The US Treasury has sanctioned two people and four entities involved in what it says was a North Korea-run IT worker ring that would infiltrate crypto companies, aiming to exploit them.

The Treasury’s Office of Foreign Assets Control (OFAC) said on Tuesday that it sanctioned the North Korea-based Song Kum Hyok for allegedly stealing US citizens’ information to use as aliases and giving it to hired foreign IT workers who would seek employment at US companies.

OFAC also sanctioned the Russian national Gayk Asatryan for allegedly using his companies to employ dozens of North Korean IT workers under long-term agreements he signed with North Korean trading firms starting in 2024.

A growing number of fraudulent tech workers with ties to North Korea, officially the Democratic People’s Republic of Korea (DPRK), have been expanding their infiltration operations, with an April report from Google finding that the infrastructure for the schemes has spread worldwide.

“Treasury remains committed to using all available tools to disrupt the Kim regime’s efforts to circumvent sanctions through its digital asset theft, attempted impersonation of Americans, and malicious cyber-attacks,” said Treasury Deputy Secretary Michael Faulkender.

Thousands of IT workers target wealthier countries to fund missile program

OFAC said North Korea aims to generate revenue for its ballistic missile programs by deploying a thousands-strong workforce of highly skilled IT workers all over the world, the bulk of which are located in China and Russia.

The workforce mainly targets employers located in wealthier countries and uses various mainstream and industry-specific networking platforms, OFAC said.

The sanctions mean all US assets connected to Asatryan, Song, and the four Russian entities also named are frozen. It’s also now illegal for people in the US to conduct any financial transactions or have business dealings with them under the threat of civil and criminal penalties.

North Korea shifting away from hacks

North Korea has been notorious for its high-profile hacks through teams such as the Lazarus Group, and is responsible for some of the largest crypto hacks ever recorded, such as the $1.5 billion Bybit exploit in February.

However, blockchain intelligence firm TRM Labs said on Tuesday that they are starting to shift tactics. 

“While exchange breaches remain significant, DPRK-linked operations are increasingly shifting toward deception-based revenue generation, including IT worker infiltration,” the firm said.

TRM Labs estimates North Korea-aligned bad actors are responsible for $1.6 billion of the $2.1 billion stolen across 75 crypto hacks and exploits in the first half of 2025.

US cracks down on North Korean IT workers

US authorities have been increasingly cracking down on fraudulent North Korean IT worker schemes this year.

Related: North Korea targets crypto workers with new info-stealing malware

On June 30, four North Korean nationals were charged with wire fraud and money laundering after posing as remote workers at US and Serbian blockchain companies.

Meanwhile, on June 5, the US Department of Justice said it was trying to seize $7.74 million in frozen crypto allegedly earned by North Korean IT workers using fake identities and working at blockchain firms as remote contractors.  

Magazine: North Korea crypto hackers tap ChatGPT, Malaysia road money siphoned: Asia Express

]]> https://earlybirdsinvest.com/us-sanctions-north-korean-tech-worker-crew-over-crypto-thefts/feed/ 0 46570 https://earlybirdsinvest.com/crypto-thefts-soar-to-2-billion-in-2025-breaking-records-and-trust-report/ https://earlybirdsinvest.com/crypto-thefts-soar-to-2-billion-in-2025-breaking-records-and-trust-report/#respond Wed, 02 Jul 2025 19:38:36 +0000 https://earlybirdsinvest.com/crypto-thefts-soar-to-2-billion-in-2025-breaking-records-and-trust-report/

Trusted Editorial content, reviewed by leading industry experts and seasoned editors. Ad Disclosure

Crypto theft has hit a record in the first half of 2025. Over $2.1 billion vanished in at least 75 hacks and exploits. That total tops the previous H1 high set in 2022 by about 10% and almost matches every dollar stolen in all of 2024.

Major Theft Figures Revealed

According to a TRM Labs report, hackers walked off with roughly $2.1 billion between January and June. They struck 75 separate times. That breaches the H1 2022 mark by about 10% and nearly equals the full‑year haul from 2024. Losses hit over $100 million in January, April, May and June. Those months show this threat isn’t limited to a one‑off event.

Bybit Breach Overshadows All

The largest single loss was the $1.5 billion February breach at Dubai‑based Bybit exchange. That attack alone accounted for nearly 70% of losses this year. It set the average size of hacks to nearly $30 million, twice the $15 million H1 2024 average. Even excluding Bybit, heists in excess of $100 million continue to occur.

Crypto thieves have ramped up their illicit activity in 2025. Source: TRM Labs.

State Actors Driving Theft

According to analyses, North Korea‑linked groups are behind about $1.6 billion of all stolen funds so far. That’s roughly 70% of the total. Experts say these thefts feed into the country’s sanction‑evasion schemes and weapons programs.

At the same time, June 18 saw a roughly $90 million hack of Iran’s largest exchange, Nobitex. Security firms link that attack to Predatory Sparrow, a group said to work for Israel. They moved money into addresses with no private keys, hinting at a symbolic motive.

Attack Methods And Security Steps

Reports show infrastructure hacks—like private‑key thefts, insider jobs and front‑end hits—accounted for over 80% of stolen funds in H1. Those breaches tend to be about 10 times larger than attacks on smart contracts.

Protocol exploits, such as flash‑loan and re‑entrancy bugs, made up another 12%. Smart contracts still carry risk, but they get patched faster than hidden back‑door or insider schemes.

Industry experts say the rise in state‑backed thefts calls for stronger measures. Cold storage should be the norm. Multi‑factor authentication must cover all critical accounts. Frequent audits are a must. Beyond those basics, teams need insider‑threat programs and social‑engineering training.

Global law enforcement, financial intelligence units and blockchain‑forensics firms like TRM Labs need to work closer than ever. Sharing alerts fast and tracing funds across borders can clamp down on these giant thefts. It’s a tall order, but as crypto grows more tied to national security, so does the need for a united defense.

Featured image from Unsplash, chart from TradingView

Editorial Process for bitcoinist is centered on delivering thoroughly researched, accurate, and unbiased content. We uphold strict sourcing standards, and each page undergoes diligent review by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance, and value of our content for our readers.