The U.S. Treasury sanctioned six individuals and two entities tied to a North Korean IT worker network that generated nearly $800 million in 2024. The action highlights how crypto rails remain central to sanctions evasion and illicit revenue streams funding Pyongyang’s weapons programs.
The designations were issued by the Office of Foreign Assets Control, which targeted facilitators operating across North Korea, Vietnam, Laos, and Spain. According to the Treasury, these operatives enabled North Korean workers to obtain remote jobs at U.S. companies while laundering earnings through cryptocurrency transactions. Assets linked to the designated individuals within the United States are now blocked and must be reported to authorities.
Among those sanctioned is Nguyen Quang Viet, who allegedly converted roughly $2.5 million into cryptocurrency for North Korean clients between mid-2023 and mid-2025. Treasury officials said part of those funds originated from workers tied to Amnokgang Technology Development Company, a previously sanctioned firm associated with DPRK cyber and procurement networks.
How Are North Korea’s Crypto Networks Funding Sanctions Evasion?
Authorities also designated Vietnamese national Hoang Van Nguyen for assisting sanctioned nuclear procurement agent Kim Se Un. According to Treasury, Nguyen helped open bank accounts and arranged crypto transfers while facilitating a counterfeit cigarette deal exceeding $200,000 in 2022.
The enforcement action extended to blockchain infrastructure used by the network. OFAC added multiple wallet addresses to its Specially Designated Nationals list, including three Ethereum addresses and four TRON addresses tied to Amnokgang Technology Development Company. Additional Ethereum and bitcoin addresses were linked to operators managing North Korean IT workers based in Boten, Laos.
The move comes as North Korea’s cyber operations continue expanding. Data from Chainalysis shows DPRK-linked hackers stole more than $2.17 billion in cryptocurrency during the first half of 2025 alone, already exceeding the total stolen during 2024. The largest incident was the February breach of Bybit, where attackers siphoned nearly $1.5 billion worth of ether.
Still, enforcement agencies face a persistent question: how effectively can sanctions disrupt decentralized financial flows once funds enter blockchain networks?
Treasury officials have indicated that identifying additional facilitators and wallet infrastructure remains a priority. Investigators are now expected to track whether the newly sanctioned addresses reappear through mixers, cross-chain bridges, or other obfuscation tools in the months ahead.
