The Office of Foreign Assets Control (OFAC) has imposed sanctions on a crypto network connected to an overseas IT worker operation linked to North Korea. The action was announced on March 12, 2026, by the United States Department of the Treasury as part of efforts to disrupt financial networks that violate international sanctions.
Authorities say the operation generated nearly $800 million in revenue during 2024. Investigators explained that the funds came from North Korean IT workers who secretly worked for companies around the world while using stolen identities and fabricated credentials. These workers reportedly secured remote jobs with technology firms and other legitimate businesses.
According to officials, the workers performed real technical tasks such as software development and other digital services. However, most of the money they earned did not remain with them. Authorities say the North Korean government collected the majority of the wages generated by workers stationed abroad.
Officials stated that the revenue from these activities helped support government programs tied to missile development and weapons systems. Such activities violate sanctions imposed by the United States and the international community.
The case highlights how cryptocurrency and digital asset transfers can be used to move money across borders in ways that are harder for traditional financial systems to detect.
Crypto exchange Binance sues Wall Street Journal after report on alleged Iran-linked transactions
Cryptocurrency Wallets Across Multiple Blockchains Identified
Investigators identified 21 cryptocurrency wallet addresses connected to the financial network behind the operation. These addresses were spread across several blockchain networks, including Bitcoin, Ethereum, and TRON.
Officials explained that the use of multiple blockchains helps obscure the movement of funds. Digital assets can move quickly between wallets and platforms, which makes it more difficult to track the origin and destination of transactions.
Authorities say a Vietnam-based facilitator, Nguyen Quang Viet, converted about $2.5 million into cryptocurrency between mid-2023 and mid-2025. Treasury data indicates the funds came from payments earned by North Korean IT workers.
Investigators also linked several crypto addresses to Amnokgang Technology Development Company, an entity that authorities say manages overseas IT worker delegations and procurement operations. Seven of the identified addresses tied to the organization were located on the Ethereum and Tron networks and reportedly received payments related to contract work and technical services.
Authorities also traced transactions connected to a Bitcoin wallet associated with Hoang Minh Quang. Treasury records show the wallet coordinated more than $70,000 in transactions with Yun Song Guk, who led a group of IT workers operating in Boten, Laos.
Iran crypto market sees 700% rise in withdrawals after strikes and stablecoin suspension
Investigators Trace Global Crypto Transfers Linked to Sanctioned Network
The Treasury also expanded earlier sanctions related to Korea Kwangson Banking Corp. Officials added 11 additional cryptocurrency addresses linked to a financial network connected to Sim Hyon Sop, who represents the bank in China.
Blockchain analytics company Chainalysis described the operation as a coordinated international network spanning several countries, including Vietnam, Laos, and Spain. According to the firm, the network relied on exchanges, hosted wallets, decentralized finance platforms, and cross-chain bridges to move funds globally.
These services allow digital assets to shift between different blockchain networks, which can make the trail of transactions more complex to track. Payments earned from overseas IT work were reportedly routed through multiple platforms before reaching wallets linked to the sanctioned network.
Chainalysis stated that its monitoring systems now flag transactions interacting with the listed addresses. This helps cryptocurrency companies identify suspicious activity more quickly and reduce the risk of interacting with sanctioned entities.
Authorities also warned companies about risks linked to remote hiring in the technology sector. Many of the workers reportedly secured jobs through online platforms and remote employment systems. Treasury guidance urges companies and crypto service providers to verify identities, screen counterparties, and monitor unusual payment patterns connected to overseas IT work.