North Korean IT Network Laundered $7.7M in Crypto Through U.S. Firms: DOJ Reveals

Calvin James

The U.S. Department of Justice has filed a civil forfeiture complaint targeting over $7.74 million in cryptocurrency allegedly laundered by North Korean IT workers. The complaint, filed in the U.S. District Court for the District of Columbia via an official press release, accuses the North Korean government of staging illegal employment schemes and exploiting the cryptocurrency ecosystem to evade international sanctions.

North Korean Government Accused of Laundering Millions in Crypto

According to court documents, North Korean IT workers acquired jobs with U.S. and global companies using fraudulent identities. The positions were obtained through stolen or falsified documentation that allowed them to bypass security protocols. Investigators found that many employers unknowingly hired these individuals, who received salaries in stablecoins such as USDC and USDT.

The funds were allegedly sent back to North Korea using layered laundering techniques. The IT workers converted tokens through chain-hopping, token-swapping, and used fictional identities to open accounts. They transferred small sums repeatedly, commingled proceeds, and used non-fungible tokens (NFTs) as a method to store and obscure funds.

The cryptocurrency was later funneled to high-level figures, including Sim Hyon Sop and Kim Sang Man. Sim is a representative of North Korea’s Foreign Trade Bank. Kim is the CEO of Chinyong, a company linked to North Korea’s Ministry of Defense. Both individuals were added to the U.S. Treasury’s Specially Designated Nationals list in 2023.

Remote Work Used to Avoid Sanctions

The Justice Department reported that North Korean IT workers operated from countries including China, Russia, and Laos. The workers were part of a larger operation coordinated by Chinyong. U.S. authorities determined that Chinyong employed entire delegations of IT specialists. These individuals worked remotely for blockchain companies, sometimes without employers realizing the workers’ origin.

The scheme enabled the North Korean government to generate revenue covertly. U.S. officials stated that this revenue supports national priorities, including weapons development. However, these operations directly violate U.S. sanctions that prohibit financial support to North Korea’s government and military entities.

The Department confirmed that more than $7.74 million in digital assets were seized before they could be transferred to North Korea. These assets were initially frozen in April 2023 as part of a larger investigation tied to an earlier indictment.

Federal Indictments and Strategic Disruptions

The complaint follows multiple criminal indictments filed against Sim Hyon Sop. Sim is charged with conspiracy to commit fraud and money laundering in coordination with North Korean workers and cryptocurrency traders. These actions form part of the Justice Department’s DPRK RevGen: Domestic Enabler Initiative.

Launched in March 2024, the initiative targets U.S. persons and foreign actors facilitating North Korea’s digital revenue operations. Earlier disruptions under this program occurred in May, August, and December of 2024, and again in January 2025. These efforts focus on remote employment fraud and crypto laundering networks linked to the DPRK.

The Department reported that this complaint aims to forfeit funds that were accumulated through illicit employment. These actions are not limited to criminal prosecution but are designed to dismantle North Korea’s financial networks that circumvent sanctions.

Investigators Trace Funds to Sanctioned Individuals and Military Ties

According to the press release, officials revealed that Kim Sang Man directed funds to Sim after collecting payments from the remote workers. Kim’s company, Chinyong, operates under North Korea’s Ministry of Defense, previously named the Ministry of the Peoples’ Armed Forces. OFAC designated the ministry as a Specially Designated National in June 2017.

Sim and Kim were both added to OFAC’s sanctions list in April and May of 2023. The designations followed evidence showing their direct roles in transmitting laundered cryptocurrency to support sanctioned North Korean institutions.

According to the forfeiture filing, the crypto trail demonstrated a deliberate attempt to obscure the origin and destination of digital funds. The operation employed U.S.-based accounts and false documentation to make the funds appear legitimate. Officials said these steps aimed to embed illicit proceeds into the global financial system.

FBI Warns of Emerging Cyber and Remote Work Threats

The FBI played a central role in this investigation through its Chicago Field Office and the agency’s Virtual Assets Unit. Assistant Director Roman Rozhavsky stated that the scheme involved defrauding American businesses by using stolen U.S. identities. He called it part of a “massive campaign” by the North Korean government to fund its authoritarian regime.

Rozhavsky urged American businesses employing remote workers to remain alert to the risk of identity fraud and foreign intrusion. He cited this case as evidence that North Korea continues to exploit U.S. economic systems through deceptive tactics.

The FBI, along with the Departments of State and Treasury, previously issued a joint advisory in May 2022 warning of North Korean IT threats. Follow-up alerts were released in October 2023 and again in May 2024. These advisories outlined indicators of fraud and explained how companies could detect suspicious activity. A final advisory in January 2025 added new concerns, including extortion and data theft by remote North Korean employees.

Legal Teams and Government Coordination

The case is being prosecuted by the Department’s Computer Crime and Intellectual Property Section, the National Security Cyber Section, and the Counterintelligence and Export Control Section. Assistant U.S. Attorneys from the District of Columbia are handling the forfeiture complaint.

The Department acknowledged support from the FBI and credited former Supervisory Special Agent Chris Wong for significant contributions. Officials confirmed that the forfeiture case aligns with broader U.S. policy on cyber-enabled financial threats.

The Department emphasized that the seizure of cryptocurrency marks another step in cutting off North Korea’s unauthorized revenue streams. The action aims to prevent these funds from contributing to the country’s weapons programs and sanctions violations.

No Broader Impact on Legal Crypto Use Reported

Officials clarified that the case targets individuals and operations that violate federal law and international sanctions. The forfeiture does not implicate lawful use of cryptocurrency or remote work. U.S. authorities emphasized that the case addresses specific illegal conduct with direct ties to sanctioned entities.

The Department reiterated that sanctions remain in force due to North Korea’s actions. These include prohibited nuclear development and illicit arms trade. Through initiatives like DPRK RevGen, the U.S. government aims to enforce financial restrictions and prevent further breaches by hostile actors.

Source