In recent developments, the emphasis on combatting North Korea’s illicit financial operations has become increasingly pronounced, particularly focusing on their involvement in cryptocurrency transactions linked to cybercrime. These efforts come amidst heightened concerns about the regime’s nuclear ambitions.

Challenges in Tracking Cyber Crime

On a pivotal day this week, the US Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions on multiple individuals and organizations accused of contributing to money laundering activities associated with digital currencies and cybercriminal endeavors.

Reports indicate that certain North Korean banks have been instrumental in managing substantial sums, such as approximately $5.3 million (around 7.63 billion Korean won) in cryptocurrency, channeled through the “First Credit Bank.” This highlights their sophisticated operations beyond traditional banking methods.

Alarmingly, some of these funds appear to have been utilized in assaults directed at US interests, with potential links to ransomware gangs profiting from work misrepresented by North Korean IT professionals operating abroad.

Among the entities sanctioned is the Chosun Mangyongdae Computer Technology Company (KMCTC), a notable player in dispatching IT teams to locations like Dandong and Shenyang in China. This indicates a complex web of technology and finance working in concert to evade sanctions.

An official from the Treasury highlighted that North Korea’s cyber operations are unique, engaging in unprecedented levels of espionage and financial misconduct. This includes a range of activities from stealing intellectual property to sabotaging critical infrastructures.

The Role of IT Workers

In a significant report by blockchain intelligence firm TRM Labs, it was revealed that certain accounts associated with Cheil Bank showcase patterns that mimic regular salary payments. Following updates to the designation of the Korea Computer Center, this suggests that these financial flows could be incomes derived from IT personnel employed under dubious circumstances.

From June 2023 to May 2025, there were substantial financial activities in wallets managed by Cheil, totaling over $12.7 million, underscoring the continuous operation over a prolonged timeframe.

Moreover, these transactions have been linked to findings from the Multilateral Sanctions Monitoring Team (MSMT), a US-led coalition focusing on North Korea, succeeding the former UN Panel of Experts. This group has cataloged the ways in which Cheil Bank and similar entities are involved in salary disbursement, payment processing, and laundering within the wider context of sanctions evasion.

In the last three years alone, North Korea has reportedly amassed over $3 billion (approximately 4.32 trillion Korean won) through cryptocurrencies, utilizing increasingly sophisticated technologies such as advanced malware for cyber theft.

The year 2025 marked a particularly notable period, with cybercriminals allegedly securing $2.7 billion in illicit gains, buoyed by significant hacks like the $1.5 billion breach of the Bybit cryptocurrency exchange that took place in February.

These proceeds are typically laundered through multiple intermediaries, including over-the-counter (OTC) brokers and foreign exchange dealers, eventually being converted into fiat currencies and redirected to accounts controlled by the North Korean regime.

The individuals and entities newly sanctioned are viewed as essential components of North Korea’s intricate financial apparatus, facilitating the transfer of millions of dollars each year in violation of international resolutions aimed at curtailing its nuclear and missile development programs.

Featured image sourced from DALL-E; chart imagery courtesy of TradingView.com.