Crypto moved to the center of Washington’s latest sanctions action on North Korea on March 12, after the US Office of Foreign Assets Control designated six people and two agencies involved in the North Korea-linked IT staffing scheme. For the digital asset industry, the significance was not just the sanctions themselves, but how clearly the case presented cryptocurrency as an infrastructure for moving illicit proceeds across borders.
OFAC Targets North Korea’s Crypto Network
According to the Treasury Department, the targeting schemes routinely defrauded US businesses and generated nearly $800 million in 2024 for North Korea’s weapons programs. Secretary Scott Bessent described a model in which overseas officers used fake identities and corporate fraud to infiltrate legitimate companies and then turn sensitive access into a second layer of leverage. “U.S. Companies Targeted Through Deceptive Schemes.” “Treasury will follow the money.”
This framing is important because this case is not just presented as a typical cybercrime story. Treasury and Chainalysis both pointed to a mixed book: hiring scams, salary mining, financial facilitators, and cryptographic rails used to convert and transfer income. Chainalysis called the operations a “sophisticated and growing threat.” It added, equally directly, that “cryptocurrency plays a central role” in transferring these funds to North Korea while evading sanctions.
The specific details of the crypto in action concern Nguyen Quang Viet, CEO of Quangvietdnbg International Services Company Limited in Vietnam. The Treasury said Nguyen converted about $2.5 million into cryptocurrency for North Korea between mid-2023 and mid-2025, including illicit proceeds related to Amnokgang Technology Development, a North Korean IT company that operates foreign worker delegations. The Treasury also said OFAC’s designation in this case reached facilitators in the DPRK, Vietnam, Laos and Spain, underscoring how geographically dispersed these support networks are.
Chainalysis said the March 12 operation involved 21 targeted addresses across multiple blockchains. These addresses include Ethereum, Tron, and Bitcoin, with seven associated with Amnokgang, two Ethereum addresses for Yoon Song Guk, one Bitcoin address for Hoang Min Kwang, and 11 newly added addresses for Sim Hyun-sop, a previously appointed representative, representative of Korea Kwangson Banking Corp.
Treasury’s briefing also showed how the IT workforce pipeline extends beyond software contracts to broader financial opportunities. It said Yoon led a group of freelance North Korean IT workers operating in the Laotian city of Boten since at least 2023 and coordinated dozens of transactions worth more than $70,000 with Hoang Min Quang related to IT services. In a separate section, the Treasury said Do Phi Hanh and Hoang Van Nguyen supported Kim Se Un, including through bank account access and crypto transactions, while Hoang also helped buy foreign currency for the regime.
This action takes place in a broader context where North Korea’s crypto footprint is getting bigger, not smaller. In its 2026 Crypto Crime Report, Chainalysis said that North Korea stole more than $2 billion in 2025, its most successful year on record, while the value of acquisitions by sanctioned entities increased by a total of 694% last year. In this context, OFAC’s order looks less like an isolated enforcement step and more like another attempt to clamp down on every layer of the DPRK’s cryptography, from stolen funds and laundering routes to labor schemes that generate new revenue.
At press time, the total crypto market cap was $2.44 trillion.
Featured image created with DALL.E, chart from TradingView.com
Editing process because bitcoinist is committed to delivering thoroughly researched, accurate and unbiased content. We adhere to strict sourcing standards and every page is rigorously reviewed by a team of top technology experts and experienced editors. This process ensures the integrity, relevance and value of our content to our readers.
