DOJ files to confiscate alleged North Korea IT worker crypto

The US Department of Justice has moved to seize $7.74 million in crypto allegedly earned by North Korean IT workers using fake identities and working at blockchain firms as remote contractors.  

The funds were initially frozen in April 2023 as part of an indictment against Sim Hyon Sop, a China-based banker allegedly helping North Korean IT workers launder money, the DOJ said in a June 5 statement.

The Justice Department is looking to seize multiple cryptocurrencies, including stablecoins and Bitcoin (BTC) in varying amounts, along with non-fungible tokens and Ethereum Name Service domains that are held in multiple self-custody wallets and Binance accounts, according to its civil forfeiture complaint filed June 5 in a Washington, DC federal court.

Matthew Galeotti, head of the Justice Department’s criminal division, said the case highlights how the North Korean government is trying to exploit the “cryptocurrency ecosystem to fund its illicit priorities.” 

“The Department will use every legal tool at its disposal to safeguard the cryptocurrency ecosystem and deny North Korea its ill-gotten gains in violation of US sanctions,” he said.

The DOJ claimed that the North Korean IT workers who earned the crypto were active in multiple countries and used phony identification documents and other obfuscation strategies to gain employment.

IT workers allegedly launder ill-gotten gains

After being paid, often in stablecoins such as USDC (USDC) and Tether (USDT), the IT workers allegedly used laundering techniques, including chain hopping and token swaps to NFTs, to obscure the funds’ origins.

The Justice Department alleged the funds were supposed to be sent back to the North Korean government via Sim and Kim Sang Man, another North Korean sanctioned by the OFAC for money laundering offenses.

In recent years, North Korea has been ramping up its efforts to infiltrate the crypto industry and raise funds to send back to the hermit kingdom. 

Google’s Threat Intelligence Group released an April report detailing North Korea expanding its infiltration operations to blockchain firms outside the US after increased scrutiny from authorities, with a notable focus on Europe.

Related: G7 summit could discuss North Korea’s crypto hacks: Report

Meanwhile, blockchain investigator ZachXBT said last August he uncovered evidence of a sophisticated network of North Korean developers that earn as much as $500,000 a month working for “established” crypto projects.

In 2022, the DOJ, Department of State and the Treasury issued a joint advisory warning about the influx of North Korean workers into various freelance tech jobs, especially crypto.

Magazine: Lazarus Group’s favorite exploit revealed — Crypto hacks analysis