TLDR:
- OFAC sanctions target six individuals tied to a DPRK IT worker scheme that generated nearly $800M in 2024 revenue.
- Treasury lists 21 crypto addresses across Ethereum, Tron, and Bitcoin linked to DPRK-linked financial networks.
- A Vietnam-based facilitator converted about $2.5M into crypto for North Korean workers between 2023 and 2025.
- Chainalysis says DPRK networks used exchanges, DeFi platforms, wallets, and bridges to move illicit funds globally.
North Korea’s global IT worker scheme has drawn new sanctions after investigators traced hundreds of millions in illicit earnings.
The U.S. Treasury Department targeted a network that allegedly moved funds through cryptocurrency channels. Authorities say the operation generated nearly $800 million in 2024 alone. The action highlights how digital assets continue to play a role in sanctions evasion.
OFAC Sanctions Expose Crypto Network Behind DPRK IT Worker Scheme
The U.S. Treasury’s Office of Foreign Assets Control sanctioned six individuals and two entities on March 12, 2026.
Authorities linked them to North Korea’s overseas IT worker operations. Officials say the scheme generated large revenue streams that supported the country’s weapons programs.
According to the Treasury action, workers obtained jobs using stolen identities and fabricated credentials. Many targeted technology firms and other legitimate businesses.
Earnings from those jobs reportedly flowed back to the North Korean government.
The regime then collected most of those wages from workers stationed abroad. Treasury officials say those funds helped finance ballistic missile and weapons programs. The activity violated both U.S. and United Nations sanctions.
Cybersecurity firm Chainalysis described the operation as a coordinated global effort. The company said the network stretched across Vietnam, Laos, and Spain. It relied heavily on digital asset transfers to move funds internationally.
Cryptocurrency Addresses and Facilitators Linked to DPRK Operations
The sanctions designation included 21 cryptocurrency addresses across several blockchains. These addresses span networks such as Ethereum, Tron, and Bitcoin.
Officials say the multi-chain structure helped obscure the flow of funds.
Vietnam-based facilitator Nguyen Quang Viet played a central role in the operation. Treasury data shows he converted roughly $2.5 million into cryptocurrency between mid-2023 and mid-2025. Authorities say those funds came from North Korean IT worker earnings.
The addresses also link to Amnokgang Technology Development Company. The DPRK entity manages overseas IT worker delegations and procurement activities. Seven addresses tied to the organization appear on Ethereum and Tron networks.
Another individual, Yun Song Guk, led an IT worker group operating in Boten, Laos. Treasury investigators traced two Ethereum addresses connected to his operations. The addresses received payments tied to contract work and technology services.
Authorities also identified a Bitcoin wallet linked to Hoang Minh Quang. Treasury records show he coordinated more than $70,000 in transactions with Yun. Officials say the payments related to IT services performed by North Korean workers.
The Treasury action also updated sanctions tied to Sim Hyon Sop. He represents Korea Kwangson Banking Corp in China. Authorities added eleven new cryptocurrency addresses connected to his financial network.
Chainalysis said the designated entities relied on common crypto services. These included hosted wallets, exchanges, decentralized finance platforms, and cross-chain bridges.
The firm said its monitoring systems now flag interactions with the sanctioned addresses.
Officials continue to warn crypto companies about the risks of such schemes. Treasury guidance urges exchanges and service providers to screen counterparties carefully.
Authorities also recommend monitoring unusual payment patterns linked to overseas IT work.
