On March 12, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced sanctions against six individuals and two entities involved in a North Korea-led IT worker fraud network. The announcement stated that these participants systematically defrauded U.S. companies to fund weapons of mass destruction programs, with nearly $800 million involved in 2024 alone.
https://home.treasury.gov/news/press-releases/sb0416
Details of the Sanctions
According to the U.S. OFAC, the North Korean-controlled IT team took employment in legitimate companies in the U.S. and other countries by using forged documents, identity theft, and fictitious identities to conceal their true identities. The North Korean government seized the vast majority of these overseas IT workers' salaries, obtaining hundreds of millions of dollars to support its weapons of mass destruction and ballistic missile programs. In some cases, North Korean affiliates also secretly implanted malware in corporate networks to steal proprietary sensitive information.
This sanction includes six individuals (Nguyen Quang Viet, Do Pyong Kyong, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, York Louis Celestino Herrera), identified as providing substantial assistance to North Korean IT workers for cryptocurrency exchanges, money laundering, bank account openings, and IT business connections; and two companies (Amnokgang, Quangvietdnbg), recognized as key operators and facilitators of the IT worker fraud network.
Analysis of Sanctioned Addresses
This sanction has identified 21 cryptocurrency addresses. According to OFAC, from mid-2023 to mid-2025, Quangvietdnbg's CEO Nguyen Quang Viet exchanged approximately $2.5 million worth of cryptocurrency for North Korea, noting that cryptocurrency is an important channel for North Korean IT workers to transfer funds and evade sanctions.
Using the on-chain anti-money laundering analysis platform BeosinKYT and tracking investigation tool BeosinTrace, the analysis of the 21 addresses in the sanction list yielded the following results:
YUN, Song Guk (North Korean, leader of IT workers in Laos)
ETH:
0xb637f84b66876ebf609c2a4208905f9ddac9d075
0x95584C303FCd48AF5c6B9873015f2AD0ca84EaE3
According to Beosin Trace, approximately 200,851 USDT previously flowed out to various centralized exchanges.
HOANG, Minh Quang (collaborated to complete IT service transactions worth over $70,000)
BTC: bc1qyy5pt5cx3zth8xlj92lq5y87dh8xv3nwgs4ncq
Previously, there was an inflow of 0.57462 BTC to a Coinbase account.
SIM, Hyon Sop (representative of North Korea's Kwangsan Bank in China, with 11 new addresses)
Previously frozen address (ETH network):
0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c
This address has a liquid amount of 21,937,732.52 USDT and 2,071,126.59 USDC, with 58,148.62 USDT still held in this address.
New sanction addresses (ETH network):
0xd04E33461FEA8302c5E1e13895b60cEe8AEfda7F
0x76EA76CA4Eb727f18956aB93445a94c5280412B9
0xFb3eFf152ea55D1BfA04Dbdd509A80fD7b72cdEB
0xFda1Ec4A6178d4916b001a065422D31EBE5F62FF
0x747AFB5c7A7fc34B547cD0FDEbf9b91759C5a52b
The fund flow chart is as follows:
Approximately 98,139.11 USDT, 21,300 USDC, and 0.51268 ETH flowed out.
New TRX:
TPDLpXxPcaSsupEZ3yrVksmNkYP5SLeKxu
TGXE9dGWawjfd3xqFSho1h1bRbRv9wUGrF
TNTFhgFoKH4srBMiWbfrVFqP2AThSmdwf1
TXhf9nU9bjo1j9z5qEesHdr6gtdndfnA4T
TK17wfSPp32RWrnzZPrGpv7TxdNFvvvE2s
TYeQD2VddTZ9NkFkAnT9DD8cUGetGUQZB2
Approximately 6,236.74 TRX and 999,014.46 USDT flowed out.
Cross-chain at the same address:
ARB: 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c
BSC: 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c
Approximately 1,133,025.26 USDT, 935,943.84 BUSD, and 17,811.05 USDC flowed out to various centralized exchanges.
AMNOKGANG TECHNOLOGY DEVELOPMENT COMPANY
ETH:
0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D
0x0330070FD38Ec3bB94F58FA55D40368271E9e54A
0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573
Approximately 205.02 ETH, 274,531.15 USDT, and 228,496.97 USDC were involved, with 96.05 ETH remaining in 0x9be599d7867f5e1a2d7ec6db9710df2b98a15573.
Tron Network
TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7
TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP
TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP
TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft
Approximately 2,744.75 TRX and 4,941,817.62 USDT flowed out to various centralized exchanges.
Beosin Anti-Money Laundering Recommendations
This action is another measure by the U.S. Department of the Treasury to combat North Korea's use of cryptocurrency to evade sanctions. For the virtual asset industry, how to conduct anti-money laundering compliance screening and identify addresses involving high-risk funds has become a key capability for virtual asset service providers (VASP).
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
