The U.S. Department of the Treasury’s Office of Foreign Assets Control has sanctioned six individuals and two entities linked to North Korea’s global IT worker revenue schemes. According to Treasury, these operations generated nearly $800 million in revenue in 2024, helping fund the DPRK’s weapons and ballistic missile programs.

These schemes rely on North Korean developers obtaining remote technology jobs using fraudulent identities. Payments received from employers are then routed through facilitators and financial intermediaries before being transferred back to the regime.

In one case highlighted by Treasury, a facilitator reportedly converted approximately $2.5 million into cryptocurrency between mid-2023 and mid-2025, demonstrating the role of digital assets in the movement of funds linked to the network.

Entities Involved in the Designation

The sanctions action targets facilitators that helped manage and process financial flows generated by the scheme.

Amnokgang Technology Development Company (OFAC)
A DPRK-based technology firm responsible for managing delegations of overseas North Korean IT workers and supporting procurement activities linked to the regime.

Quangvietdnbg International Services Company Limited (OFAC)
A Vietnam-based company whose leadership reportedly provided financial services and currency conversion for North Korean nationals, including converting proceeds from IT worker operations into cryptocurrency.

The designation also includes individuals connected to the network, including Sim Hyon Sop, Yun Song Guk, and Hoang Minh Quang, who were linked to financial facilitation and cryptocurrency activity tied to the scheme.

Blockchain Addresses Listed in the OFAC Designation

As part of the sanctions package, OFAC added or updated 21 blockchain addresses across Ethereum, TRON, and Bitcoin networks.

These addresses include 7 linked to Amnokgang Technology Development Company, 2 linked to Yun Song Guk, 1 Bitcoin address linked to Hoang Minh Quang, and 11 additional addresses associated with Sim Hyon Sop.

These blockchain identifiers are now considered blocked property under U.S. sanctions regulations.

Scorechain Analysis of the Designated Wallets

Scorechain analyzed the blockchain activity associated with the sanctioned addresses to better understand the financial footprint of the network.

Our analysis identified 21 flagged wallet addresses across three blockchain networks, 2,583 transactions within the extracted dataset, and a combined balance of approximately $292,425.31. Activity linked to these addresses spans from September 2022 to January 2026.

A significant portion of the funds currently sits in the address:

0x9be599d7867f5e1a2d7ec6db9710df2b98a15573

This address alone holds approximately $201,828.02, representing the largest balance among the wallets included in the designation.

Exposure to Crypto Services

Transaction analysis also shows exposure paths between the designated wallets and a number of labeled cryptocurrency services, including Binance, OKX, Coinbase, MEXC, KuCoin, Bybit, Bitget, ChangeNOW, Noones, Aerowap, Zondacrypto, and Paxos. These interactions illustrate how DPRK-linked financial activity can intersect with widely used digital asset infrastructure.

In the case of Amnokgang Technology Development Company, several associated addresses were active before funds were frozen by stablecoin issuers Circle and Tether.

Compliance Lessons from the Case

This case highlights an important operational pattern. While the assigned risk is now classified as high due to the sanctions designation, historical transaction activity showed more mixed exposure patterns.

In practice, this means sanctions exposure may first appear through indirect interactions, service connections, or historical counterparties before a direct sanctions hit becomes visible.

For compliance teams, this reinforces several operational priorities: screening alone is not sufficient, historical tracing remains critical, cross-chain visibility is essential, and indirect exposure review plays an important role in identifying risk.

Implications for Compliance Teams

For banks, exchanges, VASPs, and compliance teams, this case serves as another reminder that DPRK-linked networks continue to rely on legitimate-looking infrastructure and multi-jurisdiction facilitators to move value.

Treasury also noted that foreign financial institutions may face sanctions exposure if they knowingly facilitate significant transactions for designated persons.

Monitoring Exposure with Scorechain

Scorechain has integrated the newly designated addresses and entities into its monitoring environment.

Compliance teams using Scorechain can review exposure, analyze counterparties, and investigate historical interactions connected to the sanctioned wallets and entities.

Organizations handling digital asset transactions should ensure that monitoring systems account for both direct and indirect exposure to sanctioned infrastructure.

To review potential exposure or investigate historical interactions related to this OFAC action, contact the Scorechain team.

‍

‍