US Treasury Department Sanctions North Korea-Linked Network Over Crypto IT Worker Fraud

The US Department of the Treasury has slapped sanctions on people and entities tied to a North Korea-backed IT worker scheme. This scheme allegedly involved cryptocurrency and fraudulent employment to generate illegal funds. The Treasury Department stated that North Korean operatives used stolen identities to land remote tech jobs at companies around the globe. Reports indicate that the earnings from these jobs were funnelled back to the North Korean government through cryptocurrency payments and other financial routes, thereby strengthening the country's military efforts.

Sanctions Target Network Accused of Funding North Korea Through Crypto

Authorities revealed that the scheme involved foreign IT workers who pretended to be independent contractors or legitimate developers in order to get jobs with tech companies. These individuals allegedly used forged documents, invented online identities, and remote access technologies to conceal their true whereabouts and connections. The Treasury's Office of Foreign Assets Control (OFAC) estimates that the annual revenue generated by these activities could total hundreds of millions of dollars, a significant portion of which is believed to be appropriated by the North Korean government.

According to officials, the sanctions are part of broader efforts to disrupt networks that help North Korea bypass international restrictions. In a statement, the Treasury said the action targets individuals and entities involved in supporting these operations. “Under President Trump's leadership, Treasury will continue to follow the money in order to protect US businesses from these malicious activities and ensure those responsible are held accountable,” the department said, adding that the move aims to limit the regime's ability to generate illicit revenue through global employment and cryptocurrency channels.

This news follows another high-profile cryptocurrency hack, linked to hacking groups believed to be backed by North Korea. In February 2025, cryptocurrency exchange Bybit suffered one of the largest digital asset hacks when attackers stole around $1.5 billion (roughly Rs. 13,868 crore) worth of cryptocurrency. Blockchain analysts and investigators later linked the incident to the Lazarus Group, a cybercrime organisation widely believed to operate under North Korea's government.

The most recent sanctions show how regulators and law enforcement organisations are becoming increasingly concerned about the use of cryptocurrencies in cybercrime and sanctions evasion. Governments around the world are increasingly targeting networks that combine hacking, fraudulent employment, and digital asset transfers to generate revenue. Authorities claim that in order to stop these operations and shield companies from new cyberthreats, ongoing international cooperation will be required.