U.S. Strikes DPRK Cybercriminals Laundering Crypto Funds
- U.S. sanctions DPRK bankers and firms for laundering crypto tied to weapons funding.
- Treasury links $3B in stolen crypto to North Korea’s state-backed cyber operations.
- OFAC freezes assets and warns global banks against aiding DPRK crypto networks.
The United States Treasury Department has sanctioned eight individuals and two organizations that have been alleged to launder money using the Democratic People’s Republic of Korea (DPRK), concerning state-sponsored cybercrime and rogue IT activities of North Korea. The Office of Foreign Assets Control (OFAC) announced the designations are aimed at networks that transfer stolen cryptocurrency and other assets that support the weapons development programs by Pyongyang.
Treasury Cracks Down on DPRK Crypto Laundering
According to Under Secretary of Terrorism and Financial Intelligence John K. Hurley, the sanctioned parties have been playing a key role in assisting the regime to fund its nuclear and missile activities. He said that North Korean hackers steal and launder money to finance the nuclear weapons program of their regime, and this kind of activity poses a direct challenge to stability in the world. The Treasury stressed that the new steps are meant to block key financial streams, which sustain these activities.
The initiative taken by OFAC is based on the findings of the Multilateral Sanctions Monitoring Team (MSMT), which outlined North Korea’s increased use of cyber and IT tactics to bypass U.N. sanctions. The report revealed that there are current trends of cyber theft, such as cryptocurrency theft heists, and exploitation of international IT freelance portals by North Korean workers using fake identities. The schemes have in past years returned billions of dollars to the regime.
The Treasury estimates that North Korean cybercriminals have stolen over $3 billion in cryptocurrency over the past three years. They use sophisticated malware and social engineering tactics to breach financial systems globally. The money obtained illegally is subsequently washed through shell companies, digital asset mixers, and cooperative foreign intermediaries.
OFAC Names DPRK Bankers in $5M Crypto Case
Bankers Jang Kuk Chol and Ho Jong Son are reportedly associated with more than $5.3 million in cryptocurrency linked to OFAC-designated First Credit Bank. According to the Treasury Department, some of those funds could be traced to ransomware attacks on U.S. organizations and revenue earned by foreign DPRK IT employees.
Korea Mangyongdae Computer Technology Company (KMCTC) and its president, U Yong Su, were also sanctioned by OFAC for operating IT worker delegations in China and for using local proxies to conceal financial transactions. The company is said to be based in the Chinese cities of Shenyang and Dandong, where the foreign payments are organized.
In addition to KMCTC, the Treasury targeted Ryujong Credit Bank, which was alleged to have offered financial services facilitating cross-border transactions between China and North Korea. Treasury officials said that the bank has been helping remit foreign earnings in cash and laundering money on behalf of North Korean foreign employees.
Related: North Korean Hackers Pull off Record $2B Crypto Theft in 2025
U.S. Freezes DPRK Assets in Global Sanctions Push
Some of the individuals include Ho Yong Chol, Han Hong Gil, Jong Sung Hyok, Choe Chun Pom, and Ri Jin Hyok, who are the North Korean financial representatives in China and Russia. They supposedly communicated millions of U.S. and Chinese dollars using fictitious companies and approved banks. They also participate in coordinating transactions for organizations such as Korea Daesong Bank, Koryo Commercial Bank, and the Central Bank of DPRK.
The network facilitates opportunities for Pyongyang to evade restrictions and keep its weapons systems operational through intermediaries and cryptocurrency. OFAC said today that it is due to ongoing efforts to shut down such financial structures, thereby denying them access to international markets.
Due to these sanctions, any U.S.-connected assets of the specified individuals and corporations are frozen, and American companies are forbidden from transacting with them. Financial institutions worldwide have also been cautioned that they may face secondary sanctions for dealing with such actors. Treasury officials restated that it is aimed at disrupting revenue streams that finance North Korea’s weapons ambitions without impairing international financial integrity.
