Affordable wallet screening for DPRK-linked crypto theft

What to build

A lightweight wallet/address risk-screening API and browser extension for small crypto exchanges, DeFi protocols, and retail traders — ingesting the OFAC SDN list plus public Lazarus Group/DPRK-linked address clusters to flag sanctioned or high-risk counterparties on deposit/withdrawal and in-wallet transfers in real time.

The record USD 6.36B Binance hack by North Korea-linked actors is pushing smaller exchanges and DeFi teams to add basic sanctions screening, but enterprise tools like Chainalysis are priced out of their reach, leaving room for a cheap, public-data-driven alternative.

Demand

Smaller exchanges, DeFi protocols, and retail users who can't afford enterprise-grade compliance platforms want a fast way to check if an address is sanctioned or DPRK-linked, especially now that regulators and users are on edge after the largest crypto hack ever recorded.

• Hacker NewsEngagement

  31 points, 3 comments on HN for the TRM Labs writeup on the USD 6.36B Binance hack — high engagement relative to typical crypto-security posts at the source

• OFAC SDN ListRegulatory

  Publicly maintained sanctions list including DPRK/Lazarus-linked wallet addresses, usable today as the seed dataset for a screening tool without needing a paid data vendor

• Chainalysis / Elliptic pricing modelMarket

  Enterprise blockchain compliance platforms sell primarily to exchanges and institutions via annual contracts, a price point widely known to exclude smaller exchanges, DeFi protocols, and individual builders

Stack

• OFAC SDN List (public data feed)
• Etherscan / Blockchain.com / BTC.com APIs for on-chain lookups
• Chainabuse / public DPRK address lists (community-compiled)
• Node.js or Python backend (FastAPI) for the screening API
• Telegram Bot API or Discord.js for bot distribution
• Chrome Extension Manifest V3 for the browser-extension front end

Solo + AI difficulty

Easy to MVP in 1-2 weeks: pulling and normalizing the OFAC list and known DPRK address sets into a lookup API is straightforward for one builder with AI help. The hard part is the clustering/heuristics layer for detecting newly-laundered or chain-hopped funds — without that, the tool degrades to a static blocklist checker, which is still shippable but far weaker than Chainalysis-grade detection.

Entry threshold

An MVP is buildable solo in days using public blockchain explorer APIs and published sanctions and threat-intel feeds, but winning paying enterprise compliance deals is hard since Chainalysis, TRM Labs, and Elliptic already dominate that segment.

Window

6-12 months

Where to find first users

• r/CryptoCurrency and r/defi
• Crypto-compliance and Web3 security Telegram/Discord communities
• Product Hunt launch targeting crypto/dev tools
• Direct outreach to small exchange and DeFi protocol founders on Twitter/X

Competitors

• Chainalysis
• Elliptic
• TRM Labs
• MistTrack

Counter-signals & risks

• Historical match is 'none' and the signal score is low (0.47), suggesting weak confirmation or limited corroborating sources for the claimed USD 6.36B figure.

• Public/open-source address lists and heuristics lag behind real-time laundering techniques like mixers and chain-hopping, limiting a lightweight tool's effectiveness versus enterprise solutions.

• A lightweight compliance tool built by a small team carries real regulatory and liability risk — false negatives or positives could expose both the relying exchange and the tool's provider to legal and reputational harm.