North Korea crypto laundering scheme unmasked in new U.S. sanctions crackdown

The North Korea crypto scheme has erupted back into the spotlight as the U.S. Treasury Department imposed sweeping sanctions on August 27, targeting a Russian national, a Chinese firm, and North Korean-linked entities accused of channeling illicit digital assets into Pyongyang’s weapons program.

North Korea crypto scheme and the $600,000 laundered trail

At the heart of the North Korea crypto scheme was Andreyev, who officials say laundered nearly $600,000 worth of stolen cryptocurrency into U.S. dollars since late 2023.

These funds were funneled into the Chinyong Information Technology Cooperation Company, a Pyongyang-linked entity already sanctioned for its ties to the Ministry of Defense.

“North Korea’s use of overseas IT workers and crypto fraud continues to pose a direct threat to international security,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence, John K. Hurley.

The North Korea crypto scheme was not limited to Andreyev’s laundering. According to U.S. officials, Kim Ung Sunworked alongside him as a diplomatic fixer, helping to conceal illicit transfers while operating in Russia.

Meanwhile, Korea Sinjin Trading Corporation acted as a conduit between the scam operatives and North Korea’s Ministry of People’s Armed Forces General Political Bureau.

Treasury officials say Sinjin was a key beneficiary of the crypto funds and helped manage coordination between IT fraud workers and Pyongyang’s military elite.

Chinyong at the center of the North Korea crypto scheme

The Chinyong Information Technology Cooperation Company sits at the heart of the North Korea crypto scheme.

Already blacklisted in May 2023, Chinyong has long been accused of managing thousands of North Korean IT operatives working overseas under false identities.

“Chinyong operates as a shadow employer, placing North Korean workers in Western firms and siphoning salaries and stolen digital assets back to Pyongyang,” said blockchain investigator ZachXBT, who has tracked North Korean wallet movements across exchanges.

Billions lost in the North Korea crypto scheme

The scale of the North Korea crypto scheme is staggering. A United Nations Security Council report concluded that Pyongyang-linked groups drained more than $3.6 billion in cryptocurrency between 2017 and 2024.

These funds, officials say, have gone directly into advancing weapons of mass destruction (WMDs).

Despite successive rounds of sanctions, the schemes have grown more sophisticated. From phishing scams to fake blockchain startups, North Korea’s operatives deploy complex social engineering tactics to infiltrate the global crypto industry.

The sanctions are part of a broader campaign to dismantle the North Korea crypto scheme. Just last month, Treasury targeted Song Kum Hyok, a hacker tied to the Reconnaissance General Bureau and its notorious Andariel unit, for helping operatives use stolen U.S. identities to secure remote tech jobs.

“These sanctions highlight how North Korea continues to weaponize the digital economy for its nuclear ambitions,” noted Erin Platts, CEO of Silicon Valley Bank UK, in a recent panel on financial security.

No signs of slowing down or retreating

Even with mounting international pressure, experts say Pyongyang shows no signs of retreating. Independent research suggests hundreds of North Korean IT operatives are currently working in disguise across major crypto hubs.

“The reality is clear: the North Korea crypto scheme is not a one-off operation, but a long-term state strategy,” warned cybersecurity analyst Nick Carlsen, a former FBI specialist on North Korean illicit finance.

The latest U.S. Treasury designations shine a spotlight on the scale and resilience of the North Korea crypto scheme.

With billions already stolen and rerouted into weapons development, Washington and its allies are racing to choke off the pipelines.

Yet as Pyongyang adapts and innovates, experts fear the battle over the blockchain may just be beginning.