Cracking Down: U.S. Targets North Korean Entities in $12.7M Crypto and IT Fraud Scheme

The United States Treasury Department has announced sanctions against eight individuals and two entities connected to North Korea’s global financial network for their involvement in money laundering for various illicit activities, including cybercrime and fraudulent IT worker schemes.

Under Secretary of the Treasury for Terrorism and Financial Intelligence, John K. Hurley, stated that North Korean state-sponsored hackers engage in money laundering to finance the regime’s nuclear weapons program, posing a direct threat to U.S. and global security.

The sanctioned individuals and entities include Jang Kuk Chol (Jang), Ho Jong Son, Korea Mangyongdae Computer Technology Company (KMCTC), U Yong Su, Ryujong Credit Bank, Ho Yong Chol, Han Hong Gil, Jong Sung Hyok, Choe Chun Pom, and Ri Jin Hyok.

The Treasury Department revealed that a portion of $5.3 million linked to a North Korean ransomware actor has been used to fund IT worker operations and target U.S. victims.

North Korean cyber actors have been accused of orchestrating espionage, disruptive attacks, and financial theft on a large scale, with over $3 billion stolen in digital assets over the past three years through sophisticated malware and social engineering.

The regime has allegedly utilized its IT army worldwide to secure employment at companies by concealing their nationality and identities, with a significant portion of their income being funneled back to North Korea.

DPRK IT workers collaborate with foreign freelance programmers to establish business partnerships and generate revenue from commissioned projects, splitting the profits with non-North Korean workers.

TRM Labs reported that cryptocurrency wallet addresses associated with First Credit Bank received more than $12.7 million between June 2023 and May 2025, indicating sustained activity facilitating the movement of funds for weapons programs and cyber operations.

This network of individuals and entities plays a crucial role in Pyongyang’s sanctions evasion strategies, transferring millions of dollars through traditional and digital channels, including cryptocurrency, to support illicit activities.