U.S. imposes sanctions on six individuals and two firms involved in laundering $800 million in cryptocurrency for North Korea.

The Treasury Department reported that North Korea deployed IT personnel into U.S. companies and redirected their earnings back to the nation to finance weapons of mass destruction initiatives.

The Treasury Department’s OFAC office has imposed sanctions on individuals and organizations involved in laundering cryptocurrency to send back to North Korea. (Jesse Hamilton/CoinDesk)

What to know:

• The U.S. Treasury sanctioned six individuals and two companies for facilitating North Korea’s conversion of approximately $800 million into cryptocurrency in 2024 to launder funds for its weapons programs.
• Authorities stated that IT workers utilized counterfeit documents and stolen identities to secure employment, transferring the majority of their income back to Pyongyang and at times deploying malware to extract sensitive information.
• The sanctioned network reportedly employed various crypto tools, including exchanges, wallets, DeFi services, and cross-chain bridges, and was associated with 21 wallet addresses across prominent blockchains such as Ethereum, Tron, and Bitcoin.

The U.S. Treasury Department enacted sanctions against six individuals and two companies identified as aiding North Korea in converting $800 million in 2024 into cryptocurrency to launder the funds and support its weapons of mass destruction (WMD) initiatives.

The Treasury’s Office of Foreign Assets Control (OFAC) announced on Thursday that the operation placed IT workers in international firms and directed their incomes back to Pyongyang. The network operated across several nations, including Vietnam, Laos, and Spain, according to the Treasury.

The Democratic People’s Republic of Korea (DPRK) has long sought to exploit cryptocurrency protocols and networks to misappropriate and launder funds. Last year, hackers associated with the nation stole a record $2 billion in crypto, as reported by the blockchain analytics firm Chainalysis.

The sanctioned network depended on a combination of crypto infrastructure, including centralized exchanges, hosted wallets, decentralized finance (DeFi) services, and cross-chain bridges, to facilitate the movement of funds, Chainalysis elaborated in a post on its website.

OFAC’s designation included 21 crypto wallet addresses across various blockchains such as Ethereum, Tron, and Bitcoin, illustrating what Chainalysis researchers characterized as the DPRK’s increasingly multichain strategy for transferring and concealing illicit funds.

“The North Korean regime targets American enterprises through deceptive tactics executed by its overseas IT operatives, who manipulate sensitive data and extort companies for significant payments,” Secretary of the Treasury Scott Bessent stated in the announcement.

The Treasury reported that DPRK-affiliated teams employed fraudulent documentation, stolen identities, and fabricated personas to secure jobs with legitimate businesses, including those in the U.S. and allied nations.

The North Korean government allegedly appropriated most of the salaries earned by these overseas IT workers, amassing hundreds of millions of dollars for its WMD and ballistic missile initiatives. Some of the workers managed to implant malware into corporate networks to extract proprietary and sensitive data.

Among those sanctioned is Nguyen Quang Viet, CEO of Vietnam-based Quangvietdnbg International Services Co., who the Treasury indicated converted approximately $2.5 million into cryptocurrency for North Korean actors between mid-2023 and mid-2025.