US Strikes Back: $7.74M Crypto Seized from North Korea's Fake IT Worker Network

US authorities have successfully seized $7.74 million in cryptocurrency linked to a sophisticated network of North Korean IT workers. These individuals allegedly posed as foreign freelancers, using stolen US identities to secure remote jobs at tech companies, including blockchain firms. The illicit funds were then funneled back to the North Korean government to support its weapons programs, highlighting an ongoing effort to circumvent international sanctions.

Unmasking the North Korean IT Worker Scheme

The Department of Justice (DOJ) revealed that North Korean operatives obtained employment by using stolen or forged identities, often at blockchain development firms. Payments were frequently made in stablecoins like USDC and USDT. To obscure the origin of these funds, the workers employed various laundering tactics, including opening fake accounts, splitting transactions into smaller amounts, and utilizing token-swapping techniques. They even purchased NFTs as a store of value.

Key Players and Connections

• Sim Hyon Sop: A representative of North Korea's Foreign Trade Bank (FTB), Sim was indicted in April 2023 for his alleged role in facilitating these IT worker scams and laundering over $15 million in cryptocurrency.

• Kim Sang Man: CEO of Chinyong, a state-linked IT firm operating under North Korea's Ministry of Defense. Kim allegedly collaborated with Sim, opening accounts using fake Russian IDs. Chinyong has been on the US Treasury Department's list of Specially Designated Nationals (SDN) since 2017.

The Modus Operandi

The scheme involved several deceptive practices:

• Identity Theft: North Korean IT workers used stolen US identities to bypass HR security checks during the hiring process.

• VPN Usage: They regularly employed Virtual Private Networks (VPNs) to conceal their true location from both hiring companies and payroll facilitators.

• Complex Laundering: Once salaries were received, Sim would set up US-based online accounts using fictitious identities. Funds were then moved in small amounts to other blockchains or converted to different virtual currencies, a tactic known as "chain hopping" or "token swapping.

• Direct Funneling: The laundered funds were ultimately sent directly back to the Democratic People's Republic of Korea (DPRK) via Sim and, at times, through Kim Sang Man.

Broader Enforcement Efforts

This forfeiture is part of the FBI's "DPRK RevGen: Domestic Enabler Initiative," launched in March 2024. This initiative targets both North Korean operatives and their US-based enablers. Previous actions include:

• August 2023: A Nashville man was accused of running an IT worker laptop farm, funneling hundreds of thousands of dollars in fraudulent salaries to the DPRK.

• January 2024: Five individuals were charged for operating an overseas laptop farm that tricked at least 64 US companies into hiring fake IT workers.

• May 2024: Christina Marie Chapman of Arizona was charged for allegedly helping North Koreans pose as US citizens to obtain jobs, netting over $6.8 million.

The US government estimates that North Korean IT workers have infiltrated hundreds of companies, generating over $88 million in illicit funds over six years. This ongoing strategy aims to sever North Korea's access to the global financial system and prevent the regime from using cryptocurrency to evade sanctions.

As cyber threats become increasingly sophisticated, your security strategy must evolve to keep pace. BetterWorld Technology offers adaptive cybersecurity solutions that grow with the threat landscape, helping your business stay secure while continuing to innovate. Reach out today to schedule your personalized consultation.

Sources

• DOJ Seizes $7.7 Million in Crypto from North Korean IT Workers Reportedly Using Stolen U.S. IDs, Finance Magnates.

• North Korean IT Scam Tied to $7.7M Crypto Seizure, Cryptonews.

• US gov’t seizes $7.7M in illicit funds stolen in North Korean IT worker scams, Cybernews.

• DOJ Seizes $7.74M in Crypto Tied to North Korean Tech Ring – Legal Bitcoin News, Bitcoin.com News.

• US Seeks Forfeiture of $7.74M in Cryptocurrency Tied to North Korean IT Workers, SecurityWeek.