Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Crypto Journalist
We are here
Crypto Journalist
We are here
share
The US Department of Justice is moving to seize more than $15 million in USDT linked to North Korean hackers, part of a broader effort to disrupt Pyongyang’s growing reliance on crypto theft and illicit IT work to fund its sanctioned programs.
Key tips:
- The DOJ is seeking to seize more than $15 million in USDT linked to the North Korean hacking group APT38.
- The funds were traced to four major crypto platform breaches in 2023 and were first seized by the FBI in March 2025.
- Five individuals in the United States also pleaded guilty to assisting North Korean IT workers in infiltrating American companies.
The action, announced on Friday, includes two civil forfeiture complaints covering $15.1 million in Tether stolen during a series of 2023 attacks attributed to North Korea’s Advanced Persistent Threat 38 (APT38), a state-backed hacking unit known to target global crypto companies.
FBI Seeks to Give Up Seized USDT Linked to 2023 Crypto Hacks
Federal investigators traced digital assets to funds stolen from four virtual currency platforms in 2023.
The FBI initially seized the USDT in March 2025 and is now seeking court approval to permanently freeze the assets so they can be returned to the victims.
The DOJ has not identified the specific hacked platforms, although their timeline closely aligns with several major incidents that year, including the $100 million Poloniex breach in November 2023, the Hack $37 million CoinsPaid that July, the Alphapo payment attackwhich the DOJ estimates at about $100 million, and another November 2023 theft of about $138 million from a Panama-based exchange.
The DOJ has not confirmed which of these cases will be included in the forfeiture action.
According to the announcement, North Korean operatives continue to launder the stolen funds through a patchwork of mixers, cross-chain bridges, crypto exchanges and OTC brokers.
“Efforts to trace, seize, and confiscate the related stolen virtual currency remain ongoing as APT38 actors continue to launder such funds,” the DOJ said.
The enforcement push doesn’t stop at hackers. The DOJ also revealed that it has secured the guilt of five individuals who helped North Korea infiltrate US companies through fraudulent remote IT work, a scheme that has become a central revenue stream for Pyongyang.
Four American citizens, including Audricus Phagnasay (24), Jason Salazar (30), Alexander Paul Travis (34) and Erick Ntekesere Prince (38), admitted to a wire fraud conspiracy after providing their identities to North Korean IT workers and allowing them to use company-issued laptops from inside their homes.
The setup was designed to make these workers based in the United States, giving them access to American corporate networks.
Ukraine pleads guilty to selling stolen US identities to North Korea
In a separate plea, Ukrainian national Oleksandr Didenko admitted to one count of wire fraud conspiracy and aggravated identity theft.
He stole the identities of US citizens and sold them to North Korean IT operators, helping to secure roles at 40 companies. Didenko agreed to forfeit more than $1.4 million.
In total, the schemes affected 136 US companies, generated more than $2.2 million for the North Korean government, and compromised the identities of 18 Americans.
Officials have repeatedly warned that IT workers in North Korea can earn up to $300,000 a year, collectively pouring hundreds of millions of dollars into programs overseen by the regime’s Defense Ministry.
North Korea Crypto theft operations increased in 2025with hackers stealing more than $2 billion so far this year, according to blockchain analytics company Elliptic.
