US Sanctions Six People and Two Companies Over $800 Million North Korea Crypto Laundering Scheme

The U.S. Treasury Department’s Office of Foreign Assets Control has sanctioned six individuals and two companies connected to a laundering network that generated approximately $800 million in 2024 alone to fund North Korea’s weapons programs.

The scheme’s mechanics distinguish it from previous state-sponsored crypto theft operations: rather than relying primarily on exchange hacks, the network built its revenue base on thousands of North Korean IT workers who infiltrated legitimate companies worldwide using stolen identities and fabricated personas.

The operation placed remote workers inside technology companies, including firms based in the United States, where they secured high-paying employment under false identities. Earnings were converted into cryptocurrency to bypass international sanctions before being funneled back to Pyongyang. Beyond the fundraising function, some workers reportedly went further, installing malware on employer systems to steal sensitive data or position the regime for future extortion. The $800 million figure covers 2024 alone, making this a single-year revenue stream of extraordinary scale for what is essentially a human resources operation disguised as legitimate employment. OFAC froze 21 cryptocurrency wallet addresses across Ethereum, Tron, and Bitcoin as part of the action.

Who Was Sanctioned and Where They Operated

The designations target facilitators spread across Vietnam, Laos, Spain, and North Korea itself, a geographic distribution that reflects the deliberate international structuring of the network. Amnokgang Technology Development Company, a North Korean firm, is accused of managing overseas IT worker delegations and obtaining military technology on behalf of the regime. Quangvietdnbg International Services Co., based in Vietnam, is identified as a conversion vehicle, with its CEO Nguyen Quang Viet accused of converting roughly $2.5 million into cryptocurrency for the regime between mid-2023 and mid-2025.

The individual designations fill out the network’s operational structure. Yun Song Guk is identified as a North Korean operative managing freelance workers in Boten, Laos, a special economic zone that has become a known hub for illicit financial activity in Southeast Asia. Do Phi Khanh and Hoang Van Nguyen are described as Vietnamese proxies used to open bank accounts and procure foreign currency, providing the fiat on-ramps and off-ramps that any crypto conversion operation requires at its edges. York Louis Celestino Herrera, a dual national based in Spain, allegedly supported IT service contracts that provided cover for the network’s worker placements. Hoang Minh Quang handled financial transactions connected to the broader IT network.

The Conversion Infrastructure Behind the Scheme

The crypto element of the operation served a specific and practical function. North Korean workers receiving legitimate employment income in U.S. dollars or other major currencies face the problem of moving that money to Pyongyang through a global financial system that is specifically designed to block it. Cryptocurrency provided the conversion layer that made the transfer possible, with operatives moving earnings through wallets across Ethereum, Tron, and Bitcoin before the funds reached their final destination. Tron’s prevalence as a USDT settlement layer makes it a recurring fixture in North Korean laundering cases, and its appearance alongside Ethereum and Bitcoin in the frozen wallet list is consistent with patterns identified in prior enforcement actions.

The 21 wallet addresses frozen across the three chains represent the identifiable endpoints of a network that almost certainly used many more addresses in the conversion process. Blockchain analytics firm Chainalysis, which tracks North Korean crypto flows, has documented how these operations use layered wallet structures to obscure the chain of custody between initial receipt of funds and final conversion.

Where This Fits in the Broader Enforcement Effort

Treasury framed the action as part of a whole-of-government effort to disrupt North Korea’s use of digital assets, a campaign that has escalated significantly since the Lazarus Group’s attribution to the February 2025 Bybit hack, in which approximately $1.5 billion in ETH was stolen in the largest single crypto theft on record. The IT worker scheme and the exchange hacking operations are parallel tracks of the same underlying strategy: generate cryptocurrency revenue at scale, convert it into usable funds, and move it to Pyongyang outside the reach of conventional sanctions enforcement.

The sanctions designation of physical individuals and companies operating across multiple jurisdictions signals that OFAC is attempting to attack the human infrastructure of these networks rather than only the wallet addresses at their endpoints. Freezing wallets disrupts specific conversion pathways but leaves the human network intact to establish new ones. Designating the individuals who manage worker delegations, open bank accounts, and execute financial transactions raises the operational cost of rebuilding those pathways by removing the specific people with the relationships and knowledge to run them.

Whether that approach produces durable disruption or simply forces the network to recruit new facilitators is the question that prior enforcement actions have not yet definitively answered.

The post US Sanctions Six People and Two Companies Over $800 Million North Korea Crypto Laundering Scheme  appeared first on ETHNews.