The US Treasury has penalized two individuals and four organizations purportedly connected to what it describes as a North Korea-operated IT worker network infiltrating cryptocurrency firms with the intent to exploit them.
On Tuesday, the Treasury’s Office of Foreign Assets Control (OFAC) announced that it had sanctioned Song Kum Hyok, based in North Korea, for allegedly acquiring US citizens’ data to be utilized as false identities and providing it to contracted foreign IT professionals seeking jobs at US firms.
Additionally, OFAC targeted Russian national Gayk Asatryan, accusing him of employing numerous North Korean IT professionals through long-term contracts with North Korean trading firms beginning in 2024.
An increasing number of deceptive tech professionals with affiliations to North Korea, officially known as the Democratic People’s Republic of Korea (DPRK), have been intensifying their infiltration efforts, with a report from Google in April indicating that the infrastructure for these operations has proliferated globally.
“The Treasury remains dedicated to employing all available measures to thwart the Kim regime’s attempts to bypass sanctions via digital asset theft, impersonation of Americans, and harmful cyberattacks,” remarked Treasury Deputy Secretary Michael Faulkender.
Thousands of IT professionals target affluent nations to finance missile initiatives
OFAC stated that North Korea seeks to generate funds for its ballistic missile programs by deploying a workforce of thousands of highly skilled IT professionals globally, primarily situated in China and Russia.
This workforce predominantly aims at employers in wealthier nations, utilizing a range of mainstream and sector-specific networking platforms, according to OFAC.
The sanctions result in the freezing of all US assets related to Asatryan, Song, and the four mentioned Russian entities. Furthermore, it is now unlawful for individuals in the US to engage in any financial operations or dealings with them under the threat of civil and criminal repercussions.
North Korea pivoting from hacks
North Korea has gained notoriety for its prominent hacks executed by teams like the Lazarus Group, and is accountable for some of the largest recorded cryptocurrency hacks, including the $1.5 billion Bybit breach in February.
However, blockchain intelligence firm TRM Labs indicated on Tuesday that they are beginning to alter their strategies.
“While breaches of exchanges remain substantial, DPRK-linked operations are increasingly shifting towards revenue generation through deception, including IT worker infiltration,” the firm noted.
TRM Labs estimates that North Korea-aligned malicious actors are accountable for $1.6 billion of the $2.1 billion pilfered across 75 cryptocurrency hacks and exploits in the first half of 2025.
US intensifies measures against North Korean IT professionals
US authorities have increasingly intensified actions against deceptive North Korean IT worker schemes this year.
Related: North Korea targets cryptocurrency workers with novel data-stealing malware
On June 30, four North Korean nationals were indicted for wire fraud and money laundering after masquerading as remote employees at US and Serbian blockchain companies.
Additionally, on June 5, the US Department of Justice announced it was seeking to confiscate $7.74 million in frozen cryptocurrency purportedly acquired by North Korean IT workers via fictitious identities while working at blockchain firms as remote contractors.
Magazine: North Korea crypto hackers utilize ChatGPT, Malaysia road funds diverted: Asia Express
