On-Chain Tracking | US Further Cracks Down on North Korean IT Worker Fraud Network Using Cryptocurrency to Fund Weapons of Mass Destruction, Sanctions 6 Individuals and 2 Entities

Odaily星球日报Pubblicato 2026-03-14Pubblicato ultima volta 2026-03-14

Introduzione

On March 12, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned six individuals and two entities involved in a Democratic People’s Republic of Korea (DPRK)-led IT worker fraud network. The scheme defrauded U.S. companies to fund DPRK’s weapons of mass destruction programs, with nearly $800 million involved in 2024 alone. The sanctioned individuals facilitated cryptocurrency exchange, money laundering, and IT operations for DPRK IT workers who used fake identities to infiltrate companies. Two entities, Amnokgang and Quangvietdnbg, were key operators. OFAC identified 21 cryptocurrency addresses linked to the network. One individual exchanged approximately $2.5 million in crypto for DPRK operatives. Chain analysis revealed significant outflows to various exchanges, including over 200,000 USDT and substantial amounts of Ethereum, Tether, and TRX. This action underscores ongoing efforts to combat DPRK’s use of crypto to evade sanctions and highlights the importance of robust anti-money laundering screening for virtual asset service providers.

On March 12, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced sanctions against 6 individuals and 2 entities involved in a North Korea-led IT worker fraud network. The announcement stated that these participants systematically defrauded U.S. companies to provide funding for weapons of mass destruction programs, with the amount involved in 2024 alone approaching $800 million.

https://home.treasury.gov/news/press-releases/sb0416

Sanctions Details

According to the U.S. OFAC disclosure, North Korea-controlled IT teams used forged documents, stolen identities, and fabricated personas to conceal their true identities and gain employment at legitimate companies in the U.S. and other countries. The North Korean government seizes the vast majority of these overseas IT workers' salaries, obtaining hundreds of millions of dollars in funding to support its weapons of mass destruction and ballistic missile programs. In some cases, North Korean-linked personnel also secretly implanted malicious software into corporate networks to steal proprietary and sensitive information.

This round of sanctions targets a total of 6 individuals (Nguyen Quang Viet, Do Pyong Kyong, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, York Louis Celestino Herrera), identified as providing substantial assistance to North Korean IT workers through cryptocurrency exchange, money laundering, bank account opening, IT business对接 (liaison), etc.; and 2 corporate entities (Amnokgang, Quangvietdnbg), identified as key operators and facilitators of the IT worker fraud network.

Sanctioned Address Analysis

This sanctions action locked a total of 21 cryptocurrency addresses. According to the OFAC notification, from mid-2023 to mid-2025, Quangvietdnbg's CEO Nguyen Quang Viet exchanged approximately $2.5 million worth of cryptocurrency for the North Korean side, identifying cryptocurrency as a key channel for North Korean IT workers to transfer funds and evade sanctions.

Analysis was conducted on these 21 addresses using the on-chain anti-money laundering analysis platform Beosin KYT and the tracking investigation tool Beosin Trace, with results as follows:

YUN, Song Guk (North Korean national, head of IT workers in Boten, Laos)

ETH:

0xb637f84b66876ebf609c2a4208905f9ddac9d075

0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3

According to Beosin Trace statistics, approximately 200,851 USDT previously flowed out to various centralized exchanges.

HOANG, Minh Quang (Collaborated to complete IT service transactions exceeding $70,000)

BTC: bc1qyy5pt5cx3zth8xlj92lq5y87dh8xv3nwgs4ncq

Previously, 0.57462 BTC flowed into a Coinbase account.

SIM, Hyon Sop (Representative of North Korea's Kwangsong Bank in China, 11 new addresses added)

Originally frozen address (ETH network):

0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

This address had a liquid flow volume of 21,937,732.52 USDT and 2,071,126.59 USDC. Currently, 58,148.62 USDT remains dormant at this address.

Newly sanctioned addresses (ETH network):

0xd04E33461FEA8302c5E1e13895b60cEe8AEfda7F

0x76EA76CA4Eb727f18956aB93445a94c5280412B9

0xFb3eFf152ea55D1BfA04Dbdd509A80fD7b72cdEB

0xFda1Ec4A6178d4916b001a065422D31EBE5F62FF

0x747AFB5c7A7fc34B547cD0FDEbf9b91759C5a52b

Fund flow diagram as follows:

Approximately 98,139.11 USDT, 21,300 USDC, and 0.51268 ETH flowed out.

New TRX addresses:

TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu

TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF

TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1

TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T

TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s

TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2

Approximately 6,236.74 TRX and 999,014.46 USDT flowed out.

Same address cross-chain:

ARB: 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

BSC: 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

1,133,025.26 USDT, 935,943.84 BUSD, and 17,811.05 USDC flowed out to various centralized exchanges.

AMNOKGANG TECHNOLOGY DEVELOPMENT COMPANY

ETH:

0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D

0x0330070FD38Ec3bB94F58FA55D40368271E9e54A

0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573

A total of approximately 205.02 ETH, 274,531.15 USDT, and 228,496.97 USDC were involved. Among these, 96.05 ETH remains dormant in address 0x9be599d7867f5e1a2d7ec6db9710df2b98a15573.

Tron network

TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7

TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP

TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP

TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft

2,744.75 TRX and 4,941,817.62 USDT flowed out to various centralized exchanges.

Beosin Anti-Money Laundering Recommendations

This action is another measure by the U.S. Treasury Department to continuously combat North Korea's use of cryptocurrency to evade sanctions. For the virtual asset industry, how to conduct anti-money laundering compliance screening and identify addresses involved in high-risk funds has become a key capability for Virtual Asset Service Providers (VASPs).

Domande pertinenti

QWhat action did the U.S. Treasury's OFAC take on March 12 regarding North Korean IT workers?

AThe U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned 6 individuals and 2 entities involved in a North Korean-led IT worker fraud network.

QHow much money was involved in the fraudulent activities in 2024, according to the OFAC announcement?

AThe amount involved in the fraudulent activities in 2024 was nearly $800 million.

QWhat was the primary purpose of the funds obtained by the North Korean government through these IT workers?

AThe North Korean government seized the vast majority of the overseas IT workers' salaries to obtain hundreds of millions of dollars in funding for its weapons of mass destruction and ballistic missile programs.

QHow many cryptocurrency addresses were sanctioned in this action, and which platform was used to analyze them?

AA total of 21 cryptocurrency addresses were sanctioned. They were analyzed using the Beosin KYT on-chain anti-money laundering analysis platform and the Beosin Trace investigation tool.

QWhat key capability is mentioned as crucial for Virtual Asset Service Providers (VASPs) in light of these actions?

AFor Virtual Asset Service Providers (VASPs), the key capability mentioned is conducting anti-money laundering compliance screenings to identify addresses involved with high-risk funds.

Letture associate

Michael Saylor: 'We Never Said We Would Never Sell Bitcoin'

Michael Saylor stated that his company never made a commitment to never sell its bitcoin holdings, though it expects to remain a net buyer of bitcoin long-term. His comments came following reports that the company had received new authorization to sell up to $5 billion in bitcoin. Saylor clarified that this authorization is not new and was announced on June 29th as part of the company's capital management strategy. He emphasized that the authorization permits but does not obligate sales for specific purposes and that no new approval has been announced. Saylor also noted the company never officially adopted a "bitcoin will never be sold" policy.

cryptonews.ru7 min fa

Michael Saylor: 'We Never Said We Would Never Sell Bitcoin'

cryptonews.ru7 min fa

The 'Summer Saw' Continues: A Break Above $67,000 Could Signal the Start of Bitcoin's Rally

Bitcoin continues to consolidate within a $58,000–$67,000 range, with its price dropping to $62,217 on August 1st. Analysts are divided on the next direction. Trader Crypto Candy suggests a potential drop towards $60,000 if the price remains below $66,000. Investor Jelle refers to the prolonged sideways movement as a "summer saw" and maintains a dollar-cost averaging strategy. The key upside scenario hinges on a breakout above $67,000. Daan Crypto Trades states that without this, the movement risks being just an extended pause. Roman projects a sharper rise to $70,000–$80,000+ if a breakout occurs with sufficient volume. Macro-analyst Gert van Lagen views this as an accumulation phase within a multi-year "cup and handle" pattern. He notes that long-term holders are refusing to sell, as indicated by the NUPL metric staying far from capitulation. In summary, the market is in an accumulation phase, with the $60,000 and $67,000 levels being critical. A break above $67,000 could initiate significant growth, while a fall below $60,000 may lead to further decline. The recent pullback shows that legislative catalysts have provided only short-lived momentum, raising questions about the sustainability of any future breakout attempts.

cryptonews.ru22 min fa

The 'Summer Saw' Continues: A Break Above $67,000 Could Signal the Start of Bitcoin's Rally

cryptonews.ru22 min fa

Must-Watch Events Next Week｜CLARITY Act Could Face Senate Vote; SpaceX, Circle to Report Earnings (8.3-8.9)

**Summary: Key Events and Developments to Watch (August 3-9)** The upcoming week is marked by significant financial disclosures, key legislative deadlines, and notable product updates. **Major Financial Events:** Several companies are scheduled to release their Q2 2026 earnings. American Bitcoin (ABTC) will report on August 3, followed by SpaceX and Hut 8 Mining Corp. on August 4, and Circle on August 5. Notably, a significant portion of SpaceX shares (up to 12% of total shares) will be unlocked on August 6 following their earnings release. **Key Legislative Deadline:** The U.S. Senate faces an August 7 deadline to secure 60 votes for the CLARITY Act, a bipartisan bill aiming to establish a federal regulatory framework for cryptocurrencies. The Senate may hold a full vote on the bill during the week. **Economic Data:** The U.S. July Non-Farm Payrolls report will be released on August 7, providing crucial labor market data. **Technology & Product Updates:** * **Shutdowns:** DeFi portfolio tracker Zapper and wallet app Ctrl Wallet will cease operations on August 3. * **Upgrades:** LayerZero will deprecate its v1 relayers on August 3. XRP Ledger's new version 3.3.0, featuring five new functions, is expected next week. * **AI:** Elon Musk announced that the advanced Grok 4.6 AI model is set for release around August 7. * **Bitcoin:** The BIP-110 forced signaling for a potential Bitcoin network change is scheduled to begin around August 8. **Other Notable Events:** Chinese robotics firm Unitree Tech has set its preliminary price inquiry for its IPO for August 5. South Korean exchange Upbit will delist AQT and AERGO tokens on August 3.

marsbit1 h fa

Must-Watch Events Next Week｜CLARITY Act Could Face Senate Vote; SpaceX, Circle to Report Earnings (8.3-8.9)

marsbit1 h fa

Stocks Are Plummeting More Sharply Than Cryptocurrencies. Where Has the Money Gone?

Stock Markets Plunge Deeper Than Cryptocurrencies: Where Did the Money Go? In late July, Seoul's Kospi index triggered circuit breakers for two consecutive days, plummeting over 40% from its June high. The collapse was led by heavyweight stocks like SK Hynix, whose record profits still disappointed investors, and devastating leveraged ETFs, with one major product losing over 83% of its value. This signaled a global, forced deleveraging targeting the most crowded trades. Interestingly, while stocks exhibited extreme volatility akin to crypto markets, Bitcoin rose nearly 15% in July after a prior steep drop. Analysis shows the money fleeing equities did not flow into Bitcoin. Instead, Bitcoin had already absorbed its sell-off in May-June, when U.S. spot Bitcoin ETFs saw historic outflows. The true safe-haven beneficiary was gold, whose price rose over 20% year-on-year, highlighting a decoupling between Bitcoin and gold as "digital gold." The sell-off was a targeted unwinding of leveraged positions in tech and semiconductors, accelerated by broker-dealer risk management and shifts in the AI narrative, including new competition from Chinese memory chipmakers. The retreat path was clear: from high-valuation tech stocks to cash and U.S. Treasuries, then to gold. For Bitcoin to attract sustained institutional inflows, conditions like eased global liquidity pressure, a "soft-landing" Fed rate cut, and U.S. regulatory clarity via legislation like the stalled CLARITY Act are needed. Currently, Bitcoin is not a safe haven but an already-cleared asset. Its low correlation with tech stocks, however, makes it a potential diversification play for institutional portfolios once the storm passes. The money isn't here yet, but the positioning is underway.

marsbit1 h fa

Stocks Are Plummeting More Sharply Than Cryptocurrencies. Where Has the Money Gone?

marsbit1 h fa

In Conversation with Ray Dalio: We Are Currently in an AI Bubble, with 1% of My Portfolio in Bitcoin

Ray Dalio, founder of Bridgewater Associates, warns in an interview that the current AI boom shows classic bubble characteristics, which could lead to significant economic downturns as seen in past cycles like 1929 or 2000. He explains that speculative enthusiasm, fueled by debt and overvaluation, often precedes a crash when rising rates or taxation force asset sales, causing widespread losses and recession. Dalio also outlines his "Big Cycle" theory, describing an approximate 80-year pattern where widening wealth gaps, massive government deficits, and shifting geopolitical power (like China's rise) create internal conflict and global instability. He emphasizes that we are in a late-cycle, transitional phase where traditional powers like the US and UK face decline. For personal wealth protection, Dalio advises diversification beyond cash into assets like stocks, bonds, real estate, and particularly gold, which he prefers over Bitcoin. While he holds about 1% of his portfolio in Bitcoin as a non-printable hard asset, he views gold as more secure from technological or governmental threats. Regarding AI's impact, Dalio believes it will disproportionately benefit capital owners, worsening inequality by replacing both physical and cognitive labor. He suggests that human intuition and emotional intelligence, combined with AI, will be key for future workers. On taxation, Dalio argues that wealth taxes are impractical and risk triggering asset sell-offs, reducing productive investment. He points to the UK as a cautionary example of debt, low productivity, and political strife. Geopolitically, Dalio foresees a more regionalized world, with the US showing weakness in prolonged conflicts like with Iran, akin to past imperial declines. The ideal outcome, he suggests, is coexisting powerful blocs (e.g., Americas, China-Asia Pacific) without major war.

marsbit4 h fa

In Conversation with Ray Dalio: We Are Currently in an AI Bubble, with 1% of My Portfolio in Bitcoin

marsbit4 h fa

Trading

Spot