DOJ Targets Digital Assets Allegedly Earned Through Fake Identities and Laundering Tactics

The U.S. Department of Justice (DOJ) has filed a civil forfeiture complaint to seize approximately $7.74 million in cryptocurrencies and NFTs allegedly connected to a North Korean money laundering scheme, according to a statement released on June 5.

The DOJ claims the assets were earned by North Korean IT workers who posed as freelancers using fake identities to gain remote employment at blockchain-related firms, allowing them to funnel illicit income back to Pyongyang in violation of U.S. sanctions.

Crypto and NFTs Targeted in Seizure

The funds — initially frozen in April 2023 — are the subject of a civil action filed in Washington, D.C. federal court. The DOJ’s filing names multiple cryptocurrencies, including Bitcoin (BTC), Tether (USDT), USD Coin (USDC), and various non-fungible tokens (NFTs), along with Ethereum Name Service (ENS) domains.

These assets were reportedly spread across self-custody wallets and accounts on centralized exchanges such as Binance.

“The Department will use every legal tool at its disposal to safeguard the cryptocurrency ecosystem and deny North Korea its ill-gotten gains in violation of U.S. sanctions,” said Matthew Galeotti, head of the DOJ’s criminal division.

Coordinated Laundering via Stablecoins, NFTs, and Chain Hopping

According to the DOJ, the IT workers were paid in stablecoins such as USDC and USDT, and subsequently engaged in laundering techniques including:

• Chain hopping: rapidly moving assets across different blockchains to obscure origin

• Token swaps into NFTs to avoid tracking

• Multiple wallet transfers across platforms and custodians

The proceeds were then allegedly funneled to the North Korean government via intermediaries, including Sim Hyon Sop, a China-based banker indicted in 2023, and Kim Sang Man, a North Korean citizen sanctioned by the Office of Foreign Assets Control (OFAC) for laundering offenses.

Widespread Infiltration of the Crypto Industry

This case is the latest in a growing body of evidence that North Korea is systematically targeting the cryptocurrency sector to raise funds for its sanctioned state programs, including weapons development.

According to a joint advisory issued in 2022 by the DOJ, Department of State, and the Treasury Department, North Korean nationals have increasingly sought employment in freelance tech roles, especially in crypto, under false pretenses.

The advisory warned companies of red flags including:

• Repeated IP address changes

• Use of VPNs or proxies to hide geolocation

• Inconsistent employment or identification documents

ZachXBT: North Korean Devs Earning $500K per Month

In a 2023 investigation, blockchain analyst ZachXBT revealed a network of North Korean developers embedded within established Web3 projects, earning as much as $500,000 monthly. These developers reportedly posed as global freelancers, concealing their true identities through extensive obfuscation techniques.

“This isn’t just isolated cybercrime,” ZachXBT said. “It’s a coordinated operation with clear ties to the North Korean regime.”

Global Expansion of North Korean Cyber Operations

A report published in April by Google’s Threat Intelligence Group detailed how North Korea has shifted its focus from targeting U.S.-based firms to crypto companies in Europe and Asia, responding to heightened scrutiny by U.S. regulators.

The report concluded that North Korean actors are now actively pursuing employment and technical roles within DeFi protocols, token issuers, and NFT platforms across the globe, posing a significant risk to financial security and compliance frameworks.

Legal Background and Future Implications

The current civil forfeiture complaint builds on a 2023 criminal case involving Sim Hyon Sop, who was indicted for banking violations and sanctions evasion. The DOJ alleges that Sim acted as a financial facilitator for the IT workers, converting their crypto into fiat and routing funds through Chinese bank accounts and shell companies.

Should the court approve the DOJ’s seizure request, it will represent one of the largest U.S. crypto forfeitures tied to nation-state cybercrime — and a warning to firms that sanctions compliance failures can carry major legal consequences.

Conclusion

The U.S. government’s effort to seize $7.7 million in crypto and NFTs underscores a rising concern over North Korea’s abuse of the cryptocurrency ecosystem to circumvent sanctions and fund state operations. As digital assets become more integrated into global finance, regulators and investigators are stepping up efforts to trace, freeze, and reclaim illicit funds.

With North Korea continuing to exploit crypto networks for illicit purposes, companies in the Web3 space face growing pressure to implement robust identity checks, monitor suspicious behavior, and cooperate with authorities — or risk becoming part of an international money laundering pipeline.