Treasury Cracks Down on North Korea’s Sanctions Evasion by Laundering Cryptocurrencies

The US Treasury Department’s Office of Foreign Assets Control (OFAC) has sanctioned two individuals and an entity involved in a network that laundered millions of dollars in illicit funds for North Korea.

Lu Huaying and Zhang Jian, based in the United Arab Emirates (UAE), used a UAE-based shell company to facilitate money laundering and cryptocurrency conversion, funneling the proceeds back to Pyongyang.

OFAC imposes penalties

In its official press release on December 17, OFAC stated that North Korea continues to rely on agents and intermediaries to access the global financial system for illicit activities. The agency added that these operations are part of the country’s broader efforts to destabilize international security, which are now spreading to Europe with increased military ties to Russia.

Sim Hyon Sop, a representative of the DPRK’s Korea Kwangson Banking Corp (KKBC), based in the People’s Republic of China (PRC), is said to be a key figure in these activities. Operating as an agent for North Korean financial institutions, Sim is accused of orchestrating money laundering schemes, setting up shell companies and managing bank accounts to move illicit funds. OFAC previously designated Sim and KKBC under Executive Order 13382, which targets entities that support WMD proliferation. Sim’s operations primarily involve digital assets to return money to North Korea’s missile programs.

Since 2022, Huaying has allegedly been involved in laundering millions of dollars of illicit funds derived from DPRK activities through the conversion of cryptocurrency into fiat currency. Between 2022 and September 2023, the defendant used various methods, including money mules, to facilitate these transactions. Meanwhile, Jian also helped facilitate the exchange of fiat currency and acted as a courier for Sim.

OFAC is designating both Huaying and Zhang Jian, along with Green Alpine Trading, LLC, a UAE-based shell company involved in the network, for their roles in supporting Sim’s illicit activities .

Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence Bradley T. Smith stated:

“As the DPRK continues to use complex criminal schemes to fund its WMD and ballistic missile programs, including through the exploitation of digital assets, Treasury remains focused on disrupting the networks that facilitate this flow of funds to the regime. The United States, along with the UAE and the rest of our partners, will continue to target the financial networks that enable the Kim regime’s destabilizing activities.”

North Korean hackers launch massive crypto attack

North Korea’s involvement in cybercrime has wreaked significant havoc on the crypto industry, as evidenced by a series of high-profile hacks and exploits. In August, ZachXBT reported that North Korean developers infiltrated more than 25 crypto projects using fake identities, stealing $1.3 million using malicious code.

In October, it was reported that North Korean hackers linked to the Lazarus Group used a fake NFT game that exploited a zero-day flaw in Chrome to steal wallet credentials. The game, promoted through social engineering tactics, included malware that collected sensitive data. Despite a fix from Google, attackers had already executed large-scale crypto thefts.

Then in November, South Korean police confirmed that North Korean hacking groups Lazarus and Andariel orchestrated the 2019 crypto Upbit, stealing $50 million in ETH. Collaboration with the FBI and Swiss prosecutors uncovered key evidence, including North Korean IP addresses and virtual asset flow patterns. The stolen funds were laundered through multiple platforms.

Most recently, Radiant Capital confirmed that a hacking group linked to North Korea carried out a $50 million hack of its DeFi platform in October 2024. The attackers used a Telegram-based malware scheme to exploit a developer, which led to the installation of a macOS backdoor.

SPECIAL OFFER (Sponsored) Binance Free $600 (Exclusive to CryptoPotato): Use this link to register a new account and receive an exclusive welcome offer of $600 to Binance (full details).

LIMITED OFFER for CryptoPotato readers on Bybit – Use this link to register and open a FREE $500 position with any currency!