US Treasury Sanctions DPRK Bankers and Front Companies Laundering Proceeds from Cybercrime and IT Worker Operations

The US Department of the Treasury today announced sanctions targeting key figures and institutions within North Korea’s global financial network for their role in laundering funds derived from illicit schemes, including cybercrime and IT worker fraud. These activities directly finance the regime’s weapons of mass destruction and ballistic missile programs. The designations, issued by the Office of Foreign Assets Control (OFAC), focus on representatives of sanctioned North Korean financial institutions operating abroad, as well as a North Korea-based IT company managing IT worker delegations and a domestic financial institution facilitating sanctions evasion between China and North Korea.

Among the newly designated individuals are Jang Kuk Chol (Jang) and Ho Jong Son — North Korean bankers who, according to Treasury, helped manage funds, including approximately USD 5.3 million in cryptocurrency, on behalf of the OFAC-designated First Credit Bank (Cheil Credit Bank). 

A portion of these funds has been linked to a DPRK ransomware actor known to have targeted US victims and laundered proceeds from North Korean IT worker operations. Treasury also added 53 cryptocurrency addresses to the SDN listing for Cheil Credit Bank, which was first designated in September 2017.

In addition, OFAC designated foreign-based representatives of DPRK financial institutions, including senior employees of the previously sanctioned Koryo Commercial Bank, Ryugyong Commercial Bank, Foreign Trade Bank, and the Central Bank of the DPRK. Collectively, these representatives have facilitated the transfer of millions of dollars in foreign currency — including USD, CNY, and euros — to support North Korea’s illicit financial activities. The action also includes the Ryujong Credit Bank, used for remittance and money laundering, and the Korea Mangyongdae Computer Technology Company, which operates IT worker delegations abroad.

Together, these individuals and entities form a central component of Pyongyang’s sanctions-evasion architecture, enabling the regime to move millions of dollars through both traditional and digital channels, including cryptocurrency, to fund weapons programs and cyber operations.

According to TRM Labs’ on-chain analysis, the cryptocurrency addresses designated by OFAC today collectively hold a balance exceeding USD 5.4 million. Most of these funds appear to be USDT frozen during a large-scale blocklisting operation by Tether in late April and early May 2025. TRM analysis shows that 26 of the 53 addresses on the new SDN list had already been blocked prior to the announcement.

The addresses linked to Cheil Bank show consistent inbound flows resembling salary payments. With OFAC also updating the designation of the Korea Computer Center, a key entity tied to overseas North Korean IT operations, these flows likely represent income from IT workers employed abroad under false identities. Between June 2023 and May 2025, the Cheil-controlled wallets collectively received more than USD 12.7 million, reflecting sustained activity over a two-year span.

Many of these same addresses appeared in the Multilateral Sanctions Monitoring Team (MSMT) report — a US-led coalition replacing the UN Panel of Experts on North Korea after its 2025 dissolution by Russian veto. The MSMT has traced how Cheil Bank and other DPRK-linked entities facilitate payroll, payments, and laundering mechanisms across North Korea’s global sanctions-evasion network.

Over the past three years, Treasury reports that North Korea has stolen over USD 3 billion, primarily in cryptocurrency, through sophisticated cyberattacks. According to TRM Labs, hackers have stolen USD 2.7 billion in 2025 alone, driven largely by North Korea’s record-setting USD 1.5 billion Bybit hack in February. Funds from these operations are laundered through layers of intermediaries — OTC brokers, FX dealers, and nested service providers — before being converted to fiat and returned to DPRK-controlled accounts.

Treasury emphasized that these actions reflect an ongoing international effort to isolate the DPRK’s financial apparatus. The newly sanctioned individuals and entities represent key nodes in Pyongyang’s financial lifeline, responsible for moving millions of dollars annually in violation of UN Security Council resolutions to fund nuclear and missile programs.

This action, building on prior designations under Executive Orders 13382 and 13722, underscores Treasury’s continued collaboration with the Department of State and global partners to dismantle North Korea’s financial enablers and cut off its access to the global financial system.