Legal Action Against North Korean IT Professionals
Today, the U.S. Department of Justice has taken significant legal action by filing a civil forfeiture complaint in the District of Columbia. This complaint targets a group of North Korean IT professionals who, according to the allegations, illegally secured employment while generating millions of dollars in cryptocurrency, all strategically aimed at circumventing U.S. sanctions against North Korea. The assets in question had previously been tied to an indictment from April 2023 against Sim Hyon Sop—a representative of the North Korean Foreign Trade Bank—accused of collaborating with these IT workers in their illicit activities. Through a series of legal maneuvers, the U.S. government has successfully frozen and seized approximately $7.74 million associated with their operation.
The Department’s Stance
Matthew R. Galeotti, who oversees the Criminal Division of the Justice Department, stated that this forfeiture case underscores the North Korean regime’s potential misuse of the cryptocurrency sector to subsidize its unlawful goals. He emphasized the Department’s commitment to employing every legal resource possible to safeguard this digital economy and disrupt North Korea’s acquisition of assets obtained in violation of international sanctions.
Similarly, Sue J. Bai, head of the National Security Division, elaborated on the ongoing issues, explaining that North Korea has consistently leveraged global remote IT contracting and the cryptocurrency realm as tools for evading U.S. sanctions and funding its weapons initiatives. According to her, the hefty forfeiture announced today demonstrates the Department’s tactical aim at dismantling such revenue-generating schemes.
Warnings Issued
U.S. Attorney Jeanine Ferris Pirro highlighted the seriousness of this matter. She conveyed a stern message to potential adversaries: anyone attempting to profit from criminal enterprises, either directly or indirectly, should reconsider such strategies. Emphasizing the steadfastness of U.S. sanctions against North Korea, she assured that efforts to bypass them will lead to comprehensive investigations and ensuing legal actions.
Details of the Operation
The complaint describes an extensive operation wherein North Korean IT workers engaged in fraudulent practices to obtain jobs by misusing the identities of American citizens.
This deception enabled the North Korean regime to skirt U.S. sanctions and produce revenue for its authoritarian rule. Employees were reportedly based in countries like China and Russia, and engaged with diverse sectors, including blockchain firms, all while employing a range of fraudulent identification methods to obscure their true identities and affiliations.
This complex scheme allowed these workers to receive salaries—often paid in stablecoins such as USDC and USDT—while subsequently laundering these proceeds. Through various illicit means, including utilizing fictitious identities, small transaction volumes, cryptocurrency exchanges, and even purchasing non-fungible tokens, they sought to mask the origins of their financial gains. In some instances, they would channel these funds back to North Korea using intermediary figures like Kim Sang Man, the CEO of Chinyong IT Cooperation Company, which operates under North Korea’s Ministry of Defense.
Ongoing Investigations
The forfeiture action today expands on a series of legal initiatives aimed at undermining North Korea’s revenue channels, following previous high-impact operations executed throughout 2023 and into 2024. The investigative efforts are spearheaded by the FBI’s Chicago Field Office and the Virtual Assets Unit, with multiple legal personnel handling the case.
Additionally, the FBI, in partnership with the State and Treasury Departments, has distributed advisory alerts to help the broader community recognize threats posed by North Korean IT workers and ensure they remain alert against such sophisticated deceptive practices.
