U.S. sanctions network that allegedly laundered $800 million in crypto for North Korea

The U.S. Treasury Department imposed sanctions on six individuals and two companies it says helped North Korea convert $800 million in 2024 into crypto to launder the money and fund its weapons of mass destruction (WMD) programs.

The Treasury’s Office of Foreign Assets Control (OFAC) said Thursday that the operation placed IT workers into foreign companies and channeled their earnings back to Pyongyang. The network operated across multiple countries including Vietnam, Laos and Spain, according to the Treasury.

The Democratic People’s Republic of Korea (DPRK) has for years targeted cryptocurrency protocols and networks to steal and launder funds. Last year, hackers linked to the country stole a record $2 billion of crypto, according to the blockchain analytics firm Chainalysis.

The sanctioned network relied on a mix of crypto infrastructure, including centralized exchanges, hosted wallets, decentralized finance (DeFi) services and cross-chain bridges, to facilitate movement of the funds, Chainalysis said in a post on its website.

OFAC’s designation included 21 crypto wallet addresses across several blockchains including Ethereum, Tron and Bitcoin, reflecting what the Chainalysis researchers described as the DPRK’s increasingly multichain approach to moving and obscuring illicit funds.

“The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” Secretary of the Treasury Scott Bessent said in the statement.

According to Treasury, DPRK-backed teams used fraudulent documentation, stolen identities, and fabricated personas to gain employment with legitimate companies, including those in the U.S. and allied countries.

The North Korean government then reportedly appropriated most of the wages earned by these overseas IT workers, generating hundreds of millions of dollars for its WMD and ballistic missile programs. Some of the workers were able to introduce malware into company networks to extract proprietary and sensitive information.

Among those sanctioned is Nguyen Quang Viet, CEO of Vietnam-based Quangvietdnbg International Services Co., whom the Treasury said converted roughly $2.5 million into cryptocurrency for North Korean actors between mid-2023 and mid-2025.