The network operates in North Korea, Vietnam, Laos, and Spain.
The two sanctioned entities are: Amukjiang Technology Development Company, a North Korean firm managing the deployment of overseas IT workers and procuring military technology, and Vietnam's Quang Viet International Services Company, which converts worker earnings into cryptocurrency.
Additionally, six individuals have been added to the sanctions list. Quang Viet's CEO, Nguyen Quang Viet, allegedly converted $2.5 million into cryptocurrency for the regime between 2023 and 2025. North Korean citizen Yun Song-guk has been operating an IT worker team in Boten, Laos, since 2023. Huang Wen-yuan assisted sanctioned North Korean official Kim Si-eun in opening bank accounts and transferring funds. Huang Ming-guang handled transactions related to Yun's network, exceeding $70,000.
How It Works
These workers gain employment through identity theft, fake certificates, and forged documents. Once hired, individual workers can earn up to $200,000 annually, with the money flowing directly back to the regime.
This operation has become increasingly difficult to detect. North Korea now uses artificial intelligence to alter workers' appearances, voices, and accents to match stolen identities. In some cases, deeply embedded workers even implant malware to steal proprietary data or extort companies.
Finance Minister Scott Bansen stated that the regime “weaponizes sensitive data,” and the U.S. will continue to “track the funds.” Foreign financial institutions that knowingly process transactions for sanctioned entities now face secondary sanctions.
Cryptocurrency Crime in 2025: Record Numbers
In 2025, the total global illicit cryptocurrency flow reached $154 billion to $158 billion, a 145% increase from 2024.
Sanctions evasion surged by 694%, primarily due to flows related to Russia through the ruble-backed A7A5 stablecoin, which processed over $93 billion in transactions in less than a year. Hackers stole $2.87 billion across 150 incidents. One incident—the Bybit hack in February 2025—resulted in losses of $1.46 billion, accounting for 51% of total hacker losses that year. Stablecoins now represent 84% of all illicit transaction volume, favored for their liquidity and ease of cross-border transfers.
North Korea's total cryptocurrency theft in 2025 is estimated to reach $2.02 billion, a 51% increase from the previous year, with operations in over 40 countries. An estimated 1,500 IT workers are employed in China, with another 500 spread across Russia, Laos, Cambodia, and several African nations.
Fraud Industrialization
Fraud in 2025 is no longer an individual operation but functions as a structured enterprise—developers, data brokers, and specialized money laundering networks work in parallel.
AI scams utilizing deepfakes and voice cloning are 4.5 times more profitable than traditional methods. Impersonation scams—criminals posing as banks, the IRS, or government agencies—are also prevalent.