Chollima Group links the DeTankZone/Moonstone Sleet ecosystem to a broader cluster of DPRK IT workers it calls BABYLONGROUP, centered on web3 and blockchain development. The investigation says the supposedly legitimate predecessor DefiTankLand was likely developed primarily by DPRK IT workers before being reused in a North Korean APT campaign involving DeTankZone. The report traces personas, GitHub activity, freelancer profiles, and login evidence, including access from North Korean-operated IP space, to connect developers such as “Logan King” and related aliases. It also ties parts of the cluster to ICICB and ATARI blockchain/metaverse work in Dubai and notes a non-DPRK associate linked to FreeCity Market, broadening the picture of DPRK IT worker collaboration around crypto projects.