US Treasury Sanctions Alleged $800 Million North Korean IT Worker Fraud Operation

The U.S. Treasury Department on Thursday imposed sanctions on six individuals and two entities linked to a North Korean government scheme that allegedly used fraudulent IT employees to infiltrate U.S. companies and funnel hundreds of millions of dollars into Pyongyang’s weapons programs.

The plan raised nearly $800 million in 2024 alone, according to the Treasury Department’s Office of Foreign Assets Control (OFAC), which announced the move as part of a broader crackdown on North Korea’s overseas revenue networks.

“The North Korean regime is targeting American companies through deceptive schemes by foreign IT operatives, who weaponize sensitive data and extort companies for substantial payments,” Treasury Secretary Scott Bessent said in a statement. “Under President Trump’s leadership, the Treasury Department will continue to track the money to protect American companies from this malign activity and ensure those responsible are held accountable.”

North Korean IT workers typically use stolen identities, false personas and forged documents to secure remote work at U.S. and allied companies, the Treasury Department said. The regime then siphons off most of their wages to finance its nuclear and ballistic missile programs, in violation of United Nations and United States sanctions. In some cases, employees have also planted malware in corporate networks to steal proprietary data.

The individuals sanctioned Thursday operated in multiple countries, including Vietnam, Laos and Spain. Among those designated was a Vietnamese businessman who allegedly converted about $2.5 million in cryptocurrency for North Korean agents between 2023 and 2025.

Two others were sanctioned for helping a previously designated North Korean nuclear procurement facilitator to launder money and open bank accounts. A North Korean national was also targeted for leading a group of IT workers operating out of Boten, Laos.

All U.S. assets of the designated individuals and entities are now frozen and U.S. persons are prohibited from doing business with them. The Treasury Department noted that foreign financial institutions risk secondary sanctions if they knowingly facilitate transactions on behalf of designated parties.

According to law enforcement and crypto intelligence agencies, North Korean state-sponsored hackers are among the biggest adversaries in the crypto space. In 2025, North Korean hackers stole more than $2 billion worth of cryptocurrency in several attacks, according to Chainalysis, including a record revenue of almost $1.5 billion from crypto exchange Bybit.