On-Chain Tracking｜US Further Cracks Down on North Korean IT Worker Fraud Network Using Cryptocurrency to Fund Weapons of Mass Destruction, Sanctions 6 Individuals and 2 Entities

marsbit发布于2026-03-14更新于2026-03-14

文章摘要

On March 12, the U.S. Treasury’s OFAC sanctioned six individuals and two entities involved in a DPRK-led IT worker fraud network. These actors allegedly deceived U.S. companies to generate revenue for North Korea’s weapons of mass destruction programs, with nearly $800 million involved in 2024 alone. The sanctioned individuals facilitated crypto exchange, money laundering, and IT operations, while the entities (Amnokgang and Quangvietdnbg) were key operators. A total of 21 cryptocurrency addresses were identified. One individual exchanged approximately $2.5 million in crypto for North Korea. Blockchain analysis revealed fund flows to major exchanges, including over 200,000 USDT and 0.57 BTC traced to CEXs. One address held over $24 million in stablecoins, with significant outflows detected. This action underscores ongoing U.S. efforts to combat DPRK’s use of crypto to evade sanctions and fund illicit programs. Virtual asset service providers are urged to enhance AML screening and monitor high-risk addresses.

On March 12, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced sanctions against 6 individuals and 2 entities involved in a North Korea-led IT worker fraud network. The announcement stated that these participants systematically defrauded U.S. companies to provide funding for weapons of mass destruction programs, with the amount involved in 2024 alone approaching $800 million.

https://home.treasury.gov/news/press-releases/sb0416

Sanctions Details

According to the U.S. OFAC disclosure, North Korea-controlled IT teams used forged documents, stolen identities, and fabricated personas to conceal their true identities and gain employment at legitimate companies in the U.S. and other countries. The North Korean government seized the vast majority of these overseas IT workers' salaries, obtaining hundreds of millions of dollars to support its weapons of mass destruction and ballistic missile programs. In some cases, North Korea-linked personnel also secretly implanted malicious software into corporate networks to steal proprietary and sensitive information.

This round of sanctions targets 6 individuals (Nguyen Quang Viet, Do Pyong Kyong, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, York Louis Celestino Herrera), identified as providing substantial assistance to North Korean IT workers through cryptocurrency exchange, money laundering, bank account opening, and IT business matching; and 2 corporate entities (Amnokgang, Quangvietdnbg), identified as key operators and facilitators of the IT worker fraud network.

Sanctioned Address Analysis

This sanctions action locked a total of 21 cryptocurrency addresses. According to the OFAC notification, from mid-2023 to mid-2025, Quangvietdnbg CEO Nguyen Quang Viet exchanged approximately $2.5 million worth of cryptocurrency for the North Korean side, identifying cryptocurrency as a critical channel for North Korean IT workers to transfer funds and evade sanctions.

Analysis of the 21 addresses on this sanctions list was conducted using the on-chain anti-money laundering analysis platform Beosin KYT and the investigation tool Beosin Trace, with results as follows:

YUN, Song Guk (North Korean national, head of IT workers in Boten, Laos)

ETH:

0xb637f84b66876ebf609c2a4208905f9ddac9d075

0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3

According to Beosin Trace statistics, approximately 200,851 USDT previously flowed out to various centralized exchanges.

HOANG, Minh Quang (Collaborated to complete IT service transactions exceeding $70,000)

BTC:bc1qyy5pt5cx3zth8xlj92lq5y87dh8xv3nwgs4ncq

Previously, 0.57462 BTC flowed into a Coinbase account.

SIM, Hyon Sop (Representative of North Korea's Kwangson Bank in China, 11 new addresses added)

Previously frozen address (ETH network):

0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

This address had a liquid volume of 21,937,732.52 USDT and 2,071,126.59 USDC, with 58,148.62 USDT currently remaining dormant at this address.

Newly sanctioned addresses (ETH network):

0xd04E33461FEA8302c5E1e13895b60cEe8AEfda7F

0x76EA76CA4Eb727f18956aB93445a94c5280412B9

0xFb3eFf152ea55D1BfA04Dbdd509A80fD7b72cdEB

0xFda1Ec4A6178d4916b001a065422D31EBE5F62FF

0x747AFB5c7A7fc34B547cD0FDEbf9b91759C5a52b

Fund flow diagram is as follows:

Approximately 98,139.11 USDT, 21,300 USDC, and 0.51268 ETH flowed out.

New TRX addresses:

TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu

TGXE9dGWawjfd3xqFSho1h1bBbRv9wUGrF

TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1

TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T

TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s

TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2

Approximately 6,236.74 TRX and 999,014.46 USDT flowed out.

Cross-chain for the same address:

ARB:0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

BSC:0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c

1,133,025.26 USDT, 935,943.84 BUSD, and 17,811.05 USDC flowed out to various centralized exchanges.

AMNOKGANG TECHNOLOGY DEVELOPMENT COMPANY

ETH:

0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D

0x0330070FD38Ec3bB94F58FA55D40368271E9e54A

0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573

A total of approximately 205.02 ETH, 274,531.15 USDT, and 228,496.97 USDC, with 96.05 ETH dormant in address 0x9be599d7867f5e1a2d7ec6db9710df2b98a15573.

Tron network

TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7

TEEYCuGDyeNkuDj4 U6GQRXxXo3Nh29r2vP

TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP

TDe2 UNAvuUnTbbDo7518eMe3TXN5qJW8Ft

2,744.75 TRX and 4,941,817.62 USDT flowed out to various centralized exchanges.

Beosin Anti-Money Laundering Recommendations

This action is another measure by the U.S. Treasury Department to continuously combat North Korea's use of cryptocurrency to evade sanctions. For the virtual asset industry, how to conduct anti-money laundering compliance screening and identify addresses involved in high-risk funds has become a critical capability for Virtual Asset Service Providers (VASPs).

相关问答

QWhat action did the U.S. Treasury Department's OFAC announce on March 12th, and who was targeted?

AThe U.S. Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions against 6 individuals and 2 entities involved in a Democratic People's Republic of Korea (DPRK)-led IT worker fraud network.

QWhat was the primary method used by the DPRK IT teams to infiltrate legitimate companies, and what was the ultimate goal?

AThe DPRK IT teams used forged documents, stolen identities, and fabricated personas to conceal their true identities and gain employment at legitimate companies. The North Korean government then seized the vast majority of the overseas IT workers' salaries to obtain hundreds of millions of dollars in funding for its weapons of mass destruction (WMD) and ballistic missile programs.

QHow much cryptocurrency was exchanged by Nguyen Quang Viet for the North Korean side, and what role did crypto play according to OFAC?

ANguyen Quang Viet, the CEO of Quangvietdnbg, exchanged approximately $2.5 million worth of cryptocurrency for the North Korean side. OFAC identified cryptocurrency as a critical channel for DPRK IT workers to transfer funds and evade sanctions.

QWhich sanctioned individual was identified as a DPRK IT worker leader in Laos, and what was the associated Ethereum address with significant outflows?

AYUN, Song Guk was identified as a DPRK IT worker leader in Laos. The Ethereum address 0xb637f84b66876ebf609c2a4208905f9ddac9d075 was associated with him, from which approximately 200,851 USDT had flowed out to various centralized exchanges.

QWhat was the total amount of funds involved in the fraud network's activities in 2024 alone, as stated in the OFAC announcement?

AThe amount of funds involved in the fraud network's activities in 2024 alone was close to $800 million.

你可能也喜欢

朝鲜黑客单月狂掠 5 亿美元，已成加密安全头号威胁

朝鲜黑客组织Lazarus Group在不到三周内从DeFi平台窃取超5亿美元，今年非法所得已达7亿美元，总盗窃额累计67.5亿美元。攻击手法从直接攻击智能合约转向利用基础设施边缘漏洞，如通过渗透第三方RPC节点操控协议运行。 此外，朝鲜还系统性渗透全球加密行业，约100名特工使用伪造身份潜伏于区块链公司，长期获取权限后发起内部攻击。洗钱过程高度依赖中文地区担保交易和跨链混币服务。 安全专家指出，防范需加强访问控制、减少单点故障，并在攻击发生后快速协同拦截。行业需在协议外围运营安全层面提升防御能力。

marsbit13分钟前

朝鲜黑客单月狂掠 5 亿美元，已成加密安全头号威胁

marsbit13分钟前

Circle CEO首尔行：不发韩元稳定币，却见遍了韩国所有的大银行

Circle CEO Jeremy Allaire 近期访问韩国时明确表示，暂无计划发行韩元稳定币，但Circle在首尔密集推进了多项合作，包括与Upbit、Bithumb等交易所深化合作，与新韩银行、KB金融集团、友利银行等大型金融机构会面，并推动稳定币基础设施的落地。 韩国加密市场交易量约占全球30%，但结构尚不成熟，以散户和高波动性资产交易为主。目前韩国稳定币发行权存在争议，政策层倾向于科技公司发行，而银行体系主张由银行主导。在这一监管未明的背景下，Circle选择不直接竞争发行权，而是转向成为“稳定币基础设施提供者”，通过技术与服务嵌入未来可能出现的多种稳定币体系。 Allaire还提到，人民币稳定币在未来3至5年可能存在巨大机会。整体来看，稳定币竞争核心正从“发行权”转向“体系位置”，未来稳定币将呈现多主权货币并存、强监管及与传统金融深度融合的趋势，而Circle的策略是成为连接不同稳定币体系的基础设施层。

marsbit41分钟前

Circle CEO首尔行：不发韩元稳定币，却见遍了韩国所有的大银行

marsbit41分钟前

SpaceX绑定Cursor：一场“先锁定再收购”的AI豪赌

SpaceX宣布获得以600亿美元收购AI编程公司Cursor的选择权，并设定了若不收购则需支付100亿美元合作费用的替代条款。这一交易结构极具弹性，本质上是一种“期权式收购”，使SpaceX能够在承担有限风险的同时，高度绑定Cursor的技术与商业轨道。 交易核心是AI时代关键资源的交换：SpaceX提供其Colossus超级计算集群的算力，而Cursor则贡献其在开发者群体中的产品渗透力和AI编程技术。这种合作打通了“算力—模型—应用”的完整链条，弥补了SpaceX在应用层尤其是开发者工具领域的短板。 Cursor作为“AI原生开发环境”，其价值在于深度嵌入软件开发流程，代表软件生产方式的变革。尽管仅成立数年，其估值已跃升至600亿美元，年收入超10亿美元，反映出市场对其控制未来开发入口的高度认可。 从战略角度看，这是马斯克将SpaceX从航天公司转型为“AI基础设施平台”的关键一步，通过整合xAI、超算和芯片制造，构建覆盖算力、模型与应用的闭环体系，为其IPO提供更具吸引力的叙事基础。 行业竞争逻辑正从模型能力转向入口与生态之争，编程工具成为核心入口之一。SpaceX通过此举争夺程序员群体，意图在未来软件生产体系中占据主导位置。 然而，交易也存在估值过高、技术整合不确定性及监管风险。但无论如何，其真正意义在于提前锁定AI时代软件开发这一核心生产入口，押注通过控制算力与入口重新定义技术权力的分配方式。

marsbit1小时前

SpaceX绑定Cursor：一场“先锁定再收购”的AI豪赌

marsbit1小时前

Ripple的代币化赌注：随着进入万亿美元行业，XRP价格会暴涨吗？

XRP账本上正在发生一场静默的机构资本迁移。目前已有超过3.33亿美元与美债相关的机构级代币化产品部署于该网络，包括贝莱德支持的Ondo Finance（2.218亿美元）、OpenEden（5500万美元）、古根海姆（4000万美元）和安本集团（1590万美元）等机构产品。 尽管规模仅占30万亿美元美债市场的微小份额，但XRPL在2025年实现了代币化资产2200%的爆发式增长。分析师预测全球代币化市场规模可能从当前260亿美元扩张至200万亿美元。若XRP账本能持续获取这一新兴市场的份额，将对其价格产生深远影响。当前机构采用仍处于早期阶段，但底层基础设施的成熟为长期价值奠定了基础。

bitcoinist2小时前

Ripple的代币化赌注：随着进入万亿美元行业，XRP价格会暴涨吗？

bitcoinist2小时前

比特币或可加强美国国家安全，高级军事指挥官表示

美国高级军事官员表示，比特币可能增强美国国家安全。海军上将塞缪尔·帕帕罗在参议院军事委员会听证会上指出，比特币不仅是一种点对点的价值转移工具，还具有重要的计算机科学应用，尤其是其工作量证明机制可作为网络安全防护手段，大幅提高网络攻击成本。 这一观点呼应了此前美国太空军成员杰森·洛厄里的主张，即比特币的技术可应用于保护数据及通信安全，超越纯金融用途。听证会同时讨论了美国在比特币持有和挖矿领域的领先地位，但也提到其硬件依赖海外制造的供应链风险。 此外，会议涉及中国将比特币视为战略资产、朝鲜黑客组织通过加密货币窃资支持武器计划等安全威胁。目前美国正推动国内比特币矿机生产，以减少对外国设备的依赖。

bitcoinist4小时前

比特币或可加强美国国家安全，高级军事指挥官表示

bitcoinist4小时前

交易

现货
合约

热门文章

如何购买S

欢迎来到HTX.com！我们已经让购买Sonic（S）变得简单而便捷。跟随我们的逐步指南，放心开始您的加密货币之旅。第一步：创建您的HTX账户使用您的电子邮件、手机号码注册一个免费账户在HTX上。体验无忧的注册过程并解锁所有平台功能。立即注册第二步：前往买币页面，选择您的支付方式信用卡/借记卡购买：使用您的Visa或Mastercard即时购买Sonic（S）。余额购买：使用您HTX账户余额中的资金进行无缝交易。第三方购买：探索诸如Google Pay或Apple Pay等流行支付方法以增加便利性。C2C购买：在HTX平台上直接与其他用户交易。HTX场外交易台（OTC）购买：为大量交易者提供个性化服务和竞争性汇率。第三步：存储您的Sonic（S）购买完您的Sonic（S）后，将其存储在您的HTX账户钱包中。您也可以通过区块链转账将其发送到其他地方或者用于交易其他加密货币。第四步：交易Sonic（S）在HTX的现货市场轻松交易Sonic（S)。访问您的账户，选择您的交易对，执行您的交易，并实时监控。HTX为初学者和经验丰富的交易者提供了友好的用户体验。

2.0k人学过发布于 2025.01.15更新于 2025.03.21

如何购买S

相关讨论

欢迎来到HTX社区。在这里，您可以了解最新的平台发展动态并获得专业的市场意见。以下是用户对S(S)币价的意见。

活动图片

热门问答

热门分类right-arrow

热门标签right-arrow