US Sanctions 8 for $800M North Korea Crypto Launder

OFAC North Korea crypto sanctions escalated sharply on Thursday when the U.S. Treasury Department named six individuals and two companies it says ran a sophisticated operation that converted $800 million into cryptocurrency for Pyongyang in 2024 — money Treasury says went straight into North Korea's weapons of mass destruction programs.

How DPRK Turned IT Workers Into a Money Machine

The scheme wasn't some crude hack-and-cash-out operation. According to Treasury's Office of Foreign Assets Control, DPRK IT workers overseas fraud was industrial in scale — operatives armed with stolen identities, fabricated resumes, and fraudulent documentation planted themselves inside legitimate companies across the U.S. and allied nations. Vietnam, Laos, and Spain are among the confirmed operating territories.

Once embedded, these workers didn't just collect paychecks — they funneled earnings back to Pyongyang. The North Korean government reportedly captured most of those wages, feeding ballistic missile and WMD development budgets. Some operatives went further, introducing malware into company systems to extract proprietary data, leaving their employers with an extortion problem on top of an espionage one.

The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.

— Scott Bessent, U.S. Secretary of the Treasury

Who Got Sanctioned — and What the Crypto Trail Looked Like

Among the eight entities named is Nguyen Quang Viet, CEO of Vietnam-based Quangvietdnbg International Services Co. Treasury says he converted approximately $2.5 million into cryptocurrency for North Korean actors between mid-2023 and mid-2025. That's one individual, one company, one slice of an $800 million operation.

The North Korea crypto laundering $800 million network used a layered approach that blockchain analytics firm Chainalysis described as increasingly multichain — centralized exchanges, hosted wallets, DeFi protocols, and cross-chain bridges all played roles in obscuring the money's origin. OFAC's designations included 21 crypto wallet addresses spread across Ethereum, Tron, and Bitcoin, a reflection of how broadly the DPRK has expanded its onchain footprint.

Does a Record Theft Year Mean the Worst Is Ahead?

Why did 2024 become North Korea's biggest crypto haul year?

Last year, hackers tied to the DPRK stole a record $2 billion in crypto, per Chainalysis. The $800 million laundering operation named Thursday isn't part of that theft total — it's the infrastructure that moves and cleans stolen funds after the fact. That's two separate arms of the same state-sponsored machine working in parallel.

The OFAC North Korea crypto sanctions designation is the latest in a years-long effort to claw back some enforcement leverage over a state actor that has become one of the most technically capable crypto threat actors in the world. Call it whack-a-mole — because the DPRK's multichain approach means every address flagged is probably one of dozens more that aren't.