The U.S. Department of Justice (DOJ) has initiated legal proceedings to seize over $7.7 million in cryptocurrency assets linked to a sophisticated laundering scheme allegedly operated by North Korean IT agents posing as remote blockchain workers.
Filed on June 5 in Washington, D.C., the civil forfeiture complaint reveals that the crypto funds were initially frozen in April 2023 during a broader investigation involving Sim Hyon Sop—a China-based banker accused of helping launder illicit earnings for the North Korean regime. According to the DOJ, the operatives used fake identities, forged documentation, and false job placements at crypto and Web3 companies to funnel money back to North Korea.
The DOJ seeks to confiscate a range of digital assets—spanning Bitcoin, stablecoins like USDT and USDC, NFTs, and Ethereum Name Service domains—spread across self-hosted wallets and accounts tied to Binance. These funds were allegedly acquired through fraudulent employment practices and moved through layers of complex obfuscation to avoid detection.
“North Korea continues to exploit the cryptocurrency ecosystem to fund weapons programs and evade global sanctions,” said Matthew Galeotti, head of the DOJ’s criminal division.
“The Department will use every legal tool at its disposal to safeguard the cryptocurrency ecosystem and deny North Korea its ill-gotten gains in violation of US sanctions.”
Authorities warn that the operation, involving actors based in multiple jurisdictions, reflects a growing threat to digital finance. The perpetrators reportedly used advanced tactics—including deepfake identities and forged credentials—to infiltrate legitimate firms across the globe. The case underscores urgent concerns about the vulnerabilities inherent in remote hiring practices, especially in the crypto industry.
Workers Used NFT Swaps, Chain Hopping to Launder Funds
Prosecutors say the operatives employed advanced laundering techniques—such as NFT conversions and cross-chain asset hopping—to conceal millions in crypto earnings derived from fake employment contracts at blockchain companies.
According to the DOJ’s complaint, the workers were primarily compensated in stablecoins like USDC and USDT. The assets were then moved across various blockchains, rapidly swapped between currencies, and converted into NFTs—effectively disrupting traditional compliance tools and leaving investigators with a fragmented digital trail.
Officials allege the laundered funds were routed back to North Korea via an elaborate financial web that included Sim Hyon Sop and Kim Sang Man, both previously sanctioned for roles in state-linked financial crimes.
These findings contribute to a mounting body of evidence that North Korea is deliberately leveraging freelance tech employment to evade sanctions and finance its regime. In April, Google’s Threat Analysis Group reported that these tactics were expanding to include European targets—highlighting a shift beyond the U.S.
Crypto investigator ZachXBT previously tracked a network of North Korean-affiliated developers generating as much as $500,000 per month while working for unsuspecting crypto startups that failed to verify their identities.
In response to this threat, the DOJ, Treasury Department, and State Department jointly issued a public advisory in 2022, warning the crypto industry of a rising trend: North Korean operatives posing as freelance developers to gain access to critical systems and funds.
Quick Facts
- DOJ seeks to seize $7.7M in crypto tied to North Korean laundering
- Operatives posed as remote blockchain developers using fake IDs
- Laundering methods included NFT swaps and blockchain hopping
- Funds were routed through self-hosted wallets and Binance accounts
- Key figures include Sim Hyon Sop and Kim Sang Man, both sanctioned
- Google and ZachXBT have tracked broader freelance fraud patterns
