The U.S. Department of the Treasury has sanctioned ten people and entities that it says helped North Korea move about 12.7 million dollars through cryptocurrency and overseas information technology jobs. The Department of the Treasury said the network was part of a broader effort by Pyongyang to earn money outside the formal banking system and to fund military and cyber activity.
The action, announced on November 5, targets two organisations, the Korea Mangyongdae Computer Technology Company and the Ryujong Credit Bank, together with eight people based in North Korea, China, and Russia. According to the Treasury, they worked together to move money for First Credit Bank, a North Korean bank that has been under U.S. sanctions since 2017 because of its role in missile and weapons programs.
Blockchain analysis cited by U.S. officials showed that wallets tied to First Credit Bank received more than 12.7 million dollars between June 2023 and May 2025. The Treasury said the people on the new sanctions list were an important part of North Korea’s sanctions evasion system, since they helped shift funds through normal bank channels and through digital assets.
Investigators said one part of the operation relied on North Korean IT workers who were sent abroad under false identities. Many of them worked remotely for foreign companies in Chinese cities such as Shenyang and Dandong. Their earnings were then collected or partly collected and moved through accounts controlled by Chinese partners, which helped hide that the money was going back to North Korea.
U.S. officials said this method shows how North Korea has adjusted to tighter controls. By mixing legitimate income from real work with cryptocurrency transfers, the regime can move smaller amounts of money in ways that are harder to detect. Officials also pointed out that North Korean groups have stolen more than 3 billion dollars in digital assets over the past three years, which makes crypto monitoring a priority for Washington.
The sanctions freeze any assets in the United States that belong to the listed people or companies. U.S. persons are also banned from doing business with them. The Treasury said it expects banks, payment companies, and cryptocurrency platforms to screen for the names involved and to report any matches.
Analysts said the case shows how three elements now overlap in North Korea’s finances: remote IT work, cryptocurrency transfers, and support from intermediaries in neighbouring countries. Because each part on its own can look legal, financial institutions may not notice the pattern unless they combine sanctions screening with blockchain tracing and more detailed checks on overseas tech workers.
The United States said it will continue to publish names as it uncovers new parts of the network. It also called on partners in Asia and Europe to share data on cryptocurrency wallets, shell companies, and bank accounts that appear to support North Korean activity.
For companies that hire remote developers or engineers, the case is a reminder to verify identities and watch for applicants who reuse documents or who insist on being paid through unusual channels. For financial institutions, it highlights the need to monitor small and repeated transfers that link digital wallets to accounts in China or Russia, since these are common routes in North Korean schemes.