Fraud Network Generated Nearly $800M in 2024 for Weapons Programs
The U.S. Treasury Department has sanctioned a sprawling international network that enabled North Korea to generate substantial revenue through fraudulent IT worker schemes. According to the Office of Foreign Assets Control (OFAC), these operations funneled nearly $800 million in 2024 alone to support North Korea’s illicit weapons of mass destruction (WMD) and ballistic missile programs. The sanctions freeze all U.S. assets connected to the designated parties and prohibit any transactions with them.
The crackdown targets the sophisticated methods used by North Korean operatives, who rely on stolen identities and falsified credentials to secure remote employment with companies worldwide, including in the blockchain industry. Once hired, these workers divert their wages back to the North Korean regime, directly violating U.S. and United Nations sanctions.
Vietnamese CEO Laundered $2.5M Through Crypto
OFAC’s action designated six individuals and two companies central to the operation. The sanctioned entities include Amnokgang Technology Development Company, a North Korean firm responsible for managing the overseas IT workforce, and Quangvietdnbg International Services Company Limited, a Vietnam-based company. Its CEO, Nguyen Quang Viet, was sanctioned for allegedly converting approximately $2.5 million into cryptocurrency for the network between mid-2023 and mid-2025. In connection with these activities, OFAC blacklisted 21 cryptocurrency addresses on the Ethereum and Tron networks.
This enforcement highlights the global reach of the fraud ring, with facilitators and operatives identified in Vietnam, Laos, and Spain. The schemes represent a persistent threat, as these workers have also been known to covertly introduce malware into corporate networks to steal sensitive information.
Sanctions Expose Growing Multi-Chain Threat
Blockchain analysis firm Chainalysis noted that the designation of addresses across multiple blockchains reflects North Korea's increasingly multi-chain approach to moving illicit funds. The group warned that these IT worker schemes are a sophisticated and growing threat to businesses globally, reinforcing the need for stringent compliance and counterparty screening.
Cryptocurrency businesses should screen all counterparties against updated OFAC sanctions lists, be alert to patterns consistent with IT worker fraud, and monitor for unusual payment patterns.
— Chainalysis
