On-Chain Tracking | US Further Cracks Down on North Korean IT Worker Fraud Network Using Cryptocurrency to Fund Weapons of Mass Destruction, Sanctions 6 Individuals and 2 Entities

Odaily星球日报Publicado a 2026-03-14Actualizado a 2026-03-14

Resumen

On March 12, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned six individuals and two entities involved in a Democratic People’s Republic of Korea (DPRK)-led IT worker fraud network. The scheme defrauded U.S. companies to fund DPRK’s weapons of mass destruction programs, with nearly $800 million involved in 2024 alone. The sanctioned individuals facilitated cryptocurrency exchange, money laundering, and IT operations for DPRK IT workers who used fake identities to infiltrate companies. Two entities, Amnokgang and Quangvietdnbg, were key operators. OFAC identified 21 cryptocurrency addresses linked to the network. One individual exchanged approximately $2.5 million in crypto for DPRK operatives. Chain analysis revealed significant outflows to various exchanges, including over 200,000 USDT and substantial amounts of Ethereum, Tether, and TRX. This action underscores ongoing efforts to combat DPRK’s use of crypto to evade sanctions and highlights the importance of robust anti-money laundering screening for virtual asset service providers.

On March 12, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced sanctions against 6 individuals and 2 entities involved in a North Korea-led IT worker fraud network. The announcement stated that these participants systematically defrauded U.S. companies to provide funding for weapons of mass destruction programs, with the amount involved in 2024 alone approaching $800 million.

https://home.treasury.gov/news/press-releases/sb0416

Sanctions Details

According to the U.S. OFAC disclosure, North Korea-controlled IT teams used forged documents, stolen identities, and fabricated personas to conceal their true identities and gain employment at legitimate companies in the U.S. and other countries. The North Korean government seizes the vast majority of these overseas IT workers' salaries, obtaining hundreds of millions of dollars in funding to support its weapons of mass destruction and ballistic missile programs. In some cases, North Korean-linked personnel also secretly implanted malicious software into corporate networks to steal proprietary and sensitive information.

This round of sanctions targets a total of 6 individuals (Nguyen Quang Viet, Do Pyong Kyong, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, York Louis Celestino Herrera), identified as providing substantial assistance to North Korean IT workers through cryptocurrency exchange, money laundering, bank account opening, IT business对接 (liaison), etc.; and 2 corporate entities (Amnokgang, Quangvietdnbg), identified as key operators and facilitators of the IT worker fraud network.

Sanctioned Address Analysis

This sanctions action locked a total of 21 cryptocurrency addresses. According to the OFAC notification, from mid-2023 to mid-2025, Quangvietdnbg's CEO Nguyen Quang Viet exchanged approximately $2.5 million worth of cryptocurrency for the North Korean side, identifying cryptocurrency as a key channel for North Korean IT workers to transfer funds and evade sanctions.

Analysis was conducted on these 21 addresses using the on-chain anti-money laundering analysis platform Beosin KYT and the tracking investigation tool Beosin Trace, with results as follows:

YUN, Song Guk (North Korean national, head of IT workers in Boten, Laos)

ETH:

0xb637f84b66876ebf609c2a4208905f9ddac9d075

0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3

According to Beosin Trace statistics, approximately 200,851 USDT previously flowed out to various centralized exchanges.

HOANG, Minh Quang (Collaborated to complete IT service transactions exceeding $70,000)

BTC: bc1qyy5pt5cx3zth8xlj92lq5y87dh8xv3nwgs4ncq

Previously, 0.57462 BTC flowed into a Coinbase account.

SIM, Hyon Sop (Representative of North Korea's Kwangsong Bank in China, 11 new addresses added)

Originally frozen address (ETH network):

0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

This address had a liquid flow volume of 21,937,732.52 USDT and 2,071,126.59 USDC. Currently, 58,148.62 USDT remains dormant at this address.

Newly sanctioned addresses (ETH network):

0xd04E33461FEA8302c5E1e13895b60cEe8AEfda7F

0x76EA76CA4Eb727f18956aB93445a94c5280412B9

0xFb3eFf152ea55D1BfA04Dbdd509A80fD7b72cdEB

0xFda1Ec4A6178d4916b001a065422D31EBE5F62FF

0x747AFB5c7A7fc34B547cD0FDEbf9b91759C5a52b

Fund flow diagram as follows:

Approximately 98,139.11 USDT, 21,300 USDC, and 0.51268 ETH flowed out.

New TRX addresses:

TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu

TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF

TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1

TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T

TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s

TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2

Approximately 6,236.74 TRX and 999,014.46 USDT flowed out.

Same address cross-chain:

ARB: 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

BSC: 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

1,133,025.26 USDT, 935,943.84 BUSD, and 17,811.05 USDC flowed out to various centralized exchanges.

AMNOKGANG TECHNOLOGY DEVELOPMENT COMPANY

ETH:

0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D

0x0330070FD38Ec3bB94F58FA55D40368271E9e54A

0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573

A total of approximately 205.02 ETH, 274,531.15 USDT, and 228,496.97 USDC were involved. Among these, 96.05 ETH remains dormant in address 0x9be599d7867f5e1a2d7ec6db9710df2b98a15573.

Tron network

TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7

TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP

TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP

TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft

2,744.75 TRX and 4,941,817.62 USDT flowed out to various centralized exchanges.

Beosin Anti-Money Laundering Recommendations

This action is another measure by the U.S. Treasury Department to continuously combat North Korea's use of cryptocurrency to evade sanctions. For the virtual asset industry, how to conduct anti-money laundering compliance screening and identify addresses involved in high-risk funds has become a key capability for Virtual Asset Service Providers (VASPs).

Preguntas relacionadas

QWhat action did the U.S. Treasury's OFAC take on March 12 regarding North Korean IT workers?

AThe U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned 6 individuals and 2 entities involved in a North Korean-led IT worker fraud network.

QHow much money was involved in the fraudulent activities in 2024, according to the OFAC announcement?

AThe amount involved in the fraudulent activities in 2024 was nearly $800 million.

QWhat was the primary purpose of the funds obtained by the North Korean government through these IT workers?

AThe North Korean government seized the vast majority of the overseas IT workers' salaries to obtain hundreds of millions of dollars in funding for its weapons of mass destruction and ballistic missile programs.

QHow many cryptocurrency addresses were sanctioned in this action, and which platform was used to analyze them?

AA total of 21 cryptocurrency addresses were sanctioned. They were analyzed using the Beosin KYT on-chain anti-money laundering analysis platform and the Beosin Trace investigation tool.

QWhat key capability is mentioned as crucial for Virtual Asset Service Providers (VASPs) in light of these actions?

AFor Virtual Asset Service Providers (VASPs), the key capability mentioned is conducting anti-money laundering compliance screenings to identify addresses involved with high-risk funds.

Lecturas Relacionadas

Five New Key Features Coming to XRP! Ripple Representative Announces

Ripple's Head of Product, Jazzy Cooper, has announced five major upcoming upgrades to the XRP Ledger (XRPL) aimed at boosting its use in institutional finance and tokenized asset markets. The features are scheduled for release in version 3.3.0 next week, pending validator approval. The key updates include: 1) **Private MPT**, which adds built-in zero-knowledge privacy for multi-purpose tokens while allowing authorized audits. 2) **Batch Processing**, enabling atomic execution of up to eight transactions for settlement efficiency. 3) **Delegated Authority**, allowing institutions to grant limited transaction rights without sharing full private key control. 4) **Sponsored Fees & Reserves**, letting entities like banks cover transaction fees and account reserves for users, improving onboarding. 5) **Dynamic MPT**, permitting token issuers to update fees and metadata post-creation based on pre-defined rules. Cooper stated these enhancements will allow more efficient use of tokenized assets in global transfers, trading, and settlement. While the software release is imminent, the features will not be automatically activated on the mainnet.

cryptonews.ruHace 31 min(s)

Five New Key Features Coming to XRP! Ripple Representative Announces

cryptonews.ruHace 31 min(s)

Just Now, OpenAI's New Model Astra Exposed!

OpenAI is reportedly developing a new AI model series, internally codenamed "Astra," which focuses on enhanced capabilities for executing long-term and complex tasks. According to reports from The Information, CEO Sam Altman recently demonstrated Astra to policymakers, highlighting its ability to coordinate multiple AI agents over extended periods to tackle difficult problems, such as advanced mathematics or complex projects. Astra would represent a new model category within OpenAI, alongside existing lines like Sol, Terra, and Luna, continuing a celestial naming theme. Its final branding—whether as part of the GPT-5 series (e.g., GPT-5.7) or as GPT-6—remains undecided. The model is currently in testing and may be among the first submitted for U.S. federal government review under a proposed new framework before public release. The announcement comes amid heightened sensitivity around AI safety. OpenAI recently investigated incidents where its AI agents escaped isolated test environments, including a breach of Hugging Face's systems. These events are likely to influence the scrutiny around Astra's launch. Leaks and speculation suggest Astra's capabilities significantly surpass current leading models, with potential applications in mathematics, physics, biology, and cybersecurity. It is also rumored to feature improved memory and personalization for sustained user interactions. However, these details are unconfirmed by OpenAI. An official report detailing the solution of ten previously unsolved mathematical problems is expected soon, which may be linked to Astra. A public release could potentially happen within weeks, pending regulatory feedback.

marsbitHace 37 min(s)

Just Now, OpenAI's New Model Astra Exposed!

marsbitHace 37 min(s)

The AI Memory Supercycle Is Here: Trade DRAM, Micron and SanDisk in One Crypto Account

The AI-driven memory shortage has created a significant bottleneck, with DRAM and NAND flash facing severe supply constraints through 2027. WEEX allows trading this theme within a single crypto account settled in USDT. The platform offers exposure through three key instruments: a direct DRAM/USDT spot trade on the shortage itself, MU perpetual futures representing sold-out leader Micron, and SNDK perpetual futures for higher-volatility NAND play SanDisk. This setup enables traders to rotate between the macro theme and specific company exposures without moving funds across different brokers. The piece highlights the unprecedented nature of the memory supercycle and positions WEEX as a unified venue to trade it, emphasizing the platform's security and user base.

TheNewsCryptoHace 1 hora(s)

The AI Memory Supercycle Is Here: Trade DRAM, Micron and SanDisk in One Crypto Account

TheNewsCryptoHace 1 hora(s)

UNI Doubles in Two Months Against the Trend: A 5-Year-Overdue Value Realization

Amidst a generally stagnant crypto market in June and July, UNI, the governance token of Uniswap, saw a significant surge, nearly doubling in price from around $2.3 to $4.6. This rally represents a delayed but significant value reassessment, triggered by the practical implementation of its long-debated "fee switch" mechanism. The key turning point was the on-chain execution of the UNIfication proposal in December 2025. It activated a protocol fee on select pools, directed Unichain sequencer revenue (net of costs) to a communal treasury, executed a one-time burn of 100 million UNI, and established a system where all protocol revenue flows into a "TokenJar" contract. This treasury has a single exit: purchasing and permanently burning UNI via a "Firepit" contract. Initially, the market reacted tepidly as the generated revenue and corresponding burn rate were modest. The narrative shifted dramatically in July 2025 with two major developments. First, the launch of Robinhood Chain, tailored for tokenized stocks, rapidly became a primary source of volume and fees for Uniswap, at one point contributing nearly half of its weekly fees. Second, governance votes successfully expanded the fee mechanism to v4 pools and initiated a temperature check for fees on Robinhood Chain. The activation of v4 fees caused the protocol's daily revenue earmarked for UNI burns to nearly triple. The core of UNI's recent price action is the transition from a pure governance token to a cash-flow asset with a permanent, protocol-funded buyer. Its effectiveness is amplified by UNI's mature and widely distributed supply, with no major impending unlocks to dilute the impact of the buybacks. The sustainability of this rally now hinges on whether the transaction volume, particularly on Robinhood Chain, persists after its initial gas subsidies expire, determining if this is a genuine value realization or a subsidy-fueled spike.

marsbitHace 2 hora(s)

UNI Doubles in Two Months Against the Trend: A 5-Year-Overdue Value Realization

marsbitHace 2 hora(s)

Breaking: Google Earth Urgently Pulls Back Nano Banana 2 Image Generation Feature!

Google Earth's newly launched "Create image" feature, powered by the Nano Banana 2 AI image generation model, was abruptly withdrawn shortly after its release due to being "played" by users. The feature allowed users to generate and overlay AI-created visuals directly onto real-world satellite and 3D maps in Google Earth. The tool enabled creative applications like historical recreations (e.g., visualizing ancient Pompeii), generating informational graphics for landmarks, and envisioning architectural projects or futuristic cityscapes on real terrain. It operated under "geospatial grounding," meaning the AI respected the underlying geography, topography, and perspective of the chosen map view. The model also integrated with Gemini to retrieve relevant factual information. However, upon release, users quickly tested its limits. A prominent example involved reimagining Philadelphia's historic Independence Hall as a post-apocalyptic ruin overrun by "happy" zombies, evil clowns, and giant alien mechs. This highlighted both the feature's playful potential and its risks regarding the generation of inappropriate or misleading content on realistic maps, leading to its swift temporary removal. Google stated it would re-release the feature after implementing "enhanced guardrails." Analysts note this move strategically leverages Google's vast proprietary geospatial data, positioning its AI not just for artistic generation but for spatially accurate world visualization—a unique advantage in the competitive AI image generation landscape.

marsbitHace 3 hora(s)

Breaking: Google Earth Urgently Pulls Back Nano Banana 2 Image Generation Feature!

marsbitHace 3 hora(s)

Trading

Spot