U.S. Treasury sanctions participants in North Korean IT worker scheme

Key points:

• The U.S. Treasury sanctioned six individuals and two companies connected to a North Korean IT worker network.
• The sanctions list also includes 21 cryptocurrency addresses on Ethereum and Tron.

The U.S. Department of the Treasury has imposed sanctions on six individuals and two companies suspected of participating in a fraudulent scheme involving IT specialists linked to North Korea. According to U.S. authorities, such operations frequently target cryptocurrency projects and companies in the blockchain sector.

The Office of Foreign Assets Control (OFAC) said the sanctions target members of a network operating across several countries, including North Korea, Vietnam, Laos, and Spain. According to the agency, these structures help generate revenue that may be used to support North Korea’s military programs.

The sanctions list includes the North Korean company Amnokgang Technology Development Company, which U.S. officials say coordinated IT workers operating abroad. Restrictions were also imposed on Nguyen Quang Viet, head of the Vietnamese firm Quangvietdnbg International Services Company Limited. U.S. authorities believe he may have helped launder roughly $2.5 million, using cryptocurrency to move funds within the network.

Hackers from North Korea stole more than $2,8 billion in cryptocurrency

According to the report, the country uses Russian and Asian channels to launder funds and finance nuclear programs

Читать дальше

Sanctions were also imposed on Do Phi Khanh, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, and York Luis Celestino Herrera. They are suspected of working with North Korean IT groups operating through overseas companies.

The sanctions freeze any assets belonging to these individuals within U.S. jurisdiction. They are also barred from conducting transactions with U.S. entities or engaging in financial activity involving the United States. Violations of these restrictions could result in civil or criminal penalties.

IT Worker Schemes Are Spreading Globally

Experts say IT workers linked to North Korea are actively seeking employment with foreign companies, including projects in the cryptocurrency industry. A Google report from April 2025 noted that the infrastructure behind these schemes is already operating across multiple regions worldwide.

OFAC also added 21 cryptocurrency addresses on the Ethereum and Tron networks to the sanctions list. Blockchain analytics firm Chainalysis said the use of multiple blockchains reflects North Korea’s growing multi-chain strategy for moving funds.

North Korea–linked hackers target crypto professionals with deepfake video calls

Attackers impersonate trusted contacts during video calls and persuade victims to install malware disguised as a technical fix

Читать дальше

According to analysts, these operations are becoming increasingly complex and large-scale. Participants in the schemes often use stolen identities and fabricated profiles to secure jobs at legitimate companies in different countries.

Chainalysis analysts also note that these workers may do more than simply collect salaries under false pretenses. In some cases, they have reportedly deployed malware within corporate systems, allowing them to access sensitive information and internal company data.