DOJ to Seize $7.7M in Crypto Linked to Fraudulent North Korean IT Workers

Highlights:

• DOJ moves to seize $7.7M in crypto earned by North Korean IT workers using fake identities.
• North Korean workers hid earnings in stablecoins and funneled funds to weapons programs.
• Hackers created fake U.S. companies and used malware to target crypto developers.

The United States Department of Justice (DOJ) is taking steps to claim over $7.7 million in cryptocurrency. Officials say the money was secretly earned by North Korean IT workers who pretended to be freelancers from other countries. 

North Korean IT Workers Use Fake Identities to Finance Weapons Program

According to a civil complaint filed on Thursday in a Washington, D.C. court, the Justice Department said these workers got jobs at blockchain and tech companies. They used fake or stolen identities to pass as legitimate employees. The workers received their pay in cryptocurrency, mainly in stablecoins like USDC and USDT. They used tricky methods to hide where the money came from before sending it to the North Korean government. Officials said the aim was to bypass United States sanctions and fund North Korea’s weapons program.

The scheme was reportedly connected to Sim Hyon Sop, a representative of North Korea’s Foreign Trade Bank. Authorities formally indicted Sim for related offenses two years ago. He is believed to have worked with Kim Sang Man, the CEO of Chinyong, a North Korean IT company tied to the country’s Ministry of Defense.

To hide the origin of the funds, the individuals involved reportedly used various deceptive methods. These included creating fake identities to open accounts, breaking transactions into smaller pieces, and using token-swapping to mask the flow of money. They also bought NFTs, treating them as a way to store value.

Department Files Civil Forfeiture Complaint Against Over $7.74M Laundered on Behalf of the North Korean Government

: https://t.co/T6nh2ETMYY pic.twitter.com/o23HY6C6Zw

— U.S. Department of Justice (@TheJusticeDept) June 5, 2025

The DOJ revealed that a complex network of platforms and middlemen moved the money before funneling it back to the North Korean regime. Matthew Galeotti, who leads the DOJ’s Criminal Division, said this case once again shows how North Korea abuses the crypto space to finance unlawful goals. “The Department will use every legal tool at its disposal to safeguard the cryptocurrency ecosystem and deny North Korea its ill-gotten gains in violation of US sanctions,” he stated.

North Korea’s Growing Crypto Infiltration and Fraud Schemes

In recent years, North Korea has increased its attempts to enter the cryptocurrency sector to raise funds for its regime. An April report from Google’s Threat Intelligence Group revealed that North Korea has broadened its infiltration attempts to target blockchain companies beyond the United States. This expansion notably focuses on Europe, following tighter oversight by authorities.

Last August, blockchain researcher ZachXBT revealed proof of an advanced network of North Korean developers. These developers reportedly earn up to $500K per month by working on well-known crypto projects.

1/ Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed.

Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities.

I then uncovered 25+ crypto projects with… pic.twitter.com/W7SgY97Rd8

— ZachXBT (@zachxbt) August 15, 2024

A recent report revealed that North Korean hackers set up seemingly genuine companies in the U.S. to penetrate the crypto industry. They targeted unsuspecting developers with fake job offers. The Japanese Times reported that these attackers used official business registrations, corporate fronts, and social engineering tactics to hide their real identities behind American company covers. They deployed malware until the FBI intervened.