Nick Bax

Overview

Nick Bax is a blockchain researcher and forensic investigator best known for two public contributions: helping trace a wave of six-figure cryptocurrency heists to cracked LastPass password vaults, and debunking a watchdog claim that North Korea’s Lazarus Group bought into World Liberty Financial — a false positive, he showed, produced by a joke memecoin contract called Dream Cash (Cointelegraph).

Bax publishes DPRK (North Korean) crypto research under the handle Nick Bax.eth (@bax1337), and is associated with the cryptocurrency-analysis firm Five I’s — an independent hack-investigation report acknowledged “Nick Bax from Five I’s” among its contributors (Maverick Founder report). Krebs on Security identified him in 2023 as director of analytics at Unciphered, a cryptocurrency wallet recovery company (Krebs on Security). He is also a co-developer of Ump.eth, a decentralized marketplace protocol, alongside an engineer known as Barabazs (Bitget Web3), and a Convex Labs job posting describes him as leading its Blockchain Intelligence Team (Web3.career). Note: this profile is not about the British graphic designer of the same name (born 1970, formerly of The Designers Republic) — a different person (Wikipedia disambiguation).

Tracing the LastPass-breach crypto heists

From late December 2022, Bax worked with MetaMask’s Taylor Monahan to investigate a wave of high-dollar cryptocurrency thefts targeting security-conscious people across the crypto industry (Krebs on Security). They connected more than 150 victims and over $35 million in stolen crypto to a single likely cause: thieves cracking master passwords from the vaults stolen in the 2022 LastPass breach (Krebs on Security). The victims had not suffered the precursor attacks that usually precede big crypto thefts — no email or phone compromises, no SIM swaps — but had all stored their wallet seed phrases in LastPass’s “Secure Notes” area before the breaches (Krebs on Security). The researchers also found the attackers repeatedly funneled different victims’ funds into the same destination wallets across exchanges, which let them link cases together and even identify a multi-million-dollar victim employed at Chainalysis, the blockchain-analysis firm (Krebs on Security). Bax ran his own analysis over the collected theft data and reached the same conclusion Monahan had reported (Krebs on Security). In March 2025, the U.S. Secret Service and FBI effectively corroborated the findings in a seizure filing tied to a $150 million heist against Ripple co-founder Chris Larsen, and Bax told Krebs the corroboration was “validating” — though he added he would rather see fewer hacks in the first place (Krebs on Security). LastPass, for its part, has said it has seen no definitive proof linking the thefts to its breaches (Krebs on Security).

The Dream Cash false positive: how a joke memecoin broke the forensics

In September 2025, the watchdog group Accountable.US published “American Sell-Out,” alleging that World Liberty Financial had sold tokens to buyers tied to sanctioned networks — including, centrally, a claim that the wallet Shryder.eth had made dozens of transactions with a Treasury-sanctioned Lazarus Group wallet (Cointelegraph). Senators Elizabeth Warren and Jack Reed cited the report in a November 17, 2025 letter asking the Attorney General and Treasury Secretary to investigate the firm (Cointelegraph). Bax, who does his own DPRK crypto research, reviewed the cited transactions and concluded they were false positives: the supposed “Lazarus-linked” activity was generated by a joke memecoin contract called Dream Cash, which automatically routes tokens from an address labeled as Lazarus Group to anyone who claims them — and the independent user behind the wallet had claimed them as a joke, not transacted with North Korea (Cointelegraph). “The worst part of this all (other than my Senator disseminating disinfo), is Shryder wasn’t just falsely accused of being a DPRK hacker; it appears his big bag WLFI tokens (~$95k) got frozen as a result of this false positive,” Bax wrote (Cointelegraph). The case illustrates a hazard his work highlights: smart contracts that auto-route tokens make raw address-to-address proximity a meaningless signal, and label-based attribution that skips contract-behavior analysis can falsely accuse — and financially freeze — innocent users (Cointelegraph).

DPRK threat research and incident response

Bax is a white-hat hacker with the Security Alliance, the nonprofit collective of blockchain security specialists, and has taken part in its SEAL 911 incident-response work, including the Loopscale case (Hedge With Crypto; Incrypted). In the Ethereum Foundation’s six-month ETH Rangers program, run with Secureum, The Red Guild, and the Security Alliance, Bax identified dozens of teams carrying DPRK-related risk factors, and program reporting says he independently notified more than 30 project teams that DPRK-linked workers were on their payrolls while coordinating the freezing of hundreds of thousands of dollars those operatives had already received (Incrypted; CoinSpeaker). He also produced a Fake VC warning video that executives credited with preventing hacks (CoinSpeaker). Separately, after the February 2025 Bybit hack, Bax estimated that the non-KYC exchange eXch had facilitated roughly $30 million in transactions for the Lazarus Group on February 23 — eXch denied laundering for Lazarus while conceding it had inadvertently processed some stolen funds (Hedge With Crypto). In March 2025 he warned that North Korean scammers were stealing millions through fake Zoom calls that trick targets into installing malware disguised as an audio-video fix (CoinMarketCap), and he separately detailed a Microsoft Teams variant in which attackers use fake podcast invites to win screen-control access and drain wallets (MEXC News).

Selected public investigations involving Nick Bax

Investigation	Year	Bax’s contribution	Reported outcome
LastPass-breach crypto heists	2023	Independently analyzed Monahan’s theft data; confirmed the cracked-vault link (Krebs)	FBI and Secret Service corroborated the findings in a 2025 seizure case (Krebs)
eXch / Bybit-hack laundering	2025	Estimated ~$30M in Lazarus transactions flowed through eXch (Hedge With Crypto)	eXch denied laundering, admitted processing some stolen funds (Hedge With Crypto)
Accountable.US “American Sell-Out” rebuttal	2025	Showed the “Lazarus link” was a Dream Cash memecoin false positive (Cointelegraph)	The watchdog report had already been cited in a Senate letter; ~$95k of the user’s WLFI was frozen (Cointelegraph)
Maverick Founder phishing hack	2023	Acknowledged contributor to the investigation (report)	Findings published by the independent research team (report)

FAQ

Who is Nick Bax? Nick Bax is a blockchain researcher and forensic investigator who publishes DPRK crypto research as @bax1337. He was director of analytics at the wallet-recovery firm Unciphered, is a white-hat hacker with the Security Alliance, and is associated with the analysis firm Five I’s (Krebs on Security; Cointelegraph).

What did Bax prove about the Accountable.US Lazarus allegation? He showed the supposed Lazarus Group transactions were false positives from Dream Cash, a joke memecoin contract that auto-routes tokens from a Lazarus-labeled address to anyone who claims them — the user claimed them as a joke, and roughly $95,000 of his WLFI was frozen anyway (Cointelegraph).

How did investigators connect the LastPass breach to the crypto heists? Bax and Taylor Monahan found victims shared no typical precursor attacks but had all stored seed phrases in LastPass “Secure Notes” before the 2022 breaches; thieves then funneled multiple victims’ funds into the same destination wallets (Krebs on Security). The FBI and Secret Service later corroborated this in a $150M seizure case (Krebs on Security).

What is SEAL 911? SEAL 911 is the incident-response arm of the Security Alliance, the white-hat hacker collective to which Bax belongs, and it handles live responses to active crypto exploits. Bax has taken part in its incident-response work, including the Loopscale case, and in the Ethereum Foundation’s ETH Rangers program alongside it (Incrypted).

What this profile does not claim

This profile does not claim Bax made any legal determination about sanctions violations — his published analysis was a technical rebuttal of one specific Lazarus allegation, not a ruling on the rest of the Accountable.US report’s claims about Iran, Russia, or Tornado Cash (Cointelegraph). It does not state his nationality or country of residence, because no source documents them. It does not claim he still works at Unciphered — the role is documented for 2023 (Krebs on Security). The “founder of Five I’s” title is attributed rather than verified, as explained in the open items. Finally, it does not treat the ETH Rangers outcome figures or the Convex Labs posting’s media-appearance claims as independently verified facts.