US Treasury Sanctions North Korea Crypto Network

Government building with shield emblem, globe connected by network lines, and a document stamped with "Sanctions" in red.

US Treasury Sanctions Alleged North Korea IT Fraud Facilitators – 21 Crypto Addresses Added to OFAC List

Key Takeaways

The US Treasury sanctioned six individuals and two entities for alleged involvement in a North Korea-linked IT worker fraud scheme.
The Office of Foreign Assets Control added 21 cryptocurrency addresses across Ethereum and Tron to its sanctions list.
Authorities allege the network generated revenue to support North Korea’s weapons program.
The scheme targeted multiple industries, including blockchain companies, and used stolen identities and fabricated personas.

US Treasury Targets Alleged Facilitators of North Korea IT Worker Network

The US Department of the Treasury has imposed sanctions on six individuals and two entities accused of facilitating an IT worker fraud scheme linked to North Korea. The measures were announced by the Office of Foreign Assets Control, which oversees US sanctions enforcement.

According to the Treasury, the sanctioned network operated across North Korea, Vietnam, Laos and Spain. Authorities allege that the scheme generated revenue for North Korea’s weapons program.

The sanctions freeze any US-based assets connected to the named individuals and entities. They also prohibit US persons and businesses from engaging in financial transactions or other dealings with them. Violations can result in civil and criminal penalties.

Named Entities and Individuals

Among the sanctioned entities is Amnokgang Technology Development Company, described as a North Korean firm accused of managing overseas IT workers. The Treasury also sanctioned Nguyen Quang Viet, identified as the CEO of Quangvietdnbg International Services Company Limited, a Vietnam-based company.

Authorities allege that Nguyen Quang Viet’s company laundered 2.5 million US dollars through cryptocurrency on behalf of the network. In addition, five individuals were designated for their alleged roles in the IT worker operations: Do Phi Khanh, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang and York Louis Celestino Herrera.

All listed persons and entities are now subject to US sanctions restrictions, including asset freezes and transaction bans involving US jurisdictions.

21 Cryptocurrency Addresses Added Across Ethereum and Tron

As part of the enforcement action, OFAC included 21 cryptocurrency addresses in its sanctions designation. The addresses span the Ethereum and Tron blockchains.

Blockchain analytics firm Chainalysis stated that the inclusion of addresses on multiple networks reflects what it described as North Korea’s increasingly multi-chain approach to moving funds. By designating specific wallet addresses, authorities aim to limit the ability of sanctioned actors to transact in digital assets through compliant platforms and intermediaries.

For cryptocurrency exchanges, payment processors and other digital asset businesses, the addition of wallet addresses to the sanctions list requires updated compliance screening. Businesses operating internationally, including those serving crypto betting and iGaming platforms, must ensure that they do not process transactions linked to sanctioned addresses.

Fraudulent IT Worker Schemes Target Blockchain Companies

The Treasury action follows reports that fraudulent IT workers with alleged ties to North Korea have targeted a wide range of industries. Blockchain companies have been among the affected sectors.

An April 2025 report by Google found that the infrastructure supporting these schemes had spread worldwide. According to Chainalysis, the operations rely on stolen identities and fabricated personas to obtain employment with legitimate companies.

Beyond receiving salaries under false pretenses, some workers have allegedly introduced malware into company networks. Chainalysis stated that this tactic has been used to extract proprietary and sensitive information. The firm described the IT worker schemes as a sophisticated and growing threat.

For companies handling cryptocurrency transactions, including exchanges and service providers connected to online gambling platforms, such tactics raise operational and compliance risks. Screening counterparties against updated OFAC sanctions lists and monitoring for unusual payment patterns form part of standard risk management procedures when new designations are issued.

Compliance Implications for Crypto and iGaming Businesses

The addition of individuals, entities and wallet addresses to the OFAC sanctions list has direct consequences for businesses that interact with US financial systems or serve US customers. Any assets within US jurisdiction linked to the sanctioned parties are blocked.

Crypto businesses must ensure that they do not facilitate transactions involving the 21 listed addresses on Ethereum and Tron. Failure to comply with sanctions requirements can expose companies to enforcement action.

For international users of crypto betting and iGaming platforms, sanctions actions can affect the availability of certain payment routes or counterparties if platforms adjust their compliance controls. Operators typically respond by updating internal blacklists, transaction monitoring systems and onboarding procedures.

Our Assessment

The US Treasury’s sanctions designate six individuals, two entities and 21 cryptocurrency addresses connected to an alleged North Korea-linked IT worker fraud network. The measures freeze US-based assets and prohibit transactions with US persons. The case highlights how authorities are targeting both individuals and blockchain wallet addresses in response to schemes that have affected multiple industries, including blockchain companies.