Uppsala Security analyzed the October 2023 Fantom Foundation hot-wallet theft after reports that about $550,000 in cryptocurrency was drained through a vulnerability in the official Fantom wallet. The stolen assets included ETH, stablecoins, and multiple ERC20 tokens that moved to two primary attacker addresses before being swapped into ETH. Uppsala used CAMS to track 68 origin hashes, nine origin wallets, and 36 initial tokens, then followed the consolidated ETH to 0x0b1F29DF74A19C44745862ab018D925501FE9596. The source is a wallet-transaction investigation and does not name a DPRK-linked actor.