The U.S. Department of the Treasury has imposed sanctions on a network accused of helping North Korea raise illicit revenue through overseas IT workers and cryptocurrency transactions. The individuals and entities were designated by the Treasury’s Office of Foreign Assets Control, which said they facilitated the scheme.
Stolen identities used to secure remote tech jobs
According to the Treasury, North Korean IT workers used stolen identities and fabricated personas to obtain remote jobs at companies around the world. They often posed as freelance programmers or software engineers on global contracting platforms, allowing them to earn wages from employers that did not know who they were actually hiring. Treasury officials said those earnings were then funneled back to the North Korean government to support its weapons of mass destruction and ballistic missile programs.
Officials added that the regime has relied on overseas workers of this kind to generate hundreds of millions of dollars annually. The description points to a recurring revenue channel rather than an isolated fraud case.
Crypto transactions allegedly helped obscure the money trail
The Treasury said cryptocurrency was used to move and disguise the proceeds. Facilitators allegedly converted digital assets into cash or used crypto transactions to obscure the origin of funds before transferring them to accounts linked to the regime. In the department’s account, digital assets were part of the mechanism for both transferring earnings and masking where the money came from.
The activity did not stop at collecting wages. Authorities said that in some cases, these operatives introduced malware into company networks or exfiltrated sensitive data after gaining access to corporate systems. That expands the issue beyond sanctions evasion into direct cyber and corporate security risk.
Sanctions freeze U.S.-based assets and restrict dealings
Treasury officials said the move is part of a broader U.S. effort to cut off revenue streams used by North Korea to evade international sanctions and finance military programs. The department said any U.S.-based assets belonging to the designated individuals and entities are frozen, and U.S. persons are generally prohibited from engaging in transactions with them.
Washington has repeatedly warned that North Korea is making greater use of cybercrime, cryptocurrency theft, and fraudulent IT employment schemes to fund weapons development. The latest action places that warning squarely on both global hiring practices and digital asset compliance controls.