North Korea has become one of the biggest crypto antagonists for the United States.
According to blockchain analytics firm Chainalysis, North Korean hackers stole more than $2 billion in crypto during 2025, including a record $1.5 billion hack of crypto exchange Bybit .
On March 12, the U.S. Treasury Department imposed fresh sanctions on individuals and entities allegedly involved in a crypto fraud scheme.
Related: North Korea’s hacking group now holds more Bitcoin than these countries
Fraudulent IT workers run scam
The Treasury sanctioned six individuals and two entities linked to a North Korean government scheme that allegedly used fraudulent IT workers to infiltrate American companies and funnel millions into Pyongyang’s weapons programs.
The sanctions were announced by the Treasury’s Office of Foreign Assets Control (OFAC) as part of a broader effort to dismantle overseas revenue networks used by North Korea to evade international sanctions.
According to Treasury officials, the operation generated nearly $800 million in 2024 alone.
Treasury Secretary Scott Bessent said the scheme relied on deceptive employment tactics that allowed operatives to infiltrate companies and extract sensitive information.
“The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,”Bessent said in a statement.
Trending on TheStreet Roundtable:
Fake identities and remote jobs fuel Pyongyang’s funding streams
U.S. officials say North Korean IT workers routinely secure remote employment using stolen identities, forged documents and fabricated personas.
Once hired, these workers allegedly send the majority of their wages back to the North Korean government, helping finance the country’s nuclear and ballistic missile programs in violation of U.S. and United Nations sanctions.
In some cases, investigators say the workers also embedded malware inside company systems to steal proprietary data or extort payments.
The network targeted in Thursday’s sanctions operated across several countries, including Vietnam, Laos and Spain.
Among those sanctioned was a Vietnamese businessman accused of converting roughly $2.5 million into cryptocurrency for North Korean operatives between 2023 and 2025.
Two additional individuals were sanctioned for helping a previously designated North Korean nuclear procurement facilitator open bank accounts and launder funds.
Treasury also targeted a North Korean national accused of leading a group of IT workers operating out of Boten, Laos.
This story was originally published by TheStreet on Mar 14, 2026, where it first appeared in the Trading News & Analysis section. Add TheStreet as a Preferred Source by clicking here.
