DOJ Seizes $7.74M in Crypto from North Korean Hackers Laundering Millions Using Fake IDs and NFTs to Fund Regime Operations Worldwide

EddieJayonCrypto

 8 Jun 25

tl;dr

The U.S. Department of Justice filed a civil forfeiture claim for $7.74 million linked to North Korean IT workers who fraudulently gained employment at U.S. and international crypto companies to launder money for the North Korean regime. These workers used fake identities and operated globally, laun...

The U.S. Department of Justice has filed a $7.74 million crypto forfeiture claim against North Korean IT workers who used fraudulent identities to launder money for the regime, circumventing sanctions through remote employment at cryptocurrency firms.

These operatives employed a range of sophisticated laundering techniques, including fake IDs, multiple small transfers, token conversions, purchasing NFTs, and mixing funds. Their activities funnel assets through officials tied to North Korea’s Ministry of Defense, notably linking to an indicted Foreign Trade Bank representative.

FBI investigations have uncovered a vast scheme where North Korean workers defraud U.S. businesses by using stolen American identities, generating revenue for Pyongyang’s authoritarian government. Experts warn that these illicit operations are rapidly expanding, evolving into a persistent revenue stream intertwined with espionage and cybercrime.

Embedded deeply within global organizations and critical infrastructure, often through front companies or less scrutinized third parties, these workers operate worldwide in locations such as China, Russia, and Laos. Payment typically occurs via stablecoins like USDC and Tether.

Annual revenues from this fraudulent IT work may reach hundreds of millions of dollars, with much of the activity effectively obscured to avoid detection and attribution. Advanced technologies, including generative AI and deepfakes, are used to create convincing fake personas and pass technical screenings, complicating efforts by authorities to identify these actors.

The threat extends internationally, with North Korean operatives infiltrating cryptocurrency projects across Europe— such as those in the UK, Germany, Portugal, and Serbia— assisted by accomplices who help bypass identity verification and facilitate global payments.

The DOJ and FBI continue their investigations, emphasizing that North Korea has exploited global remote IT contracting and crypto ecosystems for years to evade sanctions and fund its weapons programs. This evolving, industrialized cyber threat now demands heightened vigilance and adaptive countermeasures from governments and businesses worldwide.