North Korea Used Fake IT Workers to Steal $800M in Crypto

The U.S. Treasury's Office of Foreign Assets Control (OFAC) has sanctioned six individuals and two entities for orchestrating a scheme that funneled approximately $800 million to North Korea's weapons programs in 2024. This operation involved North Korean nationals posing as remote IT workers for Western companies, using stolen identities and AI-generated deepfakes to secure employment and then sending their salaries back to Pyongyang.

Scheme Operations and Entities Involved

The illicit network operated across North Korea, Vietnam, Laos, and Spain. The sanctioned entities include Amnokgang Technology Development Company, a North Korean firm managing overseas IT worker deployments and procuring military technology, and Quangvietdnbg International Services Company Limited, a Vietnam-based company that converted worker earnings into cryptocurrency. Key individuals sanctioned include Nguyen Quang Viet, CEO of Quangvietdnbg, who allegedly converted $2.5 million into crypto for the regime, and Yun Song Guk, a North Korean national managing IT worker groups in Laos.

Exploiting Remote Work and AI

North Korean operatives exploit stolen identities, fake credentials, and forged documents to gain employment as remote IT workers, earning up to $200,000 annually per individual. To evade detection, the regime now employs AI to alter workers' appearances and voices during video interviews, making them indistinguishable from the individuals whose identities they have stolen. Some embedded workers also engage in planting malware or extorting companies.

Record Global Illicit Crypto Flows

In 2025, global illicit cryptocurrency flows surged to a record $154–$158 billion, a 145% increase from the previous year. This rise was largely driven by sanctions evasion, particularly through the ruble-backed A7A5 stablecoin, and industrialized fraud. Hackers stole $2.87 billion across 150 incidents, with the Bybit exchange breach accounting for over half of the total losses. Stablecoins now constitute 84% of illicit transaction volume due to their liquidity and ease of cross-border transfers.

North Korea's Crypto Theft and Fraud Industrialization

North Korea's crypto theft reached an estimated $2.02 billion in 2025, a 51% increase from the prior year, with operations spanning over 40 countries. An estimated 1,500 IT workers operate out of China, with hundreds more spread across Russia, Laos, Cambodia, and African nations. Scams have evolved from individual operations to structured businesses, with AI-enabled scams using deepfakes and voice cloning proving significantly more profitable. Impersonation fraud also saw a substantial increase.

Recent Enforcement Actions

Recent enforcement actions include the dismantling of the malicious proxy service SocksEscort by Europol and U.S. authorities, seizing domains and freezing cryptocurrency. The FBI has warned of North Korean group Kimsuky using malicious QR codes in spearphishing campaigns. In a landmark case, the DOJ filed for forfeiture of 127,000 BTC, valued at $15 billion, seized from the Prince Group, marking the largest crypto asset forfeiture in history. Analysts identify North Korea’s over-the-counter laundering brokers as vulnerable targets for future enforcement.