The U.S. Department of the Treasury moved to sanction six individuals and two entities tied to a North Korea-run IT worker fraud network that generated illicit revenue and funneled part of it into cryptocurrency. The action put new attention on the financial infrastructure that helped move proceeds from overseas operations back toward the DPRK.
According to Treasury, the schemes produced nearly $800 million in 2024, with conversion and laundering services playing a key role in turning earnings into crypto and repatriating value. The sanctions make clear that Washington is targeting not only the end operators, but also the intermediaries that helped convert and route funds.
Treasury Targeted the Network’s Financial Enablers
Among the named entities was Amnokgang Technology Development Company, which Treasury identified as a North Korean IT firm that managed overseas delegations of workers and handled illicit procurement and sales through foreign networks. Treasury portrayed Amnokgang as a central organizational node in the broader overseas revenue operation.
The designations also reached Quangvietdnbg International Services Company and its chief executive, Nguyen Quang Viet. Treasury said the Vietnam-based firm converted about $2.5 million into cryptocurrency for North Koreans between mid-2023 and mid-2025, including proceeds linked to Amnokgang.
Yun Song Guk was identified as another key figure in the network. Treasury said Yun led groups of North Korean IT workers operating from Boten, Laos, and coordinated dozens of financial transactions worth more than $70,000 with overseas facilitators tied to freelance IT work.
Other individuals were described as support actors who helped expand and protect the network’s operations. York Louis Celestino Herrera was designated for materially assisting Yun, while Hoang Minh Quang was identified as coordinating multiple financial transactions with him related to IT services.
The Sanctions Also Tighten Pressure on Crypto Conversion Channels
Treasury also designated Do Phi Khanh and Hoang Van Nguyen, describing them as Vietnamese proxies and facilitators for a previously sanctioned DPRK procurement intermediary. The agency linked them to bank-account access and cryptocurrency-enabling activity, extending the enforcement focus to the points where fiat access and crypto conversion overlapped.
By linking conversion services and intermediary banking access to a broader campaign involving malware, data theft, and ransomware proceeds, Treasury has narrowed the compliance margin around certain regional fiat-to-crypto rails.
The practical implication is straightforward: firms will need to monitor counterparties, wallet clusters, and historical exposure more aggressively where named persons or entities may have touched the flow of funds. The sanctions are likely to increase demand for stronger screening, deeper transaction tracing, and tighter controls around low-volume but high-risk conversion channels.
