SEOUL, September 08 (AJP) - A U.S. federal judge has ordered the forfeiture of cryptocurrency tied to a North Korean overseas IT worker scheme, granting the Justice Department a partial victory in its effort to seize nearly 8 million dollars in virtual assets allegedly linked to Pyongyang’s sanctions-evasion network, according to NK News.
The ruling comes as U.S. authorities intensify efforts to disrupt North Korea’s overseas IT workforce, which Washington says numbers in the thousands worldwide. The U.S. Treasury Department has estimated that such workers generated nearly 800 million dollars in revenue for the North Korean regime in 2024.
NK News reported Monday that Judge Rudolph Contreras of the U.S. District Court for the District of Columbia ruled on Sept. 3 that funds held in a cryptocurrency wallet whose address begins with “0x81c4” should be forfeited to the U.S. government. The ruling was part of a civil forfeiture case brought by the Justice Department in June 2025.
According to the court ruling, the wallet received approximately 158,123 USDC from at least 10 addresses used to receive payments for North Korean IT workers, as well as 54,574 USDT from at least four other worker payment addresses. Both USDC and USDT are stablecoins designed to maintain a value close to the U.S. dollar, putting the face value of those transfers at roughly $212,700.
The Justice Department had sought forfeiture of a much larger pool of assets worth more than 7.74 million dollars, including cryptocurrency, nonfungible tokens and Ethereum Name Service domains allegedly connected to North Korean money laundering and sanctions-evasion operations.
Contreras, however, granted the government's request only for assets linked to the 0x81c4 wallet. He denied the request for the remaining property without prejudice, finding that the government had failed to adequately identify those assets in its public forfeiture notice. The decision leaves prosecutors able to seek forfeiture of the remaining assets again after addressing the procedural deficiencies.
The Justice Department said when it filed the case last year that the assets had been frozen or seized as part of an investigation into North Korean IT workers who obtained jobs at foreign companies using fraudulent or fraudulently obtained identification documents.
The workers concealed their identities and locations from employers and in some cases received salaries in cryptocurrencies such as USDC and USDT, according to the department. They then allegedly moved the funds through multiple cryptocurrency addresses and other transactions designed to obscure their origin before sending the proceeds back to North Korea.
Court documents say the proceeds were ultimately transferred in some cases to Kim Sang Man, the head of an organization subordinate to North Korea's Ministry of National Defense, or to Sim Hyon Sop, an official of North Korea's Foreign Trade Bank. Both are on the U.S. Treasury Department's list of Specially Designated Nationals.
The FBI investigation found that the workers used designated payment addresses to receive earnings before transferring the funds to consolidation wallets, where revenue from multiple workers was commingled. The funds were then sent to cryptocurrency accounts connected to Kim and Sim, according to the ruling.
The case highlights the growing importance of overseas IT work as a source of foreign currency for the heavily sanctioned North Korean government.
The U.S. Treasury Department has said Pyongyang maintains a global workforce of thousands of highly skilled IT workers, with many operating from China and Russia. They frequently use stolen identities, forged documents, false online personas and proxy accounts to pose as workers of other nationalities and obtain remote employment at companies in wealthier countries.
The workers can hold legitimate positions as software developers and other technology specialists while concealing their North Korean nationality and location. U.S. authorities say the North Korean government takes a large share of their earnings and uses the revenue to support its nuclear weapons and ballistic missile programs.
In March, the Treasury Department said North Korean government-orchestrated IT worker schemes generated nearly 800 million dollars in 2024. It also sanctioned six individuals and two entities accused of facilitating networks that helped North Korean workers obtain jobs, move money and convert their earnings into funds usable by the regime.
U.S. authorities have increasingly targeted not only the North Korean workers but also overseas facilitators who provide stolen identities, financial accounts or computers that allow them to appear to be working from the United States.
In April, two U.S. nationals were sentenced for operating so-called “laptop farms” that enabled North Korean workers using stolen American identities to obtain jobs at more than 100 U.S. companies. The Justice Department said the scheme generated more than 5 million dollars for North Korea and involved the stolen identities of at least 80 Americans.
Washington says the operations present a threat beyond sanctions evasion because workers who successfully obtain remote jobs can gain legitimate access to corporate networks and sensitive information, creating opportunities for data theft, extortion and other malicious cyber activity.
Copyright ⓒ Aju Press All rights reserved.
