U.S. Treasury Sanctions Network for DPRK Crypto Laundering

Table of Contents

U.S. Targets North Korean Cryptocurrency Laundering Network

The U.S. Treasury imposed sanctions on ten entities and individuals linked to North Korea’s illicit IT worker schemes and cryptocurrency laundering activities on November 25, 2025. This marks a significant push to undermine North Korea’s financing of its weapons programs.

Tether Freezes $344 Million in USDT Over Illicit Activity

House Bill Introduces Warrants for AI Surveillance Access

Sam Bankman-Fried Withdraws Rule 33 Motion Amid FTX Speculation

The sanctions target individuals and organizations involved in transferring illicit funds, specifically focusing on the network that allegedly generated over $2 billion annually from cryptocurrency thefts. The U.S. government aims to constrict the regime’s financial resources obtained through sophisticated digital operation schemes, particularly using hacked funds for military advancements. The move represents an escalation in coordinated global sanctions efforts by various nations to combat North Korea’s illicit revenue streams, according to sources familiar with the matter.

Identifying Key Players

Entities mentioned in the Treasury’s action include Jang Kuk Chol and Ho Jong Son, who are accused of managing $5.3 million in cryptocurrency tied to First Credit Bank, also known as Cheil Credit Bank. These funds have reportedly been linked to ransomware attacks targeting U.S. victims and fraudulent IT job schemes. The sanctions also extend to the Korea Mangyongdae Computer Technology Company (KMCTC), a North Korean IT firm dispatching workers to Chinese cities while utilizing local nationals as banking proxies to obscure their operations.

The Treasury’s action also encompasses eight individuals and two firms, contributing to what has been described as North Korea’s “sanctions-evasion architecture.” Under Secretary for Terrorism and Financial Intelligence John K. Hurley stated that these sanctioned entities pose a direct threat to both U.S. and global security by enabling North Korea’s funding for nuclear weapons.

The Broader Context of Cybercrime and U.S. Actions

In 2025, North Korean hackers reportedly stole at least $2.02 billion in cryptocurrencies, a notable increase of 51% from the previous year. A particularly significant breach occurred with the Bybit hack, resulting in losses of $1.5 billion. These stolen funds are typically laundered through a predictable cycle involving small transactions, often breaking down amounts to evade detection, primarily through Chinese banks and over-the-counter traders operating across 40 countries.

International monitoring, including a United Nations Multilateral Sanctions Monitoring Team report, highlights North Korea’s vast global cyber infrastructure, relying on IT workers and facilitators located in China, Russia, Cambodia, and Vietnam. The U.S. has been proactive in its response, pushing for legislation such as the GENIUS Act to intensify efforts against money laundering while securing international cooperation to freeze assets linked to these illicit activities.

What Comes Next

The sanctions aim to obstruct North Korea’s systematic laundering processes, with funds often compartmentalized into smaller on-chain transactions under $500,000 before conversion into fiat currency to finance their weapons of mass destruction programs. Estimates suggest that over $3 billion in digital assets may have been stolen over the past three years. This trend underscores the importance of ongoing Treasury assessments, which continually evaluate the risks posed by North Korean cyber operations.

As the situation develops, analysts believe that international cooperation will be crucial in maintaining pressure on DPRK’s revenue-generating networks. The implications of these sanctions extend beyond financial restrictions, serving to demonstrate a unified front among allied nations against North Korea’s illicit activities. Achieving long-term goals will depend heavily on the collaborative intelligence-sharing and counter-cybercrime efforts across borders.