ZachXBT has disclosed data stolen from North Korea's internal payment servers, revealing transactions involving 390 accounts, chat logs, and cryptocurrency records. Since November 2025, these accounts have received over $3.5 million, with funds being withdrawn through exchanges or converted to fiat via platforms like Payoneer, then deposited into Chinese bank accounts. On-chain analysis links these payment addresses to North Korean IT workers, with one Tron address frozen by Tether in December 2025. Three companies on the user list, including Sobaeksu, have been sanctioned by OFAC. ZachXBT has compiled an organizational chart covering data from December 2025 to February 2026.