US sanctions have been imposed by the United States Treasury Department on two individuals and two companies for their role in stealing cryptocurrency from American businesses to fund North Korea’s weapons programme.

The sanctioned individuals and entities were part of a scam network that targeted  “American businesses through fraud schemes involving its overseas IT workers,” Under Secretary of the Treasury for Terrorism and Financial Intelligence John K. Hurley said in an Aug. 27 press release.

Among those named by the agency are Russian national Vitaliy Sergeyevich Andreyev, Kim Ung Sun, a North Korean government official stationed in Russia, and two companies, Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation.

How US sanctions target entities aiding North Korean IT workers

Andreyev, according to the Treasury, served as a money launderer for North Korean operatives and has helped launder roughly $600,000 worth of stolen cryptocurrency into U.S. dollars since December last year.

The funds were then routed towards Chinyong Information Technology Cooperation Company, a North Korean entity that is already under sanctions for its alleged ties to the country’s Ministry of Defense.

Officials said Andreyev was instrumental in helping North Korea bypass existing sanctions. 

Meanwhile, Kim Ung Sun, who officials say has worked with Andreyev to launder the stolen funds, acted as a diplomatic facilitator while stationed as a trade official in Russia.

The Chinese firm, Shenyang Geumpungri Network Technology Co., was established as a cover for a team of North Korean IT workers operating under Chinyong’s direction and has allegedly managed to generate over $1 million in profit for the regime.

It also played a leading role in embedding North Korean operatives into crypto and tech firms using fake documents and forged credentials, officials say.

Lastly, Korea Sinjin Trading Corporation was found to have direct ties with the North Korean Ministry of People’s Armed Forces General Political Bureau. Sinjin helped coordinate the scam network as a conduit between operatives and military authorities in Pyongyang, and was one of the financial beneficiaries of their earnings.

Chinyong is at the centre of the scam ring

The August 27 designations build on earlier actions targeting Chinyong, which has previously appeared in Treasury investigations for its central role in managing overseas crypto fraud campaigns. 

Ties between Chinyong and the North Korean military are well documented, and officials believe it operates as a shadow employer for North Korean IT workers. OFAC first blacklisted Chinyong in May 2023, marking the company as part of North Korea’s expanding web of overseas IT operations.

North Korea has long been known to fund what Treasury officials call “illicit weapons of mass destruction” via coordinated cyberattacks and multinational scams that often employ complex social engineering tactics.  

A United Nations Security Council report released last year concluded that groups tied to Pyongyang drained more than $3.6 billion in cryptocurrency between 2017 and 2024 — a figure that investigators say has only climbed since.

Over the years, authorities have gone after both the operatives and the networks behind them, using sanctions, prosecutions, and seizures to chip away at North Korea’s cyber machinery.

Just last month, the Treasury Department sanctioned Song Kum Hyok, a North Korean national tied to the country’s Reconnaissance General Bureau and its hacking unit Andariel, for helping foreign-based operatives use stolen U.S. identities to apply for remote jobs. 

Yet bad actors have shown no signs of stopping. Estimates from independent blockchain investigator ZachXBT suggest hundreds of North Korean IT operatives have quietly infiltrated the crypto industry.