U.S. Treasury Crypto Sanctions Target $600K DPRK Scheme Backed by Chinese Front

TLDR:

• Treasury imposed fresh crypto sanctions on DPRK-linked actors accused of funneling funds into weapons programs.
• A Russian national and DPRK consular official moved $600K in crypto, triggering new U.S. sanctions.
• A Chinese front company earned $1M for DPRK entities through IT workers, Treasury reported.
• The new crypto sanctions expand U.S. efforts to block DPRK’s use of IT networks and cryptocurrency.

The U.S. Treasury has announced new sanctions targeting a North Korean revenue scheme that relied on fraudulent IT workers. These workers were accused of infiltrating companies, using stolen identities, and funneling funds back to Pyongyang. 

Officials stated that the network helped finance weapons programs through cryptocurrency channels. The action broadens ongoing measures against the Democratic People’s Republic of Korea’s (DPRK) attempts to evade restrictions. Authorities confirmed that the scheme harmed businesses in the United States and beyond.

Treasury Expands Crypto Sanctions on DPRK IT Networks

According to the Treasury’s Office of Foreign Assets Control (OFAC), the sanctioned network involved two individuals, a Chinese company, and a DPRK trading corporation. 

The announcement, posted by the U.S. Treasury’s official account on X, named Russian national Vitaliy Sergeyevich Andreyev and DPRK official Kim Ung Sun. Both were accused of helping move cryptocurrency into cash to support the DPRK defense ministry’s entities.

Authorities said Andreyev converted nearly $600,000 worth of crypto into U.S. dollars since late 2024. He reportedly worked with Kim Ung Sun, who acted in Russia as a DPRK consular official. 

Their coordination allegedly provided direct support to the Chinyong Information Technology Cooperation Company, already under sanctions for its role in weapons funding.

The sanctions also hit Shenyang Geumpungri Network Technology Co., Ltd, a Chinese front company. Since 2021, Treasury said its delegation of DPRK IT workers generated more than $1 million. Those funds were linked to Chinyong and Korea Sinjin Trading Corporation, both tied to DPRK’s military structures.

Officials stressed that these IT workers used false documents and stolen identities to infiltrate businesses. They sometimes planted malware into networks, enabling theft of sensitive data and ransom demands. This tactic, the Treasury said, created financial and cybersecurity risks for American firms.

Crypto Sanctions Bring New Risks for Businesses and Banks

The new designations place strict limits on any property or assets connected to those named. Any assets under U.S. jurisdiction are blocked and must be reported to OFAC. The order also prohibits U.S. persons from engaging in transactions with these entities or individuals.

Financial institutions were warned about possible exposure if they processed transactions tied to the sanctioned parties. The action also opens the possibility of secondary sanctions on foreign banks that knowingly assist these transactions.

OFAC noted that while sanctions aim to restrict illicit funding, they also offer an opportunity for removal if behaviors change. For now, Treasury emphasized that the focus is protecting U.S. businesses from fraud schemes that blend crypto transactions with cyber intrusions.

This announcement builds on earlier actions in July, when Treasury issued sanctions against other DPRK IT networks. The department worked alongside Japan and South Korea, who jointly released a statement on the same day about the continuing risks posed by DPRK’s IT workforce

The post U.S. Treasury Crypto Sanctions Target $600K DPRK Scheme Backed by Chinese Front appeared first on Blockonomi.