Six Individuals, Two Entities Face US Treasury Sanctions Over North Korean IT Worker Scheme
Six people and two organizations have been sanctioned by the US Treasury Department for their purported involvement in a North Korean-operated IT worker fraud operation, resulting in frozen assets and 21 blacklisted cryptocurrency addresses.
Six individuals along with two organizations have been hit with sanctions by the US Treasury Department for their purported participation in a fraudulent IT worker scheme run by North Korea, which commonly sets its sights on the cryptocurrency sector.
On Thursday, the Office of Foreign Assets Control (OFAC) announced sanctions against alleged enablers of IT worker fraud operations functioning across North Korea, Vietnam, Laos and Spain, schemes that produce income to support North Korea's weapons development program.
Among those sanctioned by OFAC were Amnokgang Technology Development Company, a firm based in the DPRK that allegedly oversees IT workers stationed abroad, along with Nguyen Quang Viet, who serves as CEO of Quangvietdnbg International Services Company Limited, a Vietnam-based enterprise accused of using cryptocurrency to launder $2.5 million for the network.
Additional sanctions were imposed on Do Phi Khanh, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang and York Louis Celestino Herrera for their purported involvement in the DPRK IT worker operations.
The punitive measures result in the freezing of all assets held in the United States by those who were designated, and they are prohibited from carrying out financial transactions or participating in any commercial activities with the US, with violations subject to civil and criminal penalties.
Technology workers with fraudulent credentials linked to North Korea have maintained significant activity, going after various sectors, including companies in the blockchain space. A report published by Google in April 2025 revealed that the infrastructure supporting these schemes has expanded on a global scale.
Worker fraud rings a growing threat: Chainalysis
The OFAC sanctions encompassed 21 cryptocurrency wallet addresses spanning the Ethereum and Tron networks. On Thursday, Chainalysis stated that the "designation of addresses across multiple blockchain networks reflects [North Korea's] increasingly multi-chain approach to moving funds."
According to Chainalysis, North Korean IT worker operations "represent a sophisticated and growing threat," depending on stolen personal information and fabricated professional profiles to secure jobs with reputable companies around the world.
"Beyond generating revenue through fraudulent employment, these workers have also been known to covertly introduce malware into company networks to extract proprietary and sensitive information," the firm said.
"Cryptocurrency businesses should screen all counterparties against updated OFAC sanctions lists, be alert to patterns consistent with IT worker fraud, and monitor for unusual payment patterns."