0x403bae4F3F9f87e057F4380e6f549199673c9D13
PublicAML knows this Ethereum address as Lazarus Group, a hacker. Our AML risk score for it is 100 of 100, which we read as high risk. This address is itself listed by attributed to a hacking entity (Arkham) (0x403bae…3c9d13).
| Chain | Ethereum (ETH) |
| Entity | Lazarus Group |
| Category | hacker |
| AML score | 100 / 100 (high) |
| Cluster size | 73 addresses |
Each row is a path our propagation engine traced from a flagged address to this one, with the number of hops and the source that flagged it. A finding is an observation about the flow of funds, not a statement about the owner of this address.
| Finding | Source | Hops | Direction |
|---|---|---|---|
| This address is itself listed by attributed to a hacking entity (Arkham) (0x403bae…3c9d13). | attributed to a hacking entity (Arkham) | 0 | inbound |
| Funds reaching this address are 2 hops from attributed to a hacking entity (Arkham) (0xfa3fcc…2d6c49). | attributed to a hacking entity (Arkham) | 2 | inbound |
| Funds reaching this address are 5 hops from OFAC SDN list (0xdcbeff…643193). | OFAC SDN list | 5 | inbound |
7 further internal signals are held back from this page. They come from heuristics with known false positives, and we do not publish an accusation we would not defend. They are visible in the live check.
| Source | Share of received value |
|---|---|
| Sky (MakerDAO) | 81.2% |
| Uniswap | 14.6% |
| unknown | 2.1% |
| Lazarus Group | 2.1% |
| sweep-intermediary | 0.1% |
| Counterparty | Known as | Transactions |
|---|---|---|
| 0xfc926659dd8808f6e3e0a8d61b20b871f3fa6465 | sweep-intermediary | 20 |
| 0x96244d83dc15d36847c35209bbdc5bdde9bec3d8 | sweep-intermediary | 20 |
| 0xf3de3c0d654fda23dad170f0f320a92172509127 | Dex Router (OKX) | 16 |
| 0x83c7678492d623fb98834f0fbcb2e7b7f5af8950 | sweep-intermediary | 16 |
| 0x4838b106fce9647bdf1e7877bf73ce8b0bad5f97 | Titan Builder | 14 |
| 0xf6e72db5454dd049d0788e411b06cfaf16853042 | Sky (MakerDAO) | 12 |
| 0x5849f4bc3b81c8c3e4488d4b717d996eb410acb1 | not attributed | 8 |
| 0x83ef5e80fad88288f770152875ab0bb16641a09e | not attributed | 8 |
Attribution and risk propagation both make mistakes, and a page like this one is visible for a long time. If you own this address or can show that a finding here is incorrect, tell us and we will re-check it. Corrections are applied to the underlying data, so they carry over to the API and to every other view of this address.
PublicAML reports what it can observe on-chain and what public and vendor sources say about an address. Nothing on this page is a legal finding, an allegation against a person, or advice. Risk scores describe exposure through transaction paths, and an address can carry exposure without its owner having done anything wrong.
Data is read live from the PublicAML API at the time this page was served.