US Treasury Sanctions North Korean IT Fraud Network Facilitators, Crypto Industry Becomes Key Target

On March 13, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions against six individuals and two entities for allegedly assisting North Korea’s IT personnel in a scam operation. Investigations show that this network has targeted multiple industries, including blockchain companies, and its funds are believed to support North Korea’s weapons programs.

According to the U.S. Treasury, the sanctioned entities include North Korea’s Amnokgang Technology Development Company, responsible for managing IT personnel sent abroad. Also sanctioned are Vietnam’s Quangvietdnbg International Services Company Limited and its director Nguyen Quang Viet. The investigation states that the company transferred approximately $2.5 million through cryptocurrency channels for the network.

Additionally, Do Phi Khanh, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, and York Louis Celestino Herrera are also sanctioned for their involvement in this transnational IT personnel network. Under the regulations, all assets of these individuals and entities within the U.S. will be frozen, and they are prohibited from conducting any financial transactions with U.S. persons or entities, with potential civil or criminal penalties for violations.

Security agencies note that the scam involving North Korea-linked technical personnel has been expanding in recent years, with activities spanning North Korea, Vietnam, Laos, and Spain. A 2025 report from Google revealed that these networks have established complex infrastructure worldwide, forging identities to gain employment at tech companies and deploying malicious software within internal networks to steal data.

Blockchain analysis firm Chainalysis states that these “fake IT employee” scams are becoming a major security threat to the crypto industry. Some of these technicians not only work remotely to receive salaries but may also implant malware into corporate systems to steal trade secrets and sensitive information.

OFAC’s sanctions also include 21 cryptocurrency addresses on the Ethereum and TRON networks. Chainalysis points out that the simultaneous sanctions across multiple blockchain addresses indicate that North Korean-related funds are expanding across multi-chain structures. Industry experts warn that crypto companies should strengthen counterparty vetting and closely monitor unusual payment patterns to reduce potential security risks.