The US Department of Justice last week filed a civil forfeiture complaint over $7.74 million in digital assets linked to North Korean fake IT worker schemes.
The funds, representing cryptocurrency, NFTs, and other digital assets, were frozen in connection to the April 2023 indictment of North Korean Foreign Trade Bank (FTB) representative Sim Hyon Sop, who allegedly received over $24 million in illegal proceeds from such schemes.
Ongoing for years, these schemes have been aimed at evading sanctions against North Korea by funneling payments for illegally obtained employment at legitimate firms to the Pyongyang regime, to support its cyber and ballistic weapons programs.
Using false identities, North Korean nationals, mainly located in China, Russia, and the United Arab Emirates (UAE), would obtain employment at tech companies in the US and abroad, routing received payments to the country through a laundering network.
In May 2022, the US government warned that thousands of such individuals were being dispatched worldwide to obtain payment as IT workers, estimating that each could earn more than $300,000 per year.
In October 2023, the FBI announced the seizure of $1.5 million and 17 domain names in an investigation into North Korean IT workers, noting that any US company that hired freelance IT workers likely hired an individual participating in the scheme.
In May 2024, charges were announced against Christina Marie Chapman of Arizona, for allegedly helping North Koreans pose as US citizens to obtain jobs in the US between October 2020 and October 2023. The scheme netted over $6.8 million.
In December 2024, the US estimated that North Korean IT workers had infiltrated hundreds of companies in the US, netting more than $88 million over six years.
Over a dozen individuals were indicted and sanctioned in connection to the schemes. In January 2024, five individuals were charged over a North Korean IT worker scheme running from April 2018 through August 2024.
Now, the US is seeking the forfeiture of $7.74 million in digital assets in Sim Hyon Sop’s wallets, frozen when Sim was charged in 2023 over his alleged role in laundering over $15 million in cryptocurrency between August 2021 to March 2023.
Kim Sang Man, CEO of IT company Chinyong and subordinate to North Korea’s Ministry of Defense, who opened accounts using fake Russian IDs, was also involved in the laundering network. The US sanctioned Kim and Chinyong in 2023.
Related: North Korean Fake IT Workers Pose as Blockchain Developers on GitHub
Related: North Korean Fake IT Workers More Aggressively Extorting Enterprises
