U.S. Sanctions on Cryptocurrency Laundering for North Korea

The U.S. Treasury Department sanctioned two individuals and one entity involved in laundering cryptocurrencies for the North Korean Democratic People’s Republic of Korea (DPRK).

Two Chinese nationals, Lu Huaying and Zhang Jian, were implicated in this scheme, operating as part of a broader illicit network overseen by a sanctioned DPRK banking representative named Sim Hyon Sop, according to the Treasury’s Office of Foreign Assets Control (OFAC).

Lu and Zhang worked at a front company in the United Arab Emirates named Green Alpine Trading, which is believed to have been a key player in the money laundering operation. This company has also been designated as a sanctioned organization.

The statement from the Treasury noted, “The DPRK continues to use agents and proxies to access the international financial system to conduct illicit financial activities, including fraudulent IT work, digital assets heists, and money laundering, in support of its unlawful WMD and ballistic missile programs.”

North Korea-backed hacker groups, particularly the Lazarus Group, are accused of executing some of the most significant hacks in cryptocurrency, including the $600 million hack of the Ronin Ethereum sidechain in 2022.

One tactic used by North Korean hackers involves impersonating recruiters or high-level executives in crypto investment companies. For instance, a member of the Lazarus hacker group was reported to have posed as an executive from the Chinese blockchain asset management firm Fenbushi Capital to deceive users on LinkedIn into clicking on malicious links.

According to a report from South Korea's Yonhap News Agency in March, North Korea’s state-backed crypto hacker groups are said to have generated around 50% of the country's foreign currency, much of which allegedly supports the development of weapons of mass destruction, as cited by the United Nations Security Council.