U.S. Sanctions North Korea’s Crypto Network Funding Nuclear Programs

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned eight individuals and two entities tied to North Korea’s crypto network that allegedly laundered over $3 billion via cryptocurrency and IT worker funds to fund its nuclear and missile programs.

“North Korean state-sponsored hackers steal and launder money to fund the regime’s nuclear weapons program,” said  John K. Hurley, the Secretary of the Treasury for Terrorism and Financial Intelligence 

Today, Treasury’s Office of Foreign Assets Control took decisive sanctions action against North Korean cybercrime and IT worker fraud that the regime uses to fund its weapons of mass destruction and ballistic missile programs. Over the past three years, North Korea-affiliated…

— Treasury Department (@USTreasury) November 4, 2025

The U.S. Treasury said the state-sponsored actors directly threaten U.S. and global security, promising Washington will continue pursuing facilitators behind these schemes to cut off the DPRK’s illicit revenue streams.

U.S Sanctions Designated North Korean Bankers

Jang Kuk Chol and Ho Jong Son are two North Korean bankers accused of helping manage laundered funds, including $5.3 million in cryptocurrency, on behalf of OFAC-designated First Credit Bank.

According to intelligence findings, a portion of the funds could be linked to a DPRK ransomware actor that previously targeted U.S. victims and handled revenue from DPRK IT workers.

OFAC sanctioned Jang and Ho Jong Son for aiding North Korea’s crypto laundering and hacking operations, which fall under actions banned by E.O. 13694.

 Signed in 2015, E.O. 13694 allows the U.S. government to impose sanctions on individuals or entities responsible for malicious cyber activities that threaten U.S. national security, foreign policy, or the economy.

The U.S. also designated them pursuant to E.O. 13810, which allows sanctions on anyone generating revenue for the North Korean government or its ruling party.

The combined effect freezes their assets, cuts off access to the global financial system, and signals international partners to block dealings with them.

China And Russia Entities Also Targeted

The U.S. Treasury also sanctioned Ryujong Credit Bank under Executive Order 13810 for operating within North Korea’s financial services sector. 

The action targets five North Korean representatives based in China and Russia, accused of facilitating millions in illicit transactions for Pyongyang-linked banks.

Ho Yong Chol was accused of facilitating the transfer of over $2.5 million in U.S. dollars and Chinese yuan for U.S.-designated Korea Daesong Bank and managed an additional $85 million in transactions for a North Korean government entity. 

Today, OFAC designated several North Korean individuals and entities involved in laundering cybercrime proceeds and IT worker funds, including Korea Mangyongdae Computer Technology Corporation and 54 digital currency addresses linked to North Korean bank, Cheil Credit Bank, which…

— Chainalysis (@chainalysis) November 4, 2025

Han Hong Gil, an employee of the sanctioned Koryo Commercial Bank, coordinated more than $630,000 in cross-border transfers for Ryugyong Commercial Bank.

Jong Sung Hyok, chief representative of the DPRK Foreign Trade Bank in Vladivostok, Russia, and Choe Chun Pom, a representative of the DPRK Central Bank, were also implicated. 

Choe reportedly facilitated over $200,000 in transfers and arranged visits for Russian officials to Pyongyang. Ri Jin Hyok, another Foreign Trade Bank representative, managed over $350,000 in transactions through a front company.

Illicit North Korea Crypto Network Launders $3B

This follows similar sanctions involving a United Arab Emirates-based entity accused of laundering millions generated by IT workers and cybercrimes on behalf of the North Korean government.

Over the past three years, North Korea-affiliated cybercriminals have stolen over $3 billion, primarily in cryptocurrency, using advanced techniques such as sophisticated malware and social engineering.

1/ Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed.

Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities.

I then uncovered 25+ crypto projects with… pic.twitter.com/W7SgY97Rd8

— ZachXBT (@zachxbt) August 15, 2024

DPRK IT workers earn hundreds of millions annually by engaging in IT development work, using false or stolen identities when seeking employment contracts and creating accounts on freelance work websites.

In some instances, they partner with foreign freelance programmers, collaborating on projects originally commissioned to those workers and splitting the revenue.