U.S. Targets Crypto Laundering Network Backing North Korean Regime
U.S. seeks forfeiture of $7.74M in crypto tied to North Korean fake IT worker schemes funding weapons programs.
The U.S. Department of Justice has initiated civil forfeiture proceedings for $7.74 million in cryptocurrency and digital assets connected to North Korea’s widespread scheme of deploying fake IT workers abroad. The funds, currently frozen, stem from a broader investigation into cyber-enabled sanctions evasion efforts by the Pyongyang regime.
The crypto wallets in question are linked to Sim Hyon Sop, a representative of North Korea’s Foreign Trade Bank (FTB), who was indicted in April 2023 for laundering over $24 million in proceeds gained from fraudulent employment schemes. Between August 2021 and March 2023, Sim allegedly moved more than $15 million in illicit crypto through a complex laundering network.
North Korean nationals, using stolen or fabricated identities, obtained employment as freelance IT workers at legitimate technology companies worldwide, including in the United States. The operation, which has been active for years, funneled payments back to the regime to support its ballistic missile and cyber warfare programs. Workers were primarily based in China, Russia, and the United Arab Emirates.
As early as 2022, U.S. intelligence agencies warned that thousands of North Koreans were being dispatched to pose as remote developers or IT contractors. Each worker could reportedly earn upwards of $300,000 annually. These activities were designed to bypass international sanctions by masking the true identity and origin of the employees.
A series of legal actions have followed. In October 2023, the FBI seized $1.5 million and 17 domain names associated with the scheme. In May 2024, Arizona resident Christina Marie Chapman was charged with helping North Korean operatives obtain employment by falsely claiming U.S. citizenship. That operation alone generated over $6.8 million.
By December 2024, U.S. officials estimated that North Korean IT workers had successfully penetrated hundreds of companies, bringing in over $88 million across six years. The infiltration represented a severe threat to both national security and corporate data integrity.
The laundering network extended to figures such as Kim Sang Man, CEO of the North Korean IT company Chinyong and an affiliate of the Ministry of Defense. Kim, who used counterfeit Russian IDs to open crypto accounts, was sanctioned in 2023 alongside Chinyong.
This latest forfeiture push underscores the U.S. government’s commitment to dismantling North Korea’s illicit financing infrastructure. As cybercrime and state-backed digital manipulation evolve, Washington continues to expand its enforcement toolkit against threat actors leveraging cryptocurrency to fund authoritarian regimes.
