US Imposes Sanctions on North Korean Cyber Actors

TLDR

• Sanctions target North Korean IT workers and associated companies.
• Approximately $7.7 million in cryptocurrency seized linked to schemes.
• Third major sanction against North Korean cyber activities in 2025.

The U.S. Department of Treasury and the Department of Justice (DOJ) have jointly announced new sanctions against North Korean individuals and entities involved in cyber activities. This action targets North Korean IT workers employed internationally, allegedly to support the Kim regime financially. The sanctions are a response to a larger scheme where North Korean nationals used stolen identities to secure employment in foreign companies, especially in the blockchain and crypto sectors.

Among those named is Song Kum Hyok, linked to the Andariel hacking group, a subset of the North Korean-backed Lazarus Group. Song is accused of helping North Korean nationals secure remote jobs by providing them with fake identities, including U.S. Social Security numbers. These individuals reportedly generated revenue for the regime through fraudulent salaries and other means. Additionally, Russian national Gayk Asatryan, along with his Russia-based companies, was involved in facilitating these schemes by employing North Korean IT workers.

Sanctioned Companies and Individuals

The sanctions also target four companies, including Songkwang Trading and Saenal Trading, known for dispatching North Korean workers to Russian firms. The U.S. government alleges these businesses have been operating under agreements with North Korean trading companies since 2024. Michael Faulkender, Deputy Secretary of the Treasury, emphasized the importance of remaining vigilant against North Korea’s clandestine funding mechanisms.

“Today’s action underscores the importance of vigilance on the DPRK’s continued efforts to clandestinely fund its WMD and ballistic missile programs,” Faulkender commented. The Treasury aims to use all available measures to disrupt North Korea’s attempts to circumvent sanctions via digital asset theft and cyber-attacks. Read the full Treasury Department Press Release here.

Impact on Cryptocurrency Assets

The DOJ has reported the seizure of approximately $7.7 million in cryptocurrency assets linked to the North Korean IT worker scheme. While the specific cryptocurrencies involved in the latest seizure remain undisclosed, past actions have involved major assets like Bitcoin (BTC) and Ethereum (ETH). Historically, these assets have been commonly used in illicit transactions associated with North Korean schemes.

However, no specific tokens or DeFi protocols were directly mentioned in the latest Treasury announcement. This raises questions about potential exposure and necessitates caution among crypto exchanges and entities involved with digital assets. The frequent targeting of primary cryptocurrencies underscores ongoing vulnerabilities in the sector.

Regulatory Response and Measures

This recent Treasury action marks the third significant sanction related to North Korean cyber schemes in 2025. The coordinated efforts reflect the U.S. government’s ongoing commitment to curtail North Korean exploitation of digital assets for funding weapon and missile programs. Earlier sanctions have typically led to increased compliance measures and stricter Know Your Customer (KYC) protocols in the crypto industry.

Such measures are supported by Ari Redbord, Global Head of Policy at TRM Labs. He noted, “The embedded IT workers have served as on-ramps to both illicit revenue generation and intrusion activity, particularly in the crypto space.” As cryptocurrencies remain a vital part of international finance, incidents like these highlight the importance of robust regulatory frameworks and cybersecurity protocols.

For more information on the government’s actions, you can read the State Department’s press release here.