The US Department of the Treasury has sanctioned six people and two entities linked to an alleged North Korean IT worker fraud network. The network reportedly generates revenue to fund North Korea’s weapons program and frequently targets the cryptocurrency sector.

Over the past year, the US has imposed sanctions on North Korean bankers and companies accused of moving cryptocurrency stolen through cybercrime and IT worker fraud to fund Pyongyang’s weapons programs. The network reportedly used shell companies, fake overseas firms, and intermediaries in China and Russia to conceal the transfers.

Vietnam Firm Accused Laundering $2.5M Crypto

The Office of Foreign Assets Control announced the latest sanctions yesterday (Thursday).

The designations include Amnokgang Technology Development Company, a North Korean firm accused of managing overseas IT workers, and Nguyen Quang Viet, CEO of Quangvietdnbg International Services Company Limited, a Vietnam-based company accused of laundering $2.5 million through cryptocurrency for the network.

• US Court Dismisses Major Claims in Binance Hamas-Linked Payments Case
• JPMorgan Accused of Ignoring Red Flags as Goliath Ventures’ $328M Crypto Ponzi Scheme Collapsed
• $790 Million Alleged Losses Linked to GainBitcoin as CBI Arrests Darwin Labs Co-Founder

The individuals sanctioned are Do Phi Khanh, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, and York Louis Celestino Herrera. OFAC said the sanctions freeze all US assets connected to the designated parties and bar them from conducting financial transactions or business with US persons. Violations carry civil and criminal penalties.

North Korea IT Workers Target Crypto

Fraudulent IT workers linked to North Korea have increasingly targeted industries including blockchain and cryptocurrency companies. A Google report in April 2025 noted that the infrastructure supporting these schemes has expanded globally.

The sanctions also include 21 cryptocurrency addresses across Ethereum and Tron. Chainalysis said the “designation of addresses across multiple blockchain networks reflects [North Korea’s] increasingly multi-chain approach to moving funds.”

Chainalysis added that North Korean IT worker schemes “represent a sophisticated and growing threat,” using fake identities to gain employment with companies and sometimes introducing malware to access sensitive information.