North Korea Used Fake IT Workers to Steal $800M in Crypto

The money came from a simple but effective operation: place North Korean nationals inside Western companies as remote IT workers and funnel their salaries back to Pyongyang. according to a report from KoreaTimes.

The network operated across North Korea, Vietnam, Laos, and Spain.

The two entities sanctioned are Amnokgang Technology Development Company, a North Korean firm that manages overseas IT worker deployments and procures military technology, and Quangvietdnbg International Services Company Limited, a Vietnam-based company used to convert worker earnings into cryptocurrency.

Six individuals were also designated. Nguyen Quang Viet, CEO of Quangvietdnbg, allegedly converted $2.5 million into crypto for the regime between mid-2023 and mid-2025. Yun Song Guk, a North Korean national, has been running IT worker groups out of Boten, Laos since at least 2023. Hoang Van Nguyen helped previously sanctioned North Korean official Kim Se Un open bank accounts and move funds. Hoang Minh Quang handled over $70,000 in transactions tied to Yun’s network.

How the Scheme Works

Workers enter companies using stolen identities, fake credentials, and forged documents. Once inside, individual workers earn up to $200,000 a year — money that goes straight back to the regime.

The operation has become harder to catch. North Korea now uses AI to alter workers’ appearances, voices, and accents during video interviews to match stolen identities. Some embedded workers go further — planting malware to steal proprietary data or extort companies for ransoms.

Treasury Secretary Scott Bessent said the regime “weaponizes sensitive data” and that the U.S. would continue to “follow the money.” Foreign financial institutions that knowingly process transactions for the designated parties now face secondary sanctions.

2025 Crypto Crime: Record Numbers Across the Board

Global illicit cryptocurrency flows reached $154–$158 billion in 2025, a 145% increase from 2024.

Sanctions evasion surged 694%, driven largely by Russia-linked flows through the ruble-backed A7A5 stablecoin, which processed over $93 billion in under a year. Hackers stole $2.87 billion across 150 incidents. One breach — Bybit, in February 2025 — accounted for $1.46 billion, or 51% of the year’s total hacking losses. Stablecoins now represent 84% of all illicit transaction volume, preferred for their liquidity and ease of cross-border transfers.

North Korea’s total crypto theft for 2025 reached an estimated $2.02 billion — a 51% increase over the prior year — with operations documented in more than 40 countries. An estimated 1,500 IT workers operate out of China, with another 500 spread across Russia, Laos, Cambodia, and several African nations.

Fraud Has Industrialized

Scams in 2025 stopped being individual operations. They now run as structured businesses — with developers, data brokers, and dedicated money laundering networks working in parallel.

AI-enabled scams using deepfakes and voice cloning were 4.5 times more profitable than traditional methods. Impersonation fraud — where criminals pose as banks, the IRS, or government agencies to pressure victims into immediate transfers — grew 1,400% year-over-year. Chinese-language money laundering networks processed over $100 billion for global criminal markets in 2025.

Recent Enforcement Actions

On March 11, 2026, Europol and U.S. authorities dismantled SocksEscort, a malicious proxy service, seizing 34 domains and freezing $3.5 million in cryptocurrency. In January 2026, the FBI warned that North Korean group Kimsuky was using malicious QR codes in spearphishing campaigns targeting U.S. entities. The DOJ has filed for forfeiture of 127,000 BTC — valued at $15 billion — seized from the Prince Group, a Cambodia-based organization behind large-scale pig butchering scams. It is the largest crypto asset forfeiture in history.

Analysts at Chainalysis and TRM Labs identify North Korea’s over-the-counter laundering brokers — informal traders who convert crypto into usable currency — as the most exposed part of the network and the most viable target for future enforcement.

The information provided in this article is for educational purposes only and does not constitute financial, investment, or trading advice. Coindoo.com does not endorse or recommend any specific investment strategy or cryptocurrency. Always conduct your own research and consult with a licensed financial advisor before making any investment decisions.

The post North Korea Used Fake IT Workers to Steal $800M in Crypto appeared first on Coindoo.