The U.S. Treasury Department”s Office of Foreign Assets Control (OFAC) has imposed sanctions on a network connected to North Korea”s overseas IT worker operations, which allegedly generated nearly $800 million in illicit revenue in 2024. This action underscores the ongoing role of cryptocurrency in sanctions evasion.
On March 12, 2026, OFAC targeted six individuals and two entities associated with the Democratic People”s Republic of Korea (DPRK). These sanctions reveal how North Korean workers, many of whom used stolen identities and fake credentials, infiltrated legitimate technology firms and businesses worldwide.
The funds earned through these operations reportedly supported the North Korean regime”s weaponry programs, including ballistic missile development. According to Treasury officials, the illicit income generated from these overseas positions was funneled back to the North Korean government.
Cybersecurity firm Chainalysis characterized the operation as a well-coordinated global effort, with activities traced across multiple countries, including Vietnam, Laos, and Spain. Digital asset transfers were a critical component of this scheme, enabling the movement of illicit funds across borders.
Details of the Sanctioned Network
The recent sanctions included 21 cryptocurrency addresses from various blockchains, notably Ethereum, Tron, and Bitcoin. These addresses were reportedly utilized to obscure the flow of funds generated from North Korean IT worker earnings.
One key facilitator, Nguyen Quang Viet, based in Vietnam, converted approximately $2.5 million into cryptocurrency for North Korean workers between 2023 and 2025. Several addresses linked to the Amnokgang Technology Development Company were also identified; this DPRK entity oversees IT worker delegations and procurement.
Additionally, Yun Song Guk was mentioned for leading an IT worker group in Boten, Laos. Treasury investigators uncovered two Ethereum addresses associated with his operations, which received payments for technology services. Another individual, Hoang Minh Quang, was identified as managing over $70,000 in transactions with Yun related to IT services performed by North Korean employees.
Implications for Cryptocurrency Platforms
OFAC”s actions have expanded sanctions on Sim Hyon Sop, a representative of Korea Kwangson Banking Corp in China, with eleven new cryptocurrency addresses connected to his financial network. Chainalysis noted that the sanctioned entities relied on various crypto services, including hosted wallets, exchanges, decentralized finance (DeFi) platforms, and cross-chain bridges.
In light of these developments, U.S. authorities are urging cryptocurrency companies to exercise due diligence by screening counterparties meticulously and monitoring for unusual payment patterns that may be linked to overseas IT work.
This latest enforcement highlights the persistent challenges regulators face in combating the use of cryptocurrencies for illicit activities and the need for enhanced vigilance within the crypto industry.
