North Korean hackers steal over $3 billion in cryptocurrencies, US sanctions bankers and tech companies

The U.S. Treasury Department on Tuesday sanctioned eight individuals and two entities involved in North Korean cybercrime activities. The move targets a flow of cryptocurrencies stolen by North Korean hackers and laundered through overseas networks.

In the past three years, North Korea-linked cybercriminals have stolen more than $3 billion, much of it in virtual currency, according to the Treasury Department. They used sophisticated malware, social engineering, and ransomware to attack banks, exchanges, and other digital platforms.

The US Treasury said the money would help finance North Korea’s nuclear weapons and missile programs.

“North Korea’s state-sponsored hackers are stealing and laundering funds to fund the regime’s nuclear weapons program,” said John K. Hawley, Under Secretary of the Treasury for Terrorism and Financial Intelligence.

Bankers Jang Guk-cheol and Heo Jeong-seon were sanctioned. They helped manage more than $5.3 million in cryptocurrencies and income from overseas North Korean IT workers related to ransomware attacks.

IT company Korea Mangyongdae Computer Technology Corporation was also sanctioned. The company runs a delegation of IT workers in China and uses local proxies to hide the source of its funding. Its chairman, Woo Yong-soo, was similarly nominated, according to an announcement from the Ministry of Finance.

Pyongyang-based Yujong Credit Bank was sanctioned for supporting money laundering between North Korea and China. Five representatives of North Korean banks in China and Russia were also targeted for allegedly transferring millions of dollars, renminbi and euros through global financial networks.

Last year, the FBI issued a warning that North Korean hackers were targeting U.S. crypto exchange traded funds (ETFs) to steal digital assets.

The attack used sophisticated social engineering, including detailed research on employees in the cryptocurrency and DeFi sectors, personalized scams, fake job offers, and malware deployment.

North Korea’s exploitation

According to a statement from the Ministry of Finance, North Korea also exploits IT workers overseas. They use false identities and contracts to hide their nationality. Some work with non-North Korean freelancers and divert project profits to Pyongyang.

The Treasury Department said the sanctions block all property and interests of the specified individuals and entities under U.S. jurisdiction. Americans are prohibited from doing business with them. Financial institutions that violate the rules may be subject to enforcement measures.

Experts point out that North Korea’s crypto asset management is extremely sophisticated. The country uses a combination of cybercrime, sanctions evasion, and foreign IT workers to fund its weapons program.

Tuesday’s actions highlighted the growing role of cryptocurrencies in North Korea’s illicit finance. The United States aims to cut off North Korea’s access to digital assets while warning the global financial system not to support these networks.