U.S. Treasury sanctions North Korean IT worker scheme that funneled millions through crypto

The U.S. Treasury sanctioned individuals and entities supporting a North Korean IT worker fraud operation that uses stolen identities to place developers in remote tech jobs, funneling hundreds of millions of dollars back to Pyongyang through cryptocurrency transactions and international banking channels.

The operation, exposed through OFAC sanctions, represents a major revenue stream for North Korea’s weapons program—one that exploits freelance platforms and poses cybersecurity risks to global companies unknowingly hiring North Korean operatives with access to sensitive corporate systems.

Officials say the DPRK IT worker fraud network allowed North Korean developers to collect salaries from unsuspecting firms, funneling the income back to the government in Pyongyang. According to U.S. authorities, these schemes have become a key financial lifeline for the isolated regime.

Crypto Used to Obscure Illicit Funds

The Treasury said the DPRK IT worker fraud network relied heavily on cryptocurrency to disguise the origin of funds and move proceeds across borders.

Investigators believe facilitators in the operation converted digital assets into fiat currency or used crypto transfers to obscure transaction trails before sending funds to accounts linked to the North Korean government.

According to the Treasury Department, this financial activity forms part of a broader strategy by the DPRK IT worker fraud network to bypass international sanctions imposed on North Korea.

“The DPRK continues to deploy IT workers globally to generate revenue for the regime,” the Treasury said in its announcement, warning that these activities are closely tied to efforts to finance weapons development.

The sanctions freeze any assets belonging to the individuals or organizations involved that fall under U.S. jurisdiction and prohibit American citizens and companies from conducting transactions with them.

Remote Tech Jobs at the Center of the Scheme

Authorities say the DPRK IT worker fraud network operates by placing North Korean developers in remote roles through global freelancing platforms and tech contracting marketplaces.

Using stolen personal data and falsified professional profiles, operatives pose as software engineers, blockchain developers, or freelance programmers.

Once hired, members of the DPRK IT worker fraud network reportedly receive payment through international banking channels or cryptocurrency transfers, allowing them to bypass restrictions placed on North Korean businesses.

According to U.S. officials, the wages generated by this system often flow directly to the North Korean state.

The United Nations Panel of Experts on North Korea has previously estimated that overseas workers connected to Pyongyang generate hundreds of millions of dollars each year, much of which is believed to support government programs.

Analysts say the DPRK IT worker fraud network represents an evolution of those labor export schemes, shifting from physical labor to digital services that are easier to conceal.

Cybersecurity Risks for Global Companies

Beyond financial fraud, the DPRK IT worker fraud network also presents serious cybersecurity threats to companies that unknowingly hire these developers.

U.S. investigators say some operatives have used their access to corporate systems to deploy malware or extract sensitive information from company networks.

In certain cases, individuals linked to the DPRK IT worker fraud network reportedly gained privileged access to internal software infrastructure, potentially exposing businesses to intellectual property theft and data breaches.

Cybersecurity experts say the growing sophistication of these operations makes them difficult to detect.

“This is not just a sanctions evasion problem—it’s also a corporate security issue,” said Michael Barnhart, a principal threat intelligence analyst at cybersecurity firm Mandiant, who has studied North Korean cyber operations.

Barnhart noted that organizations must improve hiring verification processes to prevent infiltration by members of the DPRK IT worker fraud network.

Crypto Laundering and Sanctions Evasion

North Korea has increasingly turned to digital assets to evade financial restrictions imposed by the United States and its allies.

Blockchain analysis firms have documented multiple cases in which North Korean-linked actors used cryptocurrency to launder stolen funds or move illicit earnings across borders.

Officials say the DPRK IT worker fraud network represents another way the regime exploits crypto technology to maintain access to international financial systems.

“The DPRK continues to adapt its illicit finance strategies,” said Brian Nelson, the U.S. Treasury’s Under Secretary for Terrorism and Financial Intelligence.

Nelson warned that the DPRK IT worker fraud network forms part of a broader pattern in which North Korea leverages cybercrime, cryptocurrency theft, and online fraud to fund government activities.

Growing Global Concern

The crackdown on the DPRK IT worker fraud network comes as governments worldwide increase scrutiny of North Korea’s cyber-enabled revenue streams.

In recent years, authorities in the United States, South Korea, and Europe have linked North Korean hackers to major cryptocurrency thefts targeting blockchain platforms and decentralized finance projects.

The Federal Bureau of Investigation (FBI) has also warned that companies hiring remote developers should conduct thorough background checks to avoid unknowingly employing individuals connected to the DPRK IT worker fraud network.

Industry experts say the issue highlights the intersection between cybersecurity, cryptocurrency regulation, and international sanctions enforcement.

A Broader Effort to Cut Off Funding

For Washington, targeting the DPRK IT worker fraud network is part of a wider campaign to block financial channels that North Korea uses to fund its nuclear weapons and ballistic missile programs.

By sanctioning individuals and facilitators connected to the operation, the Treasury hopes to disrupt the financial infrastructure supporting the DPRK IT worker fraud network.

Officials say they will continue monitoring global freelance marketplaces, crypto transactions, and cybercrime activity linked to North Korea.

As cryptocurrency adoption expands worldwide, authorities warn that schemes like the DPRK IT worker fraud network may become increasingly sophisticated—posing ongoing risks to businesses, financial institutions, and the global digital asset ecosystem.