Crypto In Focus As OFAC Targets North Korean IT Worker Network

Crypto moved to the center of Washington’s latest North Korea sanctions action on March 12, after the US Treasury’s Office of Foreign Assets Control designated six individuals and two entities tied to DPRK-run IT worker schemes. For the digital asset industry, the significance was not only the sanctions themselves, but how explicitly the case framed cryptocurrency as infrastructure for moving illicit revenue across borders.

OFAC Targets North Korean Crypto Network

According to Treasury, the targeted schemes systematically defrauded US businesses and generated nearly $800 million in 2024 for North Korea’s weapons programs. Secretary Scott Bessent described a model in which overseas operatives used fake identities and corporate deception to infiltrate legitimate companies, then turned sensitive access into a second layer of leverage. “Targets American companies through deceptive schemes.” “Treasury will continue to follow the money.”

That framing matters because the case was not presented as a conventional cybercrime story alone. Treasury and Chainalysis both pointed to a blended playbook: fraudulent hiring, wage extraction, financial facilitators, and crypto rails used to convert and move proceeds. Chainalysis called the operations “a sophisticated and growing threat.” It added, in equally direct terms, that “cryptocurrency plays a central role” in moving those funds back to North Korea while evading sanctions.

The clearest crypto-specific detail in the action concerned Nguyen Quang Viet, CEO of Vietnam-based Quangvietdnbg International Services Company Limited. Treasury said Nguyen converted about $2.5 million into cryptocurrency for North Koreans between mid-2023 and mid-2025, including illicit earnings tied to Amnokgang Technology Development Company, a DPRK IT company that manages overseas worker delegations. Treasury also said OFAC’s designations in this case reached facilitators in the DPRK, Vietnam, Laos and Spain, underscoring how geographically dispersed these support networks have become.

Chainalysis said the March 12 action included 21 designated addresses across multiple blockchains. Those addresses spanned Ethereum, Tron and Bitcoin, with seven linked to Amnokgang, two Ethereum addresses tied to Yun Song Guk, one Bitcoin address tied to Hoang Minh Quang, and 11 newly added addresses for previously designated Sim Hyon Sop, a representative of Korea Kwangson Banking Corp.

Treasury’s narrative also showed how the IT-worker pipeline extends beyond software contracting into broader financial enablement. It said Yun had led a group of North Korean freelance IT workers operating out of Boten, Laos since at least 2023 and coordinated several dozen transactions totaling more than $70,000 with Hoang Minh Quang tied to IT services. In a separate strand, Treasury said Do Phi Khanh and Hoang Van Nguyen supported Kim Se Un, including through bank-account access and crypto transactions, while Hoang had also helped procure foreign currency for the regime.

The action lands against a broader backdrop in which North Korea’s crypto footprint has been getting bigger, not smaller. Chainalysis said in its 2026 crypto crime report that North Korea stole more than $2 billion in 2025, its most successful year on record, while value received by sanctioned entities overall surged 694% last year. In that context, the OFAC designations look less like an isolated enforcement step and more like another attempt to squeeze every layer of the DPRK crypto stack, from stolen funds and laundering routes to the labor schemes that generate fresh inflows.

At press time, the total crypto market cap stood at $2.44 trillion.

Featured image created with DALL.E, chart from TradingView.com