The United States has escalated its crackdown on North Korea’s illicit crypto activities, issuing new sanctions against individuals and companies accused of funneling stolen digital assets into the country’s weapons program.
According to an Aug. 27 announcement from the U.S. Treasury Department, the sanctions target Russian national Vitaliy Sergeyevich Andreyev, North Korean trade official Kim Ung Sun, and two companies — Shenyang Geumpungri Network Technology Co., Ltd. in China and Korea Sinjin Trading Corporation.
Laundering crypto for North Korea’s weapons program
Officials allege that Andreyev acted as a money launderer for North Korean IT operatives, converting at least $600,000 worth of stolen crypto into U.S. dollars since late 2023. The funds were reportedly funneled to Chinyong Information Technology Cooperation Company, a North Korean entity already under U.S. sanctions for ties to the Ministry of Defense.
Kim Ung Sun is said to have worked alongside Andreyev, leveraging his diplomatic post in Russia to help conceal transactions and support Pyongyang’s financial operations.
Chinese firm embedded North Korean IT workers
Investigators revealed that Shenyang Geumpungri Network Technology Co. served as a front for North Korean IT workers, generating more than $1 million in profits for the regime. The company allegedly placed operatives inside foreign tech and crypto firms by using forged credentials and fake documents.
Meanwhile, Korea Sinjin Trading Corporation reportedly worked as a liaison between the operatives and the North Korean military, ensuring the profits flowed back to Pyongyang’s armed forces.
Chinyong’s central role in crypto fraud
The designations build on past actions against Chinyong, which the Treasury has repeatedly identified as a hub for North Korea’s overseas crypto scams. OFAC first sanctioned the firm in May 2023, citing its close alignment with the country’s military establishment.
North Korea’s reliance on cybercrime to fund weapons programs is well-document. A UN Security Council report estimated that Pyongyang-linked hackers siphoned off more than $3.6 billion in cryptocurrency between 2017 and 2024.
Broader fight against North Korea’s cyber networks
The latest measures follow a July action against Song Kum Hyok, a North Korean operative tied to the Reconnaissance General Bureau and hacking group Andariel, who allegedly helped other operatives obtain remote jobs using stolen U.S. identities.
Despite repeated sanctions, experts warn that hundreds of North Korean IT workers remain embedded across the global crypto and tech sectors, quietly funneling revenue back to the regime.
The Treasury reiterated its commitment to “disrupting the financial lifelines of North Korea’s weapons program,” but acknowledged that the regime continues to evolve its cyber tactics to evade restrictions.
