Federal Ruling on North Korean IT Workers’ Wages
In a recent ruling, a federal judge in the United States has mandated the forfeiture of approximately $212,700 in stablecoins associated with wages earned by North Korean IT workers, marking a significant advancement for the Justice Department in its broader effort to seize over $7.74 million in digital currencies linked to a purported sanctions evasion scheme.
Details of the Ruling
On September 3, Judge Rudolph Contreras of the U.S. District Court concluded that the funds seized from a specific crypto wallet, which begins with “0x81c4”, should be surrendered to the U.S. government. His decision confirmed part of the Justice Department’s motion for a default judgment, although he withheld approval for the immediate seizure of other assets that were also part of the case.
The federal prosecutors indicated that the wallet received a total of about 158,123 USDC coins from at least 10 different addresses involved in processing payments for North Korean technical staff, along with an additional 54,574 USDT from four distinct payment sources. Together, these dollar-pegged stablecoins amounted to the aforementioned $212,700.
Allegations of Fraud and Money Laundering
The government claimed that these funds were the result of a scheme whereby North Korean workers secured positions in the IT sector abroad, masking their identities and locations, and subsequently funneled their wages through cryptocurrency to ultimately send money back to North Korea.
Judge Contreras affirmed that the evidence presented by the government sufficiently linked the 0x81c4 crypto wallet to the alleged illegal activities. He determined that the government’s allegations presented a case of wire fraud and money laundering, noting that the transactions involved foreign entities acting on behalf of individuals under sanctions in violation of the International Emergency Economic Powers Act.
Scope of the Forfeiture Initiative
While the ruling facilitates the forfeiture of these specific assets, it only addresses a fraction of the entire range of assets targeted for seizure by U.S. authorities. The Justice Department launched its civil forfeiture initiative in June 2025, aiming to recover more than $7.74 million in cryptocurrency and digital assets generated and laundered through similar North Korean IT employment operations.
Previously, these assets were frozen in connection with an indictment from April 2023 against Sim Hyon Sop, who is implicated in managing the movement of crypto earnings linked to North Korean IT employees. This seizure included various forms of digital property, such as NFTs and Ethereum Name Service domains, following claims that some funds had already been frozen or taken while North Korean associates were attempting to launder their earnings.
Future Implications and Investigations
However, the judge denied the forfeiture of additional assets, citing insufficient identification of these properties in the government’s public notice, leaving the door open for prosecutors to appeal with more information in the future. The Justice Department has accused North Korea of deploying IT personnel internationally to secure jobs at blockchain and technology firms, often utilizing phony identification documents to obscure their true nationality.
These workers received compensation for their legitimate IT services using stablecoins like USDC and USDT. Prosecutors highlighted that various tactics were employed to hide the source of their cryptocurrency before routing the funds to North Korea, including maintaining low transaction amounts, using accounts created under fake identities, token exchanges, and mixing their employment gains with other funds.
U.S. law enforcement remains focused on dismantling the networks that facilitate these operations. In March, the Treasury Department imposed sanctions on a network that purportedly assisted North Korean workers in finding jobs abroad while employing false identities, further complicating the laundering of their earnings through cryptocurrency.
Additionally, investigations have exposed that North Korean operatives have infiltrated crypto development circles, with an Ethereum Foundation-backed study identifying numerous suspects linked to DPRK activities within tech companies. Continued concerns arose in July 2026 when Consensys uncovered that a consultant tied to North Korea had temporarily accessed its systems, although no assets or sensitive data appeared to have been compromised.
Key Operatives and Ongoing Struggles
The forfeiture case also references Sim and Kim Sang Man as key operatives who facilitated the movement of funds earned by North Korean workers abroad. Sim, associated with North Korea’s Foreign Trade Bank, has been sanctioned in the past due to his involvement in the country’s weapons programs, while Kim was also sanctioned for his executive role in the Chinyong IT Cooperation Company, which fields teams of IT workers overseas, particularly in countries such as Russia and Laos.
Recent investigations have shown a direct link between Kim and significant crypto transactions emanating from overseas workers, underscoring the ongoing struggle against North Korean efforts to fund its government through illicit means.
