wallets, which Tether blacklisted in December.