North Korea’s Crypto Laundering Web Faces New US Sanctions

Between 2017 and 2025, North Korea turned the crypto sector into a structural source of funding. On October 28, 2025, the US Treasury hit a conversion network tied to the regime, following a series of investigations linking infiltrated IT worker salaries, hacks and industrial-scale laundering.

A Salary Scheme Disguised as Payroll

On October 28, 2025, the Treasury designated ten individuals and one entity tied to a cryptocurrency conversion network linked to North Korea. Two Russian nationals, Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas, are accused of facilitating about $5.5 million in crypto transactions for Pyongyang over several periods. According to the Treasury, the scheme monetizes the salaries of North Korean IT workers covertly hired under false identities by legitimate companies, including crypto firms. These proceeds fund the regime and its weapons programs.

Chainalysis traced the path of one infiltrated developer who contributed code to blockchain projects and DeFi (decentralized finance) protocols. Between late 2022 and early 2023, his wallet received stablecoins roughly every two weeks, at a pace resembling a paycheck. He then converted them into Ether (ETH) and moved them to consolidation addresses that Chainalysis links to sanctioned entities. Some funds reportedly reached Boykov, who allegedly passed them to the sanctioned Russian platform Garantex for potential cash-out. Chainalysis says these relationships dated back several years and therefore predated the most recent sanctions.

Flows by Actor

The amounts attributed to each intermediary point to continuous activity rather than an isolated event:

Boykov also allegedly monitored transfers and provided logistical support to Limited Liability Company Alis, which is linked to the North Korean IT workers. Obertas allegedly processed at least $1.25 million in other currencies since January 2025. Chainalysis also linked funds from Amnokgang Technology Development Company, an already sanctioned organization, to wallets associated with Obertas. Those flows then reached mainstream and sanctioned exchanges. Six workers at the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, reportedly generated more than $750,000 since 2025.

The Office of Foreign Assets Control (OFAC) added Ethereum and Tron addresses tied to the designated individuals, along with an Ethereum address linked to Kim Ki Hyok. Property under US jurisdiction must be blocked and reported, and US persons generally cannot deal with designated parties without authorization.

Infiltration, Forged Identities and Intermediaries

The infiltration relies on stolen identities, falsified documents and fabricated work histories. Operators used generative AI to produce résumés, realistic photos and even deepfake videos during interviews, masking their identities and getting around recruitment checks. Once hired, they receive salaries that the regime allegedly appropriates. The Treasury warns that these workers exploit corporate access to deploy malware and steal proprietary or sensitive data.

The operatives are generally based in China or Russia. They rely on a US-based intermediary, sometimes operating out of an ordinary home in Arizona, Minnesota or Illinois, who opens or holds the accounts that receive the salaries and then redistributes the funds. This intermediary also hosts what is described as a laptop farm: the employer ships equipment that is configured to let operatives log in from China or Russia while making the connection appear to come from the United States. In some cases, one intermediary managed 50 to 60 machines.

“The point of this scam is really to earn money from well-paid jobs in the US and the West and send it directly to Kim Jong Un and his regime, to fund everything from the nuclear weapons program to his personal slush fund and other government operations.”

Bobbie Johnson, freelance investigative journalist

Johnson counted about a dozen active cases in the United States, each potentially linked to dozens or even hundreds of jobs, though the true scale remained unknown. Separately, four North Korean nationals were charged by federal prosecutors with seeking remote employment at a US company in order to steal nearly $1 million in cryptocurrency. A UN panel of experts cited by Chainalysis estimates that this type of employment scheme generates between $250 million and $600 million in annual revenue for the regime.

Bybit: The Largest Crypto Heist on Record

On February 21, 2025, hackers compromised a Bybit vendor to secretly alter the wallet address toward which 401,000 ETH was headed, a theft of roughly $1.5 billion. According to the BBC, at least $300 million, or 232 million pounds, had been converted into untraceable funds within two weeks, and Bybit estimated that about 20% of the assets had “gone dark.”

TRM Labs estimates that more than $2.7 billion was stolen in crypto hacks in 2025, with over half linked to North Korea. The playbook remains consistent: a fake job offer or investment pitch on LinkedIn, followed by a booby-trapped coding test that steals SSH keys, browser cookies or cloud tokens. Attackers then capture hot wallet keys, multisig signatures or deployment systems.

“Every minute counts for hackers trying to muddy the trail of funds, and they are extremely sophisticated in what they do.”

Dr Tom Robinson, co-founder of Elliptic

Robinson added that among crypto criminals, “North Korea is the best at laundering cryptocurrency.” Bybit CEO Ben Zhou stated that “no customer funds were stolen.” The company replenished the stolen ETH through loans from investors and launched a Lazarus bounty program. Twenty people reportedly shared more than $4 million in rewards after identifying $40 million in stolen funds and alerting crypto companies.

Laundering at Industrial Scale

TRM describes the liquidation of these funds as a near-industrial activity, outsourced to a network of OTC (over-the-counter) brokers, underground bankers and money transmitters, often referred to as the “Chinese laundromat.” After the sanctions against Tornado Cash in 2022 and Sinbad in 2023, funds were fragmented across Avalanche, Ethereum, Bitcoin and Tron, with stablecoins notably converted into USDT on Tron.

According to TRM, the laundering and liquidation of the Bybit proceeds was entrusted to these Chinese specialists. Professional organizations buy assets at a discount and settle in yuan, goods or direct payments to North Korean front companies, sometimes through WeChat. These mechanisms explain why static sanctions lists are no longer enough, and TRM urges companies to monitor multichain transaction paths.

Diverging Estimates and Precedents

Figures vary by source. Recorded Future estimates that North Korea stole about $3 billion in cryptocurrency since 2017, including $1.7 billion in 2022, or 44% of that year’s crypto thefts. The Council on Foreign Relations (CFR) reports more than $1 billion stolen in 2022, versus $400 million in 2021, and roughly one-third of all losses from cyber intrusions into crypto. The sources do not specify whether the gap stems from different counting periods, scopes or methodologies.

Precedents are numerous: the 2019 Upbit hack (about $41 million), the $275 million KuCoin theft in 2020, most of which was recovered, the $600 million Ronin Bridge attack in 2022 and roughly $100 million taken from Atomic Wallet in 2023. Pyongyang has never acknowledged being behind the Lazarus Group. In 2020, Washington placed North Koreans accused of belonging to Lazarus on its Cyber Most Wanted list, with arrest odds judged extremely low.

Sanctions, Limits and Response Options

The CFR considers US sanctions against crypto mixers, notably Blender in May 2022 and Tornado Cash in August 2022, to have been relatively effective: Tornado Cash volume fell sharply after its designation. However, the decentralized nature of these protocols prevents them from being isolated from the financial system the way a conventional organization can be, and new mixing services keep emerging. The exchange eXch, accused of letting more than $90 million pass through, disputes the allegation. Its owner, Johann Roberts, says his team initially did not freeze the funds because of a dispute with Bybit and doubts about their origin, and that it is now cooperating.

Saher Naumaan, principal threat intelligence analyst at BAE Systems Digital Intelligence, recommends a public and transparent registry of compromises, real-time reporting of stolen wallets, CISA and NSA guidance on securing smart contracts, and periodic audits certified by NIST and made mandatory by the Treasury.

However, the available sources report no measurable change in market prices directly linked to the October 28, 2025 sanctions. The impact of these measures is therefore better measured in compliance and regulatory risk than in price terms.

Outlook and Scenarios

The North Korean case reveals a structural tension: the more crypto integrates with financial markets, the more attractive it becomes to sanctioned actors, and the more robust compliance infrastructure must be. Three scenarios stand out. In the central case, targeted sanctions and on-chain surveillance keep hindering conversion without eliminating flows. In a more favorable case, public compromise registries and certified audits shrink attack surfaces. In an adverse case, deepfake sophistication and multichain fragmentation make detection slower than exfiltration.

For investors and companies alike, operational risk, covering hiring, key management and smart contract security, is now a distinct factor, on par with volatility.

Sources

• CryptoSlate
• TRM Labs
• BBC
• Recorded Future
• PBS NewsHour
• Council on Foreign Relations (CFR)

Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.