U.S. Sanctions North Korean IT Workers Over ‘Cyber Espionage,’ Crypto Thefts
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) recently added North Korean national Song Kum Hyok to its sanctions list, designating him a “Specially Designated Nationals” (SDN). This action aims to block Song from the global financial system due to his alleged role as a malicious cyber actor linked to a North Korean hacking group. OFAC’s announcement highlights Song’s involvement in placing other North Korean officials within various companies under the guise of IT workers. These individuals subsequently funnel funds back to North Korea and exploit their employers for additional revenue.
The cryptocurrency industry has been significantly impacted by such schemes, experiencing numerous large-scale thefts orchestrated by North Korean hackers. The Treasury Department statement explicitly notes the DPRK’s significant revenue generation through the deployment of these IT workers, who infiltrate companies worldwide, including those in the technology and virtual currency sectors. While the announcement references past crypto hacks attributed to North Korean activities, it refrains from naming specific projects or listing affected crypto wallets.
However, the OFAC action builds upon previous sanctions against the Lazarus Group, a notorious entity linked to several high-profile crypto heists, including the $625 million Axie Infinity hack and the $1.5 billion Bybit breach. The Treasury Department emphasizes that North Korean IT workers often manage funds received for contract work through virtual currency exchanges and trading platforms, utilizing these platforms for laundering and remitting funds to North Korea.
Ari Redbord, global head of policy and government affairs at TRM Labs, explains that these embedded IT workers serve as crucial on-ramps for illicit revenue generation and subsequent intrusion activities, especially within the crypto space. He highlights the significance of the Treasury Department’s explicit mention of North Korean IT workers operating from China and Russia, indicating a growing alignment between the DPRK and these jurisdictions. This action aligns with a broader pattern of recent Treasury Department initiatives targeting North Korea’s exploitation of IT workers to channel illicit proceeds back to Pyongyang, often laundered through crypto exchanges and anonymized platforms. Redbord emphasizes that Song’s designation targets the operational layer—the enabler, not just the hacker—underlining the importance of disrupting these networks.
