OFAC Names North Korean Bankers

Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned three individuals for providing support to North Korea through illicit financing and malicious cyber activity.

The Democratic People’s Republic of Korea (DPRK) is accused of laundering stolen virtual currency and deploying information technology (IT) workers to fraudulently obtain employment to generate revenue for the regime's unlawful weapons of mass destruction and ballistic missile programs. The United States has taken these actions in close coordination with South Korea.

"The DPRK's use of illicit facilitation networks to access the international financial system and generate revenue using virtual currency for the regime's unlawful weapons of mass destruction and ballistic missile programs directly threatens international security," said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson.

He added that the US and its partners are committed to safeguarding the international financial system from DPRK's destabilizing activities, particularly in light of the three intercontinental ballistic missile (ICBM) launches this year.

Wu Huihui and Cheng Hung Man have been designated for providing material support to the Lazarus Group, which is controlled by the DPRK's primary intelligence bureau, the Reconnaissance General Bureau. The Lazarus Group has been involved in cyber espionage, data theft, monetary heists, and destructive malware operations. It is also responsible for the largest virtual currency heist to date, stealing almost $620 million from a blockchain project linked to the online game Axie Infinity.

Sim Hyon Sop has been designated for acting on behalf of the Korea Kwangson Banking Corp (KKBC), an entity that provides financial services in support of both Tanchon Commercial Bank and Korea Hyoksin Trading Corporation. Sim has coordinated millions of dollars in financial transfers for the DPRK.

The DPRK generates revenue by deploying IT workers who fraudulently obtain employment in the technology and virtual currency industries. These workers use fake personas to apply for jobs and request payment in virtual currency, which is then sent through a complicated laundering pattern back to the DPRK.

For additional information regarding the DPRK’s IT workers, see the May 16, 2022, Guidance on the Democratic People’s Republic of Korea Information Technology Workers.