A blockchain investigation links recent exploits against Matt Furie and ChainSaw NFT projects and Favrr to a cluster of suspected DPRK IT workers who may have been hired as developers. The ChainSaw-related activity involved transferring contract ownership to 0x9Fca, unpausing mints, minting NFTs, and selling into bids, with estimated losses above $310,000 across Replicandy, Peplicator, Hedz, and Zogz. The Favrr incident is described as a separate $680,000-plus exploitation tied through payroll flows, consolidation wallets, a Gate deposit address, and a suspicious CTO persona. The reporting highlights GitHub accounts, wallets, exchange deposits to MEXC and Gate, VPN/language/time-zone anomalies, and payroll trails as evidence for DPRK IT worker infiltration risk in Web3 teams.