On-Chain Tracking｜US Further Cracks Down on North Korean IT Worker Fraud Network Using Cryptocurrency to Fund Weapons of Mass Destruction, Sanctions 6 Individuals and 2 Entities

marsbitОпубликовано 2026-03-14Обновлено 2026-03-14

Введение

On March 12, the U.S. Treasury’s OFAC sanctioned six individuals and two entities involved in a DPRK-led IT worker fraud network. These actors allegedly deceived U.S. companies to generate revenue for North Korea’s weapons of mass destruction programs, with nearly $800 million involved in 2024 alone. The sanctioned individuals facilitated crypto exchange, money laundering, and IT operations, while the entities (Amnokgang and Quangvietdnbg) were key operators. A total of 21 cryptocurrency addresses were identified. One individual exchanged approximately $2.5 million in crypto for North Korea. Blockchain analysis revealed fund flows to major exchanges, including over 200,000 USDT and 0.57 BTC traced to CEXs. One address held over $24 million in stablecoins, with significant outflows detected. This action underscores ongoing U.S. efforts to combat DPRK’s use of crypto to evade sanctions and fund illicit programs. Virtual asset service providers are urged to enhance AML screening and monitor high-risk addresses.

On March 12, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced sanctions against 6 individuals and 2 entities involved in a North Korea-led IT worker fraud network. The announcement stated that these participants systematically defrauded U.S. companies to provide funding for weapons of mass destruction programs, with the amount involved in 2024 alone approaching $800 million.

https://home.treasury.gov/news/press-releases/sb0416

Sanctions Details

According to the U.S. OFAC disclosure, North Korea-controlled IT teams used forged documents, stolen identities, and fabricated personas to conceal their true identities and gain employment at legitimate companies in the U.S. and other countries. The North Korean government seized the vast majority of these overseas IT workers' salaries, obtaining hundreds of millions of dollars to support its weapons of mass destruction and ballistic missile programs. In some cases, North Korea-linked personnel also secretly implanted malicious software into corporate networks to steal proprietary and sensitive information.

This round of sanctions targets 6 individuals (Nguyen Quang Viet, Do Pyong Kyong, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, York Louis Celestino Herrera), identified as providing substantial assistance to North Korean IT workers through cryptocurrency exchange, money laundering, bank account opening, and IT business matching; and 2 corporate entities (Amnokgang, Quangvietdnbg), identified as key operators and facilitators of the IT worker fraud network.

Sanctioned Address Analysis

This sanctions action locked a total of 21 cryptocurrency addresses. According to the OFAC notification, from mid-2023 to mid-2025, Quangvietdnbg CEO Nguyen Quang Viet exchanged approximately $2.5 million worth of cryptocurrency for the North Korean side, identifying cryptocurrency as a critical channel for North Korean IT workers to transfer funds and evade sanctions.

Analysis of the 21 addresses on this sanctions list was conducted using the on-chain anti-money laundering analysis platform Beosin KYT and the investigation tool Beosin Trace, with results as follows:

YUN, Song Guk (North Korean national, head of IT workers in Boten, Laos)

ETH:

0xb637f84b66876ebf609c2a4208905f9ddac9d075

0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3

According to Beosin Trace statistics, approximately 200,851 USDT previously flowed out to various centralized exchanges.

HOANG, Minh Quang (Collaborated to complete IT service transactions exceeding $70,000)

BTC:bc1qyy5pt5cx3zth8xlj92lq5y87dh8xv3nwgs4ncq

Previously, 0.57462 BTC flowed into a Coinbase account.

SIM, Hyon Sop (Representative of North Korea's Kwangson Bank in China, 11 new addresses added)

Previously frozen address (ETH network):

0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

This address had a liquid volume of 21,937,732.52 USDT and 2,071,126.59 USDC, with 58,148.62 USDT currently remaining dormant at this address.

Newly sanctioned addresses (ETH network):

0xd04E33461FEA8302c5E1e13895b60cEe8AEfda7F

0x76EA76CA4Eb727f18956aB93445a94c5280412B9

0xFb3eFf152ea55D1BfA04Dbdd509A80fD7b72cdEB

0xFda1Ec4A6178d4916b001a065422D31EBE5F62FF

0x747AFB5c7A7fc34B547cD0FDEbf9b91759C5a52b

Fund flow diagram is as follows:

Approximately 98,139.11 USDT, 21,300 USDC, and 0.51268 ETH flowed out.

New TRX addresses:

TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu

TGXE9dGWawjfd3xqFSho1h1bBbRv9wUGrF

TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1

TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T

TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s

TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2

Approximately 6,236.74 TRX and 999,014.46 USDT flowed out.

Cross-chain for the same address:

ARB:0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

BSC:0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

1,133,025.26 USDT, 935,943.84 BUSD, and 17,811.05 USDC flowed out to various centralized exchanges.

AMNOKGANG TECHNOLOGY DEVELOPMENT COMPANY

ETH:

0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D

0x0330070FD38Ec3bB94F58FA55D40368271E9e54A

0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573

A total of approximately 205.02 ETH, 274,531.15 USDT, and 228,496.97 USDC, with 96.05 ETH dormant in address 0x9be599d7867f5e1a2d7ec6db9710df2b98a15573.

Tron network

TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7

TEEYCuGDyeNkuDj4 U6GQRXxXo3Nh29r2vP

TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP

TDe2 UNAvuUnTbbDo7518eMe3TXN5qJW8Ft

2,744.75 TRX and 4,941,817.62 USDT flowed out to various centralized exchanges.

Beosin Anti-Money Laundering Recommendations

This action is another measure by the U.S. Treasury Department to continuously combat North Korea's use of cryptocurrency to evade sanctions. For the virtual asset industry, how to conduct anti-money laundering compliance screening and identify addresses involved in high-risk funds has become a critical capability for Virtual Asset Service Providers (VASPs).

Связанные с этим вопросы

QWhat action did the U.S. Treasury Department's OFAC announce on March 12th, and who was targeted?

AThe U.S. Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions against 6 individuals and 2 entities involved in a Democratic People's Republic of Korea (DPRK)-led IT worker fraud network.

QWhat was the primary method used by the DPRK IT teams to infiltrate legitimate companies, and what was the ultimate goal?

AThe DPRK IT teams used forged documents, stolen identities, and fabricated personas to conceal their true identities and gain employment at legitimate companies. The North Korean government then seized the vast majority of the overseas IT workers' salaries to obtain hundreds of millions of dollars in funding for its weapons of mass destruction (WMD) and ballistic missile programs.

QHow much cryptocurrency was exchanged by Nguyen Quang Viet for the North Korean side, and what role did crypto play according to OFAC?

ANguyen Quang Viet, the CEO of Quangvietdnbg, exchanged approximately $2.5 million worth of cryptocurrency for the North Korean side. OFAC identified cryptocurrency as a critical channel for DPRK IT workers to transfer funds and evade sanctions.

QWhich sanctioned individual was identified as a DPRK IT worker leader in Laos, and what was the associated Ethereum address with significant outflows?

AYUN, Song Guk was identified as a DPRK IT worker leader in Laos. The Ethereum address 0xb637f84b66876ebf609c2a4208905f9ddac9d075 was associated with him, from which approximately 200,851 USDT had flowed out to various centralized exchanges.

QWhat was the total amount of funds involved in the fraud network's activities in 2024 alone, as stated in the OFAC announcement?

AThe amount of funds involved in the fraud network's activities in 2024 alone was close to $800 million.

Похожее

Liquidity Forecasts Show Ozak AI Reaching a $1.5 Billion Fully Diluted Valuation Soon After Launch

Updated liquidity forecasts indicate that Ozak AI is positioned to reach a fully diluted valuation (FDV) of $1.5 billion shortly after its initial exchange listings. With over $6.8 million raised in its presale—priced at $0.014 per token—and more than 1.17 billion tokens already sold, the project has demonstrated strong early capital formation, reducing downside risk during price discovery. Analysts highlight that Ozak AI’s concentrated early supply and capital-efficient structure could allow smaller liquidity injections to drive significant valuation expansion, potentially bypassing lower valuation ranges entirely. The project’s AI-native infrastructure—including Prediction Agents, the Ozak Stream Network, Data Vaults, EigenLayer integration, and Arbitrum Orbit deployment—supports higher valuation multiples by offering tangible utility rather than speculative appeal. Partnerships with Pyth Network, SINT, HIVE Intel, and Weblume further strengthen liquidity confidence and exchange adoption prospects. With robust presale performance, functional AI infrastructure, and favorable liquidity dynamics, Ozak AI is emerging as a liquidity-driven growth asset with the potential for rapid post-launch valuation scaling.

TheNewsCrypto2 ч. назад

Liquidity Forecasts Show Ozak AI Reaching a $1.5 Billion Fully Diluted Valuation Soon After Launch

TheNewsCrypto2 ч. назад

Exchange Exposure Could Push Ozak AI’s Daily Volume Beyond $500 Million Within the First Trading Month

Ozak AI ($OZ) is positioned to capitalize on market shifts from established altcoins to innovative AI-driven projects. With a successful presale raising over $5 million and strong token distribution, the project is expected to achieve significant trading volume upon exchange listing—potentially exceeding $500 million daily within the first month. Key factors driving this outlook include concentrated early investor interest, AI and DePIN utility, and strategic partnerships enhancing functionality and credibility. Unlike hype-driven tokens, Ozak AI’s real-world use cases in staking and ecosystem integrations support sustained trading activity beyond initial speculation.

TheNewsCrypto3 ч. назад

Exchange Exposure Could Push Ozak AI’s Daily Volume Beyond $500 Million Within the First Trading Month

TheNewsCrypto3 ч. назад

Clarity Act Reaches Critical Juncture: The U.S. Crypto Regulatory Crossroads

The U.S. cryptocurrency regulatory landscape faces a historic turning point in spring 2026. The fate of the CLARITY Act, which aims to establish a comprehensive market structure framework for digital assets—hangs in the balance. If it fails to clear the Senate Banking Committee by late April, its chances of passage drop drastically, potentially delaying U.S. crypto legislation for years. Simultaneously, the GENIUS Act is reshaping the stablecoin market through stringent prudential regulations, including AML/CFT compliance and reserve requirements, favoring major compliant players like USDC and Tether’s new USAT. A key political compromise led by Senators Tillis and Alsobrooks addresses contentious issues like stablecoin yields, though critical implementation details remain unresolved. The White House strongly supports the legislation as part of a strategy to make the U.S. a global crypto hub, but political challenges—including midterm elections and cross-party demands—threaten its progress. If passed, the CLARITY Act could unlock trillions in institutional capital and help the U.S. compete with the EU’s MiCA framework. If stalled, global regulatory leadership may shift to Europe and Asia. Regardless of outcome, regulatory clarity and compliance infrastructure are becoming central to competitive advantage in the crypto industry.

marsbit3 ч. назад

Clarity Act Reaches Critical Juncture: The U.S. Crypto Regulatory Crossroads

marsbit3 ч. назад

Warsh Hearing Concludes: What Are the Notable Signals for the Crypto Industry?

The Senate Banking Committee held a confirmation hearing for Judy Shelton, a Federal Reserve nominee, who faced intense questioning regarding her ability to maintain the central bank's independence amid pressure from President Trump to lower interest rates. Shelton denied any pre-arranged commitments on rate cuts and emphasized her independence, though Democrats remained skeptical, citing contradictions with Trump's public statements. Shelton characterized post-pandemic inflation as a major policy failure and called for a "regime change" in the Fed’s approach, including reforms to inflation measurement and communication strategies. She criticized the current practice of Fed officials frequently signaling future rate moves and did not commit to maintaining post-meeting press conferences, suggesting potential reductions in transparency. Regarding crypto markets, Shelton’s extensive investments in digital asset companies—including Solana, DeFi, and blockchain infrastructure—were noted, though she has pledged to divest these holdings due to ethics rules. Her familiarity with the crypto industry and deregulatory leanings may signal a more open, though cautious, stance toward digital assets. However, concerns were raised about potential conflicts of interest, especially given Trump family involvement in crypto-financial ventures. The timing of her confirmation remains uncertain, pending a Justice Department investigation into current Chair Powell. Shelton’s potential leadership could lead to a more hawkish, productivity-focused Fed with tighter policy communication—factors that may significantly influence liquidity conditions and macro narratives for crypto markets.

marsbit4 ч. назад

Warsh Hearing Concludes: What Are the Notable Signals for the Crypto Industry?

marsbit4 ч. назад

"Form Over Substance" Fed Hearing: Warsh Avoids Interest Rates, But Offers Reassurance for Crypto

Kevin Wash, nominee for Federal Reserve Chair, testified before the Senate Banking Committee, emphasizing his independence from former President Trump and stating that Trump never asked him to commit to specific interest rate decisions. Wash avoided extensive discussion on monetary policy but called for institutional reforms at the Fed, advocating for a gradual and cautious reduction of the balance sheet without clear signals on rate cuts. The hearing was seen as largely symbolic, with Wash’s confirmation hinging on political negotiations offstage, particularly whether Trump drops his investigation into current Chair Powell. Notably, Wash expressed a crypto-friendly stance, acknowledging digital assets as part of the U.S. financial services industry and committing to divest his own crypto holdings if confirmed. This marks a positive signal for the crypto market from a potential Fed leader.

Odaily星球日报5 ч. назад

"Form Over Substance" Fed Hearing: Warsh Avoids Interest Rates, But Offers Reassurance for Crypto

Odaily星球日报5 ч. назад

Торговля

Спот

Фьючерсы

Обсуждения

Добро пожаловать в Сообщество HTX. Здесь вы сможете быть в курсе последних новостей о развитии платформы и получить доступ к профессиональной аналитической информации о рынке. Мнения пользователей о цене на S (S) представлены ниже.

On-Chain Tracking｜US Further Cracks Down on North Korean IT Worker Fraud Network Using Cryptocurrency to Fund Weapons of Mass Destruction, Sanctions 6 Individuals and 2 Entities

Введение

Sanctions Details

Sanctioned Address Analysis

Beosin Anti-Money Laundering Recommendations

Связанные с этим вопросы

Похожее

Liquidity Forecasts Show Ozak AI Reaching a $1.5 Billion Fully Diluted Valuation Soon After Launch

Exchange Exposure Could Push Ozak AI’s Daily Volume Beyond $500 Million Within the First Trading Month

Clarity Act Reaches Critical Juncture: The U.S. Crypto Regulatory Crossroads

Warsh Hearing Concludes: What Are the Notable Signals for the Crypto Industry?

"Form Over Substance" Fed Hearing: Warsh Avoids Interest Rates, But Offers Reassurance for Crypto

Торговля

Популярные статьи

Как купить S

Sonic: Обновления под руководством Андре Кронье – новая звезда Layer-1 на фоне спада рынка

HTX Learn: Пройдите обучение по "Sonic" и разделите 1000 USDT

Обсуждения

Топ вопросы

Популярные категории

Популярные теги