US Treasury Sanctions Alleged $800 Million North Korean IT Worker Fraud Operation

The U.S. Treasury Department has imposed sanctions on six individuals and two entities involved in a North Korean scheme that allegedly used fraudulent IT workers to infiltrate American companies and generate nearly $800 million in revenue in 2024 alone. This revenue is reportedly being funneled to Pyongyang's weapons programs, violating U.S. and United Nations sanctions.

Details of the Scheme

According to the Treasury's Office of Foreign Assets Control (OFAC), North Korean IT workers typically secure remote employment with U.S. and allied companies by using stolen identities, fake personas, and forged documents. The regime then diverts the majority of their wages to fund its nuclear and ballistic missile programs. In some instances, these workers have also deployed malware within company networks to steal proprietary data.

Treasury Secretary Scott Bessent stated, “The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.” He emphasized the department's commitment to protecting U.S. businesses and holding those responsible accountable.

International Operations and Sanctioned Parties

The sanctioned individuals operated across various countries, including Vietnam, Laos, and Spain. One designated Vietnamese businessman allegedly converted approximately $2.5 million into cryptocurrency for North Korean operatives between 2023 and 2025. Others were sanctioned for assisting a previously designated North Korean nuclear procurement facilitator with money laundering and opening bank accounts. A North Korean national was also targeted for leading an IT worker group based in Boten, Laos.

As a result of the sanctions, all U.S. assets belonging to the designated individuals and entities are frozen, and U.S. persons are prohibited from conducting business with them. Foreign financial institutions that knowingly facilitate transactions for these parties risk secondary sanctions.

North Korea's Role in Crypto Theft

North Korean state-sponsored hackers have been identified as significant actors in the cryptocurrency space. Reports indicate that in 2025, these hackers stole over $2 billion worth of crypto through various attacks. This includes a substantial heist of nearly $1.5 billion from the crypto exchange Bybit, according to Chainalysis.