US Seeks to Seize $7.7M in Crypto Linked to North Korean IT Worker Laundering Scheme

Washington, D.C. – June 6, 2025 — The U.S. Department of Justice (DOJ) has launched a civil forfeiture action to seize over $7.7 million in cryptocurrencies and NFTs allegedly linked to a North Korean money laundering operation involving IT workers posing as remote blockchain developers.

According to a statement released on June 5, the funds—originally frozen in April 2023—were tied to a network of North Korean nationals using false identities to secure remote jobs at tech and blockchain companies. These workers, under the guidance of North Korean agents, reportedly funneled their crypto earnings back to the regime through a complex laundering scheme.

Crypto Earnings Laundered Through Chain Hopping and NFTs

The DOJ alleges that the IT workers, operating from various countries, received payments in cryptocurrencies such as Bitcoin (BTC), Tether (USDT), and USD Coin (USDC). After acquiring the funds, they used advanced techniques like chain hopping, token swapping, and conversions to non-fungible tokens (NFTs) to disguise the origins of the money.

The scheme was allegedly facilitated by Sim Hyon Sop, a China-based financial intermediary previously indicted for aiding North Korean operatives. Another key player identified is Kim Sang Man, a North Korean national sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) for similar financial crimes.

Read More: North Korean Hackers Pose as IT Workers to Steal Billions, Study Reveals

Assets Targeted in Forfeiture Include Multiple Wallets and ENS Domains

The DOJ's forfeiture filing seeks control over a diverse portfolio of assets spread across self-custody crypto wallets, Binance exchange accounts, Ethereum Name Service (ENS) domains, and digital collectibles. The targeted assets reflect a growing trend of cybercriminals turning to decentralized tools to hide illicit gains.

Source: US Department of Justice

DOJ Vows to Protect Crypto Ecosystem from State Exploitation

“This case demonstrates how the North Korean regime continues to exploit the cryptocurrency ecosystem to finance its unlawful activities,” said Matthew Galeotti, head of the DOJ’s criminal division. “We will continue to use all available legal measures to prevent sanctioned entities from abusing digital assets.”

The DOJ’s actions align with broader government efforts to curb North Korea’s increasing cyber aggression. In recent years, the regime has ramped up its digital infiltration, with a sharp focus on freelance tech roles within the global crypto space.

Read More: U.S. Sanctions Target Crypto Wallets Linked to Garantex and Yemen’s Houthis

North Korea’s Expanding Digital Footprint

An April 2025 report by Google’s Threat Intelligence Group noted a marked increase in North Korean efforts to penetrate blockchain firms in Europe and other non-U.S. jurisdictions. This follows earlier warnings from U.S. agencies, including a 2022 advisory from the DOJ, State Department, and Treasury, highlighting the risk posed by disguised North Korean tech freelancers.

Further investigation by blockchain analyst ZachXBT in 2024 revealed a vast, coordinated network of North Korean developers earning up to $500,000 per month working for established crypto platforms—often without the companies being aware of their true identities.

Key Takeaways for the Crypto Industry

• North Korea is actively exploiting remote tech jobs to fund its regime via cryptocurrency.

• IT workers use sophisticated laundering methods, including NFTs and chain-hopping, to cover tracks.

• The U.S. government is pursuing aggressive legal action to freeze and seize illicit digital assets.

• Companies in the crypto and tech space should remain vigilant and enhance identity verification processes for remote hires.