How North Korean IT specialists bypass sanctions and earn millions

The Office of Foreign Assets Control (OFAC) has imposed sanctions on six individuals and two organizations that helped implement schemes involving IT specialists from North Korea. According to estimates, these schemes generated about $800 million in 2024 alone, funds that may have been directed to finance the country’s military programs.

One key intermediary helped convert about $2.5 million into cryptocurrency between mid-2023 and mid-2025. These networks operated across several countries, including Vietnam, Laos, and Spain, using cryptocurrency to move funds.

These measures are part of a broader policy by the U.S. Treasury aimed at disrupting schemes through which North Korea generates revenue while bypassing international sanctions. GetBlock AML Research publishes new details from the investigation into North Korean hacking groups and the cryptocurrency laundering networks connected to them.

Sanctions by OFAC against the IT specialist network

On March 12, 2026, OFAC announced sanctions against six individuals and two entities linked to fraudulent schemes organized by the North Korean government.

These schemes targeted companies, including American firms, and generated significant revenue. According to authorities, the funds were used to finance programs related to weapons of mass destruction and ballistic missile development.

How fake IT employment schemes operate

Schemes involving North Korean IT specialists are considered a complex and growing threat to businesses. People involved in these schemes obtain jobs at foreign companies using forged documents, stolen identities, and fabricated biographies. Outwardly they appear to be ordinary remote employees.

However, a significant portion of their income is reportedly transferred to the state. As a result, hundreds of millions of dollars may be funneled into government programs while bypassing sanctions.

In some cases, these workers also deployed malicious software within company systems to gain access to sensitive information. Such data was sometimes later used to extort money from the companies.

The role of cryptocurrency in North Korea’s sanctions evasion

Cryptocurrency plays a key role in moving funds obtained through these schemes. It allows money to be transferred between countries while bypassing restrictions and oversight.

Under the new sanctions, 21 cryptocurrency addresses across different blockchain networks were identified. This indicates that multiple technologies are being used to conceal the movement of funds.

Intermediaries and companies involved in financial operations

Nguyen Quang Viet, head of a company in Vietnam, provided currency exchange services for North Korean nationals. According to OFAC, between 2023 and 2025 he helped convert about $2.5 million into cryptocurrency, including funds obtained through IT schemes.

These operations were linked to Amnokgang Technology Development Company — a North Korean organization that manages groups of IT workers abroad.

North Korean national Yun Song Guk was also sanctioned. Since at least 2023, he has managed a group of IT specialists in Laos.

Hoang Minh Quang was also noted for participating in financial operations totaling more than $70,000 related to IT services.

In addition, information was updated regarding Sim Hyon Sop, previously added to the sanctions list and linked to a North Korean banking structure. New cryptocurrency addresses were added to his profile.

How cryptocurrencies are used to evade sanctions

OFAC’s actions are part of a long-term strategy to combat the use of cryptocurrency to bypass sanctions. North Korea increasingly relies on digital assets to generate revenue. This includes:

• employment of IT specialists under false identities
• cyberattacks and hacks
• ransomware attacks

Scheme of illicit crypto asset transfers through addresses linked to Amnokgang Technology Development Company. Visualization by Chainalysis.

Multiple blockchain networks are used to transfer funds, making transactions more difficult to trace.

Risks for businesses and compliance recommendations

Companies working with cryptocurrency should consider these risks. It is recommended to screen counterparties against sanctions lists, pay attention to suspicious employment schemes, and monitor unusual payments.

Particular attention should be paid to transactions linked to Southeast Asian countries, where such networks were reportedly active. Businesses are also advised to review warnings previously issued by the FBI and other U.S. government agencies to better understand the indicators of such schemes.