DWF Labs was likely compromised in September 2022 in an incident assessed as linked to the DPRK-affiliated AppleJeus threat actor. The compromise reportedly exposed both private keys and exchange-account credentials, enabling attackers to drain at least $44 million in predominantly stablecoin assets over several hours and again the following day. The stolen funds were bridged from Ethereum to Bitcoin, remained largely dormant, and were later routed through a custodial mixer; portions also commingled with proceeds from other AppleJeus-linked thefts. DWF Labs had not publicly confirmed the incident as of November 2025.