Treasury Cracks Down on North Korea Sanctions Evasion Through Cryptocurrency Laundering

The United States Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned two individuals and one entity involved in a network laundering millions of dollars in illicit funds for North Korea.

Lu Huaying and Zhang Jian, based in the United Arab Emirates (UAE), used a UAE-based front company to facilitate money laundering and cryptocurrency conversion, funneling the profits back to Pyongyang.

OFAC imposes sanctions

in his official Press release On December 17, OFAC stated that North Korea continues to rely on agents and proxies to access the global financial system for illicit activities. The agency added that these operations are part of the country's broader efforts to destabilize international security, which now extend to Europe with growing military ties with Russia.

Sim Hyon Sop, a representative of the DPRK's Korea Kwangson Banking Corporation (KKBC), based in the People's Republic of China (PRC), is said to be a key figure in these activities. Sim, who operates as an agent for North Korean financial institutions, is accused of orchestrating money laundering schemes, establishing shell companies and managing bank accounts to move illicit funds. OFAC previously designated Sim and KKBC under Executive Order 13382, targeting entities that support the proliferation of weapons of mass destruction. Sim's operations primarily involve digital assets to funnel money into North Korea's missile programs.

Since 2022, Huaying has allegedly been involved in laundering millions of dollars of illicit funds derived from DPRK activities by converting cryptocurrencies into fiat currency. Between 2022 and September 2023, the defendants used various methods, including money mules, to facilitate these transactions. Meanwhile, Jian also helped facilitate the exchange of fiat currency and acted as a courier for Sim.

OFAC is naming Huaying and Zhang Jian, along with Green Alpine Trading, LLC, a United Arab Emirates-based front company involved in the ring, for their role in supporting Sim's illicit activities.

Acting Undersecretary of the Treasury for Terrorism and Financial Intelligence, Bradley T. Smith, stated:

“As the DPRK continues to use complex criminal schemes to finance its weapons of mass destruction and ballistic missile programs, including through the exploitation of digital assets, the Treasury remains focused on disrupting the networks that facilitate this flow of funds to the regime. “The United States, along with the United Arab Emirates and our other partners, will continue to target the financial networks that enable the Kim regime's destabilizing activities.”

North Korean hackers execute wide-ranging crypto heist

North Korea's involvement in cybercrime has wreaked significant havoc on the crypto industry, as evidenced by a series of high-profile attacks and exploits. In August, ZachXBT reported that North Korean developers infiltrated more than 25 crypto projects using fake identities, stealing $1.3 million through malicious code.

In October, reports emerged that North Korean hackers linked to the Lazarus Group used a fake nft game that exploited a Chrome zero-day flaw to steal wallet credentials. The game, promoted through social engineering tactics, included malware that collected sensitive data. Despite a fix from Google, attackers had already executed large-scale cryptocurrency thefts.

Then in November, South Korean police confirmed that North Korean hacker groups Lazarus and Andariel orchestrated the 2019 Upbit crypto heist, stealing $50 million worth of eth. Collaboration with the FBI and Swiss prosecutors uncovered key evidence, including North Korean IP addresses and virtual asset flow patterns. The stolen funds were laundered through multiple platforms.

More recently, Radiant Capital confirmed that a hacking group linked to North Korea carried out a $50 million hack on its DeFi platform in October 2024. The attackers used a Telegram-based malware scheme to exploit a developer , which led to the installation of a backdoor for macOS.

<!– ai CONTENT END 1 –>