US sanctions 11 over North Korean IT worker scheme that moved millions in crypto
Treasury says two Russian nationals converted more than $5 million in crypto for North Korean networks and published the wallets involved.
The US Treasury has added 11 people and entities to its sanctions list over a scheme that placed North Korean IT workers in jobs abroad and moved their earnings through crypto.
What happened
According to the Treasury’s Office of Foreign Assets Control (OFAC), two Russian nationals converted more than $5 million in crypto for North Korean networks. OFAC listed the crypto wallets linked to those involved as part of the sanctions designations.
The sanctions bar US people and companies from dealing with those named and freeze any assets they hold under US jurisdiction.
Background
US officials have warned for years that thousands of North Korean IT workers use false identities to win remote jobs, often at technology and crypto companies. Their salaries, frequently paid in crypto or stablecoins, are sent back to fund the government in Pyongyang, including its weapons programmes.
The workers rarely act alone. They rely on helpers abroad who provide identities, laptops and bank accounts, and on money handlers who convert crypto into cash or other currencies. Sanctions that target those handlers are aimed at the point where digital funds become usable money.
Why it matters
Publishing wallet addresses turns the sanctions into a practical tool for the crypto industry. Exchanges and stablecoin issuers can screen against those addresses and block or freeze funds that touch them.
The move also comes as North Korea faces accusations over the much larger Binance theft. Together, the cases show two sides of the same strategy: quiet, steady income from fake workers, and occasional large thefts from crypto firms.
Written by Tech Security with AI assistance. Not financial advice. See our disclaimer.