U.S. Imposes Sanctions on North Korean Bankers and Firms Over Crypto Laundering Tied to Weapons Funding

The United States has announced new sanctions targeting North Korean bankers and financial institutions accused of channeling illicit cryptocurrency funds into Pyongyang's weapons programs.

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) designated eight individuals and two entities allegedly involved in "laundering funds derived from cybercrime and IT worker fraud." According to U.S. officials, the network funneled proceeds from ransomware and cryptocurrency theft to support North Korea's military operations.

Among those sanctioned are two bankers accused of handling at least $5.3 million in cryptocurrency through the already blacklisted First Credit Bank. The sanctioned firms, Ryujong Credit Bank and Korea Mangyongdae Computer Technology Company (KMCTC), are alleged to have used shell companies and intermediaries in third countries to obscure the movement of funds, reportedly relying on Chinese and Russian proxies to evade detection.

"North Korean state-sponsored hackers steal and launder money to fund the regime's nuclear weapons program," said Under Secretary of the Treasury for Terrorism and Financial Intelligence John K. Hurley. He added that such activities "directly threaten U.S. and global security," emphasizing Washington's continued efforts to "cut off the DPRK's illicit revenue streams."

KMCTC, based in Pyongyang, operates IT delegations in China's Shenyang and Dandong. The Treasury alleged that its leadership employed Chinese nationals as banking proxies to mask income from North Korean IT workers abroad.

The sanctions freeze any U.S.-linked assets belonging to the named individuals and entities and bar American persons from engaging in transactions with them.

In a related move, the U.S. Department of Justice recently seized $7.7 million in cryptocurrency connected to North Korean IT workers accused of using stolen American identities to secure remote jobs. The workers reportedly operated from several countries, including China, Russia, and Laos, using VPNs and U.S.-based hardware to disguise their locations.

According to the Justice Department, these operations generated millions in illicit earnings, some of which were allegedly funneled back to North Korea's weapons development programs. Security researchers have also linked North Korean hackers to schemes involving fake U.S.-registered companies and fraudulent job offers designed to compromise cryptocurrency developers through malware-laden files.