U.S. sanctions network tied to DPRK IT jobs and crypto laundering operation

The U.S. Department of the Treasury has imposed sanctions on a network accused of helping North Korea generate illicit revenue through overseas information technology workers and cryptocurrency transactions.

Summary

• The U.S. Treasury sanctioned individuals and entities tied to a North Korean IT worker fraud network.
• The scheme allegedly used stolen identities and remote IT jobs to generate funds.
• Officials say cryptocurrency was used to launder and transfer proceeds linked to Pyongyang’s weapons programs.

U.S. blacklists facilitators of DPRK scheme that used crypto to move illicit earnings

In a statement, the Treasury’s Office of Foreign Assets Control (OFAC) said the targeted individuals and entities facilitated a scheme in which North Korean IT workers obtained remote jobs using stolen identities and false personas, allowing them to earn income from companies around the world.

Officials say the wages from these jobs were often funneled back to the North Korean government, helping finance the country’s weapons of mass destruction and ballistic missile programs.

The regime has relied on such overseas workers to generate hundreds of millions of dollars annually.

According to the Treasury, the network also relied on cryptocurrency to move and disguise the proceeds. Facilitators allegedly converted digital assets into cash or used crypto transactions to obscure the origin of funds before transferring them to accounts linked to the regime.

The scheme typically involved North Korean developers posing as freelance programmers or software engineers on global contracting platforms. Using fabricated identities and stolen personal information, they secured jobs at unsuspecting firms in the United States and other countries.

In some cases, authorities say these operatives introduced malware into company networks or exfiltrated sensitive data once they gained access to corporate systems.

Treasury officials said the action forms part of a broader U.S. effort to cut off revenue streams that North Korea uses to evade international sanctions and finance its military programs.

The department added that the sanctions freeze any U.S.-based assets belonging to the designated individuals and entities and generally prohibit U.S. persons from engaging in transactions with them.

Washington has repeatedly warned that North Korea increasingly uses cybercrime, cryptocurrency theft and fraudulent IT work schemes to fund its weapons development, posing growing risks to global businesses and the digital asset ecosystem.