US sanctions network tied to $800M DPRK crypto scheme as IT worker fraud moves illicit funds across global blockchain networks.
The United States sanctioned a network linked to North Korea’s crypto funding operations. The action targets individuals and entities tied to IT worker fraud schemes.
According to Chainalysis, the operation generated nearly $800 million in 2024.
U.S. authorities say the funds supported the Democratic People’s Republic of Korea’s weapons programs. The Treasury Department announced the sanctions through the Office of Foreign Assets Control on March 12.
Today, OFAC designated six individuals and two entities for facilitating North Korean IT worker schemes that generated nearly $800 million in 2024 to fund the DPRK's weapons programs. The action targets networks in Vietnam, Laos, and Spain that used crypto to move illicit…
— Chainalysis (@chainalysis) March 12, 2026
DPRK IT Worker Fraud Scheme Targets Global Businesses
North Korea uses overseas IT workers to infiltrate legitimate companies.
Authorities say these workers hide their identities using stolen documents and fabricated profiles. They secure remote employment with firms across multiple countries, including the United States.
According to Chainalysis, the regime collects most of the wages earned abroad. The funds move back to North Korea through controlled financial channels.
Officials say this system funnels hundreds of millions of dollars to state weapons programs.
Investigators also link some workers to cyber intrusion activities.
In certain cases, they install malware inside corporate networks. This access allows them to collect confidential data and demand payments from affected companies.
The Treasury Department sanctioned six individuals and two entities involved in these operations. Authorities say the network operated across Vietnam, Laos, and Spain.
These locations served as hubs for coordination and financial transfers tied to the scheme.
Related reading: Chainalysis Flags Hundreds of Millions in Crypto Tied to Trafficking Groups
Crypto Network-Enabled Multi-Chain Fund Transfers
Crypto played a central role in the operation. Authorities designated 21 digital asset addresses linked to the sanctioned network.
The addresses span several blockchain ecosystems.
Chainalysis reported that the network used both Ethereum and Tron wallets to move funds. Investigators say the structure allowed operators to distribute and obscure transaction flows. This approach helped move earnings generated through fraudulent IT work.
The sanctions also target Nguyen Quang Viet, chief executive of Quangvietdnbg International Services Company Limited.
According to OFAC, Nguyen converted about $2.5 million into cryptocurrency between mid 2023 and mid 2025. Officials say the funds came from North Korean IT worker activity.
Authorities also linked the scheme to Amnokgang Technology Development Company. The DPRK firm manages overseas IT worker delegations. Officials designated seven cryptocurrency addresses connected to the company across Ethereum and Tron networks.
Another sanctioned individual, Yun Song Guk, reportedly led a group of North Korean IT workers in Boten, Laos.
OFAC listed two Ethereum addresses tied to Yun’s operations. Investigators also identified transactions between Yun and Hoang Minh Quang related to IT services payments.
The Treasury Department also updated sanctions against Sim Hyon Sop. Officials added 11 cryptocurrency addresses tied to the previously designated representative of Korea Kwangson Banking Corp. The addresses operate across Ethereum and Tron blockchains.
Chainalysis said the designations reflect a broader pattern of North Korean crypto activity. The country increasingly uses digital assets to evade sanctions and move funds globally.
Past operations include cyber theft, ransomware attacks, and large-scale crypto hacks.
Officials say businesses should monitor counterparties for sanctions exposure. Chainalysis noted that crypto firms must screen addresses against updated OFAC lists.
Enhanced due diligence remains critical, especially for services operating in Southeast Asia.
The blockchain analytics firm confirmed it has labeled the designated addresses within its monitoring systems. According to Chainalysis, its compliance tools now trigger alerts for transactions involving these sanctioned wallets.
Authorities continue efforts to disrupt North Korea’s financial networks. Investigators say digital assets remain a major channel for sanctions evasion tied to state programs.
