On-Chain Tracking｜US Further Cracks Down on North Korean IT Worker Fraud Network Using Cryptocurrency to Fund Weapons of Mass Destruction, Sanctions 6 Individuals and 2 Entities

marsbitPublished on 2026-03-14Last updated on 2026-03-14

Abstract

On March 12, the U.S. Treasury’s OFAC sanctioned six individuals and two entities involved in a DPRK-led IT worker fraud network. These actors allegedly deceived U.S. companies to generate revenue for North Korea’s weapons of mass destruction programs, with nearly $800 million involved in 2024 alone. The sanctioned individuals facilitated crypto exchange, money laundering, and IT operations, while the entities (Amnokgang and Quangvietdnbg) were key operators. A total of 21 cryptocurrency addresses were identified. One individual exchanged approximately $2.5 million in crypto for North Korea. Blockchain analysis revealed fund flows to major exchanges, including over 200,000 USDT and 0.57 BTC traced to CEXs. One address held over $24 million in stablecoins, with significant outflows detected. This action underscores ongoing U.S. efforts to combat DPRK’s use of crypto to evade sanctions and fund illicit programs. Virtual asset service providers are urged to enhance AML screening and monitor high-risk addresses.

On March 12, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced sanctions against 6 individuals and 2 entities involved in a North Korea-led IT worker fraud network. The announcement stated that these participants systematically defrauded U.S. companies to provide funding for weapons of mass destruction programs, with the amount involved in 2024 alone approaching $800 million.

https://home.treasury.gov/news/press-releases/sb0416

Sanctions Details

According to the U.S. OFAC disclosure, North Korea-controlled IT teams used forged documents, stolen identities, and fabricated personas to conceal their true identities and gain employment at legitimate companies in the U.S. and other countries. The North Korean government seized the vast majority of these overseas IT workers' salaries, obtaining hundreds of millions of dollars to support its weapons of mass destruction and ballistic missile programs. In some cases, North Korea-linked personnel also secretly implanted malicious software into corporate networks to steal proprietary and sensitive information.

This round of sanctions targets 6 individuals (Nguyen Quang Viet, Do Pyong Kyong, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, York Louis Celestino Herrera), identified as providing substantial assistance to North Korean IT workers through cryptocurrency exchange, money laundering, bank account opening, and IT business matching; and 2 corporate entities (Amnokgang, Quangvietdnbg), identified as key operators and facilitators of the IT worker fraud network.

Sanctioned Address Analysis

This sanctions action locked a total of 21 cryptocurrency addresses. According to the OFAC notification, from mid-2023 to mid-2025, Quangvietdnbg CEO Nguyen Quang Viet exchanged approximately $2.5 million worth of cryptocurrency for the North Korean side, identifying cryptocurrency as a critical channel for North Korean IT workers to transfer funds and evade sanctions.

Analysis of the 21 addresses on this sanctions list was conducted using the on-chain anti-money laundering analysis platform Beosin KYT and the investigation tool Beosin Trace, with results as follows:

YUN, Song Guk (North Korean national, head of IT workers in Boten, Laos)

ETH:

0xb637f84b66876ebf609c2a4208905f9ddac9d075

0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3

According to Beosin Trace statistics, approximately 200,851 USDT previously flowed out to various centralized exchanges.

HOANG, Minh Quang (Collaborated to complete IT service transactions exceeding $70,000)

BTC:bc1qyy5pt5cx3zth8xlj92lq5y87dh8xv3nwgs4ncq

Previously, 0.57462 BTC flowed into a Coinbase account.

SIM, Hyon Sop (Representative of North Korea's Kwangson Bank in China, 11 new addresses added)

Previously frozen address (ETH network):

0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

This address had a liquid volume of 21,937,732.52 USDT and 2,071,126.59 USDC, with 58,148.62 USDT currently remaining dormant at this address.

Newly sanctioned addresses (ETH network):

0xd04E33461FEA8302c5E1e13895b60cEe8AEfda7F

0x76EA76CA4Eb727f18956aB93445a94c5280412B9

0xFb3eFf152ea55D1BfA04Dbdd509A80fD7b72cdEB

0xFda1Ec4A6178d4916b001a065422D31EBE5F62FF

0x747AFB5c7A7fc34B547cD0FDEbf9b91759C5a52b

Fund flow diagram is as follows:

Approximately 98,139.11 USDT, 21,300 USDC, and 0.51268 ETH flowed out.

New TRX addresses:

TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu

TGXE9dGWawjfd3xqFSho1h1bBbRv9wUGrF

TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1

TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T

TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s

TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2

Approximately 6,236.74 TRX and 999,014.46 USDT flowed out.

Cross-chain for the same address:

ARB:0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

BSC:0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

1,133,025.26 USDT, 935,943.84 BUSD, and 17,811.05 USDC flowed out to various centralized exchanges.

AMNOKGANG TECHNOLOGY DEVELOPMENT COMPANY

ETH:

0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D

0x0330070FD38Ec3bB94F58FA55D40368271E9e54A

0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573

A total of approximately 205.02 ETH, 274,531.15 USDT, and 228,496.97 USDC, with 96.05 ETH dormant in address 0x9be599d7867f5e1a2d7ec6db9710df2b98a15573.

Tron network

TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7

TEEYCuGDyeNkuDj4 U6GQRXxXo3Nh29r2vP

TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP

TDe2 UNAvuUnTbbDo7518eMe3TXN5qJW8Ft

2,744.75 TRX and 4,941,817.62 USDT flowed out to various centralized exchanges.

Beosin Anti-Money Laundering Recommendations

This action is another measure by the U.S. Treasury Department to continuously combat North Korea's use of cryptocurrency to evade sanctions. For the virtual asset industry, how to conduct anti-money laundering compliance screening and identify addresses involved in high-risk funds has become a critical capability for Virtual Asset Service Providers (VASPs).

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
aPrioriAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
comp
CompoundCOMP
mantra
MantraMANTRA
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
brev
BrevisBREV
cake
PancakeSwapCAKE
jst
JUSTJST
sun
SUNSUN

Related Questions

QWhat action did the U.S. Treasury Department's OFAC announce on March 12th, and who was targeted?

AThe U.S. Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions against 6 individuals and 2 entities involved in a Democratic People's Republic of Korea (DPRK)-led IT worker fraud network.

QWhat was the primary method used by the DPRK IT teams to infiltrate legitimate companies, and what was the ultimate goal?

AThe DPRK IT teams used forged documents, stolen identities, and fabricated personas to conceal their true identities and gain employment at legitimate companies. The North Korean government then seized the vast majority of the overseas IT workers' salaries to obtain hundreds of millions of dollars in funding for its weapons of mass destruction (WMD) and ballistic missile programs.

QHow much cryptocurrency was exchanged by Nguyen Quang Viet for the North Korean side, and what role did crypto play according to OFAC?

ANguyen Quang Viet, the CEO of Quangvietdnbg, exchanged approximately $2.5 million worth of cryptocurrency for the North Korean side. OFAC identified cryptocurrency as a critical channel for DPRK IT workers to transfer funds and evade sanctions.

QWhich sanctioned individual was identified as a DPRK IT worker leader in Laos, and what was the associated Ethereum address with significant outflows?

AYUN, Song Guk was identified as a DPRK IT worker leader in Laos. The Ethereum address 0xb637f84b66876ebf609c2a4208905f9ddac9d075 was associated with him, from which approximately 200,851 USDT had flowed out to various centralized exchanges.

QWhat was the total amount of funds involved in the fraud network's activities in 2024 alone, as stated in the OFAC announcement?

AThe amount of funds involved in the fraud network's activities in 2024 alone was close to $800 million.

Related Reads

Wall Street's Most Famous 'Cassandra' Now Has His Sights Set on Nvidia

Michael Burry, the famed "Big Short" investor, has once again captured Wall Street's attention with a series of short positions against major tech and semiconductor stocks, most notably Nvidia. In late June and July, through his "Cassandra Unchained" newsletter, Burry disclosed short bets against Nvidia, Tesla, Applied Materials, Caterpillar, the SOXX semiconductor ETF, and later, Micron Technology. His core thesis revolves around potential distortions in the AI infrastructure boom, specifically questioning whether extended depreciation schedules (e.g., 6 years vs. a realistic 2-3 years for AI chips) by cloud giants like Microsoft and Google artificially inflate profits. He also raises concerns about possible "off-balance-sheet circular financing," where chip demand might be propped up by vendor-backed funding to clients. Nvidia's stock experienced volatility following these disclosures, briefly dipping but largely holding near Burry's reported entry points, leaving his positions roughly flat or slightly underwater as of late July. This move is part of a pattern for Burry, whose track record since his legendary 2008 bet is mixed. He has faced notable losses, such as on Tesla in 2021, while scoring on broader market turns like the 2020 pandemic crash. His methodology focuses intensely on free cash flow and scrutinizing original financial documents to spot overvaluation and structural risks, but it often struggles with timing the market. The article contrasts Burry's stance with other prominent investors. Steve Eisman, another "Big Short" figure, is not shorting Nvidia, citing strong fundamentals but expressing nervousness about sustainability. Jim Chanos agrees with the broad "accounting mismatch" concern—comparing it to the dot-com bubble—but targets financial leverage in private equity firms rather than the chip stocks themselves. While Nvidia's short interest remains relatively low at 1.3-1.4% of float, the massive stock size means absolute short losses have been significant, exceeding $5 billion earlier this year. The piece concludes that for ordinary investors, the key takeaway is not replicating specific short bets but learning from the critical frameworks these investors use: questioning rosy accounting, identifying structural vulnerabilities, and maintaining skepticism during market euphoria, even if pinpointing the exact catalyst for a downturn remains elusive.

marsbit8m ago

Wall Street's Most Famous 'Cassandra' Now Has His Sights Set on Nvidia

marsbit8m ago

Weekly Selection丨Epic Stock Market Volatility, Changxin Tech's IPO Reshapes Storage Landscape, Saylor Aims to Re-Anchor STRC Around September 8th

PANews Weekly Digest: Market Turmoil, Tech Breakthroughs, and Crypto Developments. The week saw significant volatility across global markets. South Korea's KOSPI index experienced extreme turbulence, including multiple trading halts, largely driven by sharp declines in AI hardware stocks like SK Hynix. In contrast, China's Changxin Xinqiao (CXC) achieved a landmark IPO with a market cap surpassing 4 trillion yuan, marking a major success for the domestic DRAM industry after a decade of losses. In the crypto and Web3 space, several key narratives emerged. AI is driving demand for new infrastructure, with projects like AI agent wallets and programmable payments gaining traction, attracting interest from firms like Coinbase. The Bitcoin mining sector is pivoting, with companies like MARA focusing on energy management as electricity becomes a core AI-era asset. Meanwhile, the RWA (Real World Assets) sector faces a "utilization puzzle," with hundreds of billions in on-chain assets remaining dormant. Notable market movements included a historic single-day surge of over 17% for the KOSPI index and a significant migration of $16.5 billion in staked ETH within the Lido ecosystem. Michael Saylor announced a target to re-peg the STRC stablecoin around September 8th. Other highlights include discussions on Ethereum's ambitious 2030 roadmap for scaling and privacy, analysis showing high protocol revenues not always translating to token price gains, and warnings from Citi about potential extreme commodity price shocks by late 2026.

marsbit13m ago

Weekly Selection丨Epic Stock Market Volatility, Changxin Tech's IPO Reshapes Storage Landscape, Saylor Aims to Re-Anchor STRC Around September 8th

marsbit13m ago

When the Market Begins to Question AI Capex: A Full Analysis of Q2 Earnings Reports from Five Tech Giants

In late July 2026, five major US tech giants—Alphabet, Intel, Microsoft, Meta, and Apple—released their Q2 earnings reports. While all companies exceeded revenue and profit expectations, driven by strong AI-related business growth, investor reactions diverged sharply due to concerns over escalating AI capital expenditures (capex) and their impact on free cash flow. Alphabet reported strong revenue growth and a surging cloud business, but its stock fell after announcing a doubled year-on-year capex and negative quarterly free cash flow for the first time. Intel posted its strongest revenue growth in over 15 years, but its stock experienced volatile trading after significantly raising its full-year capex guidance. Microsoft saw its stock surge after beating estimates and, crucially, lowering its capex forecast while projecting positive free cash flow. Meta faced the most severe sell-off as its profits declined despite revenue beats, with free cash flow plunging over 90% and its capex guidance raised. Apple reported record June-quarter results, but its stock plummeted after providing Q4 revenue guidance that fell short of expectations, citing supply chain constraints and forex headwinds. The overall takeaway is that the market's focus has shifted from validating AI demand to scrutinizing the timeline for returns on massive AI investments. Companies demonstrating a clearer path to managing capex and preserving free cash flow, like Microsoft, were rewarded, while those signaling continued aggressive spending faced investor skepticism.

Odaily星球日报22m ago

When the Market Begins to Question AI Capex: A Full Analysis of Q2 Earnings Reports from Five Tech Giants

Odaily星球日报22m ago

a16z: From Companies to DAOs, DUNA May Become the Next Generation Organizational Form

This article, "From Companies to DAOs: How DUNA Could Become the Next Organizational Form," traces the 500-year evolution of business collaboration. It begins with medieval structures like the *commenda* and Florentine *compagnia*, which exposed partners to personal risk. The modern corporation, exemplified by the Dutch East India Company (VOC), was a revolutionary leap, enabling large-scale, capital-intensive ventures by offering limited liability and reducing coordination costs. However, corporations introduced new challenges like principal-agent problems and bureaucratic overhead. The piece argues that software and internet-native protocols are now reducing these traditional overheads. Decentralized Autonomous Organizations (DAOs) emerged as a new model for coordination without centralized management. Yet, DAOs face a significant legal vacuum: they lack legal recognition, leaving members exposed to unlimited personal liability, and their tokens are vulnerable to being classified as securities under unclear regulations (e.g., the Howey Test). This has forced projects into suboptimal workarounds like offshore foundations. The article identifies the Decentralized Unincorporated Nonprofit Association (DUNA) as a potential solution. Recently legalized in states like Wyoming, the DUNA provides a legal wrapper for decentralized networks. It grants key protections—legal personality, limited liability, and perpetual existence—to a group without imposing a traditional hierarchical management structure. This allows token-holder communities to govern, hold assets, and contract as a single legal entity, aligning with their decentralized nature. While DUNA doesn't solve all governance challenges or magically resolve securities law questions, it represents a crucial step. It fills the legal recognition gap, offering a native legal form for internet-scale, decentralized collaboration and extending the separation of personal risk from organizational venture into a new domain.

marsbit1h ago

a16z: From Companies to DAOs, DUNA May Become the Next Generation Organizational Form

marsbit1h ago

2026 Mid-Year Report On-Chain RWA: Tokenized Stock Market Cap Doubles in a Year, But 90% of Rights Are Hollow Shells

The 2026 Mid-Year Report on On-Chain RWA highlights a significant growth in tokenized stock market capitalization, which nearly doubled from $951 million in March to $1.89 billion by July. However, the report reveals a fundamental contradiction in this "layer 2.5" ecosystem: products with the strongest legal foundation (like regulated U.S. infrastructure) lack liquidity and distribution, while freely tradable offshored wrapper products often lack substantive ownership rights. The increase is driven largely by a few products (SECZ, FGRS, STRCx) and platforms (Ondo, xStocks, Securitize collectively hold over 85% share). While distributed value across networks like Ethereum, Solana, and BNB Chain has grown, the market remains fragmented. Products referencing the same underlying asset (e.g., Apple stock) are distinct legal liabilities with different intermediaries and jurisdictional rules, offering varying degrees of legal claim. The report cautions that headline numbers are misleading, as they reflect changes in distributed token value—driven by issuance, conversions, and price movements—not pure investor inflows. True "canonical shares" with legal ownership, wide wallet distribution, institutional liquidity, and independent on-chain price discovery do not yet exist at scale. Tokenized treasuries show stronger product-market fit, and ETFs may be easier to scale than single stocks. The core takeaway is a trade-off: legal certainty versus liquidity and composability.

marsbit1h ago

2026 Mid-Year Report On-Chain RWA: Tokenized Stock Market Cap Doubles in a Year, But 90% of Rights Are Hollow Shells

marsbit1h ago

Trading

Spot

Hot Articles

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of S (S) are presented below.

活动图片

Top Questions

Hot Categoriesright-arrow

Hot Tagsright-arrow