Shryder

Overview

Shryder is a pseudonymous crypto trader known as @shryder1337 on X and as Shryder.eth on-chain, who bought 600,000 WLFI governance tokens for about $10,000 from World Liberty Financial on Donald Trump’s inauguration day, January 20, 2025 (TheStreet). Months later a watchdog report falsely linked him to North Korea’s Lazarus Group — a false positive caused by a joke memecoin contract — and roughly $95,000 of his tokens was frozen (CoinTelegraph).

Accountable.US’s September 18, 2025 report claimed his wallet had made at least 55 transactions with a wallet sanctioned by the U.S. Treasury’s OFAC for association with the Lazarus Group (Accountable.US). Blockchain researcher Nick Bax of Ump.eth independently reviewed the transactions and showed the link was an artifact of the Dream Cash memecoin contract, which automatically routes tokens from a Lazarus-labeled address to anyone who claims them; @shryder1337 had claimed them as a joke (CoinTelegraph).

The Inauguration Day purchase and the watchdog’s allegation

Accountable.US’s September 18, 2025 report opened its key findings with Shryder: on Inauguration Day, it said, the Trump-family venture World Liberty Financial sold 600,000 of its $WLFI tokens, valued at $10,000, to the trader “Shryder.eth,” who “appears to have made at least 55 transactions with a wallet now-sanctioned by the Treasury Department’s Office of Foreign Asset Control (OFAC) for being associated with the Lazarus Group” (Accountable.US). TheStreet added that the wallet had already been flagged by the automated screening tools of trading platform Uniswap and NFT marketplace OpenSea, yet WLFI kept it live until August 31, 2025, when it was finally blacklisted — after receiving a $47 airdrop of WLFI’s USD1 stablecoin (TheStreet). The report also flagged other buyers: a wallet that bought about 3,468 WLFI tokens after transacting on Nobitex, Iran’s largest crypto exchange; a wallet that bought over 10,000 tokens after touching A7A5, a ruble-backed token sanctioned in August 2025; and at least 62 wallets that had used the Tornado Cash mixer (TheStreet).

The Dream Cash false positive

The Lazarus allegation against Shryder collapsed under independent review. Bax examined the cited transactions and found they were false positives: the Dream Cash joke memecoin contract automatically routes tokens from a Lazarus-labeled address to anyone who claims them, and @shryder1337 had claimed them as a joke (CoinTelegraph). The mechanism: Dream Cash had set the Lazarus wallet as its contract owner, so when Shryder.eth claimed the token, the transfer appeared to come from the hacker group — “only a trick created by the contract setup” — and the analysts had treated the token claim as proof of a real link without checking the smart contract (The CoinRepublic). MetaMask security lead Taylor Monahan also challenged the analysis (The Block). Bax summed it up: “TL/DR: someone wrote 14 pages about Lazarus based on a funky shitcoin token transfer,” adding that the worst part was that Shryder wasn’t just falsely accused of being a DPRK hacker — his roughly $95,000 bag of WLFI tokens appeared to have been frozen as a result (The Block).

Frozen tokens and the Senate probe

The episode became political on November 17, 2025, when Senate Banking Committee Democrats Elizabeth Warren and Jack Reed wrote to Treasury Secretary Scott Bessent and Attorney General Pamela Bondi citing the Accountable.US findings, warning the sales “gave adversaries a seat at the table” and asking five questions, due December 1, 2025, on whether any inquiries were open into WLFI’s token sales (Standing Record; CoinTelegraph). WLFI denied wrongdoing, telling CNBC it had performed “rigorous AML/KYC checks” on all presale buyers and rejected millions of dollars from failed screenings (CoinTelegraph). The political weight was real: Eric Trump, Donald Trump Jr., and Barron Trump are co-founders, Donald Trump is “Co-Founder Emeritus,” and Trump-affiliated DT Marks DEFI LLC holds 22.5 billion WLFI tokens worth over $3 billion and is entitled to 75% of token-sale revenue (CoinTelegraph). Two days later, WLFI said a “relatively small subset of user wallets were compromised via phishing attacks or exposed seed phrases,” that it had frozen them in September 2025, and that verified users would have funds reallocated — “not a WLFI platform or smart contract issue” (The Block). The stakes in one stat: a wallet that paid about $10,000 for its WLFI position in January had roughly $95,000 frozen by November — a near-10x paper gain wiped out by an automated compliance action triggered by a misread contract (Accountable.US; CoinTelegraph).

Claim about Shryder’s wallet	What Accountable.US alleged	What independent researchers found
Link to Lazarus Group	At least 55 transactions with an OFAC-sanctioned wallet tied to the North Korean hacking team	The “link” was a Dream Cash memecoin claim routing tokens from a Lazarus-labeled address — no real interaction (CoinTelegraph)
The 600,000-token purchase	Sold to a sanctions-linked actor on Inauguration Day	The purchase itself is not disputed; the alleged sanctions link was the false positive (TheStreet)
Platform flags and freeze	Wallet flagged, blacklisted Aug 31, 2025	Same flags occurred — researchers say they reflect automated tag-matching, not verified wrongdoing (The CoinRepublic)
The frozen funds	Not addressed in the report	Roughly $95,000 in WLFI frozen as a result of the false positive (The Block)

Frequently asked questions

Who is Shryder? Shryder is the pseudonym of a crypto trader active on X as @shryder1337 and on-chain as Shryder.eth. No publicly verifiable source names his real identity, and this profile makes no claim about it. He became publicly known only through the 2025 WLFI false-positive episode (CoinTelegraph).

Why was Shryder linked to North Korea’s Lazarus Group? Accountable.US claimed his wallet made at least 55 transactions with an OFAC-sanctioned Lazarus-linked wallet. Nick Bax showed it was a false positive: the joke memecoin Dream Cash auto-routed tokens from a Lazarus-labeled address to anyone who claimed them, and Shryder had claimed them as a joke (CoinTelegraph).

What is Dream Cash? Dream Cash is a joke memecoin whose contract set a Lazarus-labeled wallet as its owner. Anyone claiming the token generated a transfer that appeared to come from the North Korean hacking team — a misleading trail with no actual group involvement (The CoinRepublic).

What happened to Shryder’s WLFI tokens? Bax reported roughly $95,000 in WLFI was frozen because of the false positive. WLFI separately said it froze affected wallets in September 2025 and would reallocate funds to verified users — but no source confirms whether Shryder’s funds were ever returned (CoinTelegraph; The Block).

Did the U.S. government investigate World Liberty Financial over this? On November 17, 2025, Senators Warren and Reed cited the Accountable.US report in a letter to Treasury Secretary Bessent and Attorney General Bondi, asking whether any inquiries were open into WLFI’s token sales and requesting answers to five questions by December 1, 2025 (Standing Record).

What this profile does not claim

This profile does not name or speculate about Shryder’s real-world identity — only the pseudonym, X handle, and ENS name documented in independent press. It does not take a position on Accountable.US’s wider findings beyond the Lazarus claim, which two independent security researchers specifically refuted; the report’s Nobitex, A7A5, and Tornado Cash findings are the report’s own assertions, not independently verified here. It does not claim the $95,000 freeze was ever reversed, nor that the August 31, 2025 blacklist and the September 2025 freeze were the same action. It does not present WLFI’s “rigorous AML/KYC” defense or the senators’ warning as findings — they are competing claims from interested parties.