US Treasury Sanctions North Korean IT Fraud Network and Crypto-Laundering Channels

North Korea has been accused of dispatching IT workers under stolen or fabricated identities to secure remote jobs abroad, remit salaries to sanctioned state agencies and gain legitimate access to source code and internal systems. The scheme turns recruitment into an insider-security risk, particularly for crypto companies. In a separate case, the U.S. Justice Department said in April 2026 that two American facilitators helped place workers at more than 100 U.S. companies using at least 80 stolen identities, generating more than $5 million for North Korea.

Researchers Mauro Eldritch of BCA LTD, Heiner García of NorthScan and ANY.RUN built a fictitious DeFi startup, Ballena Azul, and hired three people they assessed as suspected Famous Chollima operatives. The findings were presented at DEF CON 34 in Las Vegas in August 2026 and reported on Aug. 11. On their first day, all three profiled assigned virtual machines and checked the apparent location of their connections; investigators also observed AstrillVPN, 2fa.cn and AI job-interview tools. The controlled systems exposed operational behavior and infrastructure without granting access to a real company.

North Korea has long been accused of stealing digital assets to evade international sanctions and generate foreign currency. The Royal United Services Institute, a UK think tank known as RUSI, said Pyongyang is increasingly relying on established criminal networks and scam groups to process illicit proceeds, making the money trail harder to follow and raising sanctions-compliance risks for financial institutions worldwide.

North Korea stole at least $2.8 billion in cryptocurrency during 2024 and 2025, according to RUSI’s latest report. The assets were sold at a discount or blended with proceeds from scams before underground money brokers in Southeast Asia converted them into cash. RUSI said the laundering chain allows Pyongyang to turn stolen crypto into usable funds that can help finance its weapons programs.

North Korea’s central bank oversees currency issuance and state funds, while the Foreign Trade Bank handles foreign payments and currency transactions. The alleged ring included veterans of a military intelligence cyber-operations unit and IT specialists recruited from leading universities. Their suspected use of state-developed hacking expertise against two pillars of the country’s financial system marks an unusual insider breach and exposes vulnerabilities within an apparatus better known for conducting cyber theft abroad.

Daily NK reported on July 24 that North Korea’s security agency raided a Pyongyang safe house on the night of July 12, 2026, arresting alleged ringleaders and IT personnel. Investigators said the group diverted trade funds and foreign currency in small increments, sent them to overseas crypto wallets and used brokers in China to convert the assets into U.S. dollars and Chinese yuan. Authorities did not disclose the amount stolen or the number arrested, but reportedly seized computer equipment worth hundreds of thousands of dollars.

North Korea has long used state-backed hackers to steal crypto assets and evade international sanctions. The United Nations and cybersecurity researchers say the proceeds have funded nuclear weapons and ballistic missile programs, turning attacks on exchanges from financial crimes into global security and non-proliferation concerns.

G7 leaders adopted a statement at their June 15–17, 2026 summit in Évian-les-Bains, France, reaffirming the need for joint action against North Korean crypto theft and cybercrime. Chainalysis estimates that North Korean hackers stole $2.02 billion in 2025, up 51% from a year earlier, bringing their cumulative haul to at least $6.75 billion.

North Korea has long deployed IT workers using stolen or false identities to apply for overseas remote jobs. U.S.-based accomplices receive company laptops on their behalf and install remote-access software, making the workers appear to be located in the United States. The scheme generates revenue for the sanctioned North Korean regime while giving its personnel access to corporate networks. Cryptocurrency companies are especially attractive targets because they hold readily transferable assets and operate critical infrastructure.

The U.S. Justice Department said on May 6, 2026, that Matthew Isaac Knoot and Erick Ntekereze Prince had each been sentenced to 18 months in prison. The two cases affected nearly 70 U.S. companies and generated more than $1.2 million for North Korea. Knoot was sentenced on May 1 and ordered to pay $15,100 in restitution and forfeit another $15,100. Prince was sentenced on May 6 and ordered to forfeit $89,000.

North Korea has long used overseas IT workers posing as job applicants to infiltrate crypto projects and gain salaries, system access and digital assets. The network uncovered by blockchain investigator ZachXBT involved about 140 people, indicating that the operation had developed into a sizable, sustainable source of foreign currency that could help North Korea evade international sanctions.

As of July 19, 2026, data released by ZachXBT showed that the team earned about $1 million a month from IT jobs and crypto scams. Members used simple passwords such as “123456” to manage payment and ranking platforms. Stolen crypto was converted into fiat currency and then transferred to Chinese bank accounts.