Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
The US Treasury has impose fresh sanctions about a group of North Korean bankers and institutions accused of laundering millions in cryptocurrencies linked to cyberattacks and illicit IT work schemes that help finance Pyongyang’s weapons programs.
The Office of Foreign Assets Control (OFAC) said Tuesday that eight individuals and two entities have been designated for “laundering funds derived from cybercrime and computer worker fraud,” including proceeds related to ransomware and crypto theft.
“North Korean state hackers are stealing and laundering money to fund the regime’s nuclear weapons program,” Treasury Under Secretary for Terrorism and Financial Intelligence John K. Hurley said in a news release.
Last month, blockchain analytics firm Elliptic reported that North Korean hackers had stolen more than $2 billion in cryptocurrency by 2025, underscoring the regime’s growing reliance on digital assets.
According to the Treasury, DPRK hackers are using advanced malware, phishing campaigns, and social engineering to breach crypto companies and exchanges. A recent one CoinDesk investigation also found that North Korean hackers are increasingly leveraging AI to automate and scale their attacks.
The sanctioned network allegedly relied on cryptocurrency transactions and shell companies to hide the flow of illicit funds. Two North Korean bankers, Jang Kuk Chol and Ho Jong Son, handled at least $5.3 million in crypto linked to OFAC-designated First Credit Bank, funds linked to a ransomware group that previously targeted US victims and laundered proceeds from overseas DPRK IT workers.
OFAC said the two men were designated under multiple executive orders to support cyber-enabled activities and business operations that generate revenue for the North Korean government.
The Treasury also targeted the Korea Mangyongdae Computer Technology Company (KMCTC), which operates delegations of IT workers in Shenyang and Dandong in China. KMCTC and its chairman, U Yong Su, allegedly used Chinese nationals as banking proxies to disguise the origins of funds earned by DPRK IT workers abroad.
Tuesday’s actions extend to Ryujong Credit Bank, accused of facilitating international transfers for North Korean entities involved in sanctions evasion and crypto-laundering.
OFAC said the designations strengthen U.S. efforts to “cut off illicit revenue streams” that fuel North Korea’s weapons programs and cyber operations that threaten the global digital economy.
