- 9 Dec 2025
- Elara Crowthorne
- 25
OFAC Sanctions Checker for Crypto Wallets
Check if a cryptocurrency wallet address is linked to North Korean sanctions. Enter a wallet address to verify its status against the U.S. Treasury's OFAC sanctions list.
North Korea isn’t just building missiles-it’s building crypto heists. In 2025 alone, U.S. officials estimate that North Korean hackers stole over $2.1 billion in cryptocurrency, using fake IT workers, shell companies, and global money trails to fund weapons programs. The Office of Foreign Assets Control (OFAC) responded with its most aggressive sanctions campaign yet, targeting not just wallets and exchanges, but the human networks behind the thefts.
How North Korea Uses IT Workers to Steal Crypto
It sounds like a spy movie, but it’s happening right now. North Korean operatives are getting hired as remote software developers by U.S.-based crypto startups and Web3 firms. They apply with fake resumes, stolen identities, and polished GitHub profiles. Names like "Joshua Palmer" and "Alex Hong" aren’t real people-they’re disposable personas, reused across dozens of operations. These workers don’t just write code. They sit inside company networks for months, quietly mapping systems, stealing API keys, and gathering credentials. Once they have access, they trigger ransomware, drain wallets, or siphon funds directly into crypto addresses controlled by Pyongyang. Some are paid in stablecoins like USDC, which are easy to convert and harder to trace than Bitcoin. Security firms track these groups under names like Famous Chollima, UNC5267, and Wagemole. They’re not rogue hackers. They’re state-run teams, directly linked to the Workers’ Party of Korea. Their goal isn’t just money-it’s survival. Every dollar stolen helps buy missile parts, uranium, and cyber weapons.The Sanctioned Players: Who’s on the List
On August 27, 2025, OFAC added six new names to its sanctions list. Among them:- Kim Ung Sun-a North Korean operative who moved nearly $600,000 in crypto to cash through OTC brokers in Russia and the UAE.
- Vitaliy Sergeyevich Andreyev-a Russian national who helped launder funds using shell companies and fake invoices.
- Shenyang Geumpungri Network Technology Co., Ltd-a Chinese front company that hired fake IT workers and routed payments through Hong Kong.
- Korea Sinjin Trading Corporation-a trading entity tied to the DPRK’s Ministry of State Security.
How the Money Moves: The Laundering Pipeline
The stolen crypto doesn’t stay on-chain. It flows through a carefully engineered laundering pipeline:- Stolen funds enter wallets controlled by embedded IT workers.
- They’re split into small transfers to avoid detection-sometimes under $10,000 per transaction.
- Money moves through decentralized exchanges (DEXs) and privacy tools like Tornado Cash (even after its shutdown).
- It’s then funneled into centralized exchanges like Binance or Kraken, using fake KYC documents.
- Finally, it’s converted to cash via OTC brokers in Russia, the UAE, or Southeast Asia-many of which OFAC has already sanctioned.
Front Companies and Global Hubs
North Korea doesn’t operate from Pyongyang. It operates from:- Shenyang, China-where IT firms like Chinyong Information Technology Cooperation Company hire workers under the guise of software outsourcing.
- Laos and Cambodia-where remote work visas are easy to get and oversight is minimal.
- Russia-where sanctions evasion infrastructure is well-established, with IP addresses, servers, and bank accounts used to mask origins.
- The UAE-where free zones allow anonymous company registration and crypto transactions with little scrutiny.
Why This Matters to U.S. Companies
If you run a crypto startup or hire remote developers, you’re a target. North Korean operatives don’t break in through firewalls-they walk in the front door. They apply for jobs, pass interviews, and get paid in crypto. By the time the company realizes something’s wrong, the keys are gone. The FBI has warned that over 120 U.S. tech firms have unknowingly hired DPRK-linked workers since 2021. Some lost hundreds of thousands in assets. Others had their source code stolen and sold to competitors. The threat isn’t just financial-it’s existential for startups. Companies now need to screen not just for criminal records, but for behavioral red flags: workers who refuse video calls, use burner email domains, or have inconsistent work histories across platforms like RemoteHub and WorkSpace.ru. Even a single compromised account can lead to total system collapse.
The Bigger Picture: Crypto as a Weapon
North Korea’s crypto thefts aren’t random crimes. They’re state policy. The regime’s annual budget for cyber operations is estimated at over $1 billion. That’s more than what some small nations spend on defense. Crypto is their weapon of choice because:- It’s borderless-no customs checks, no paper trails.
- It’s anonymous-at least on the surface.
- It’s liquid-can be converted to cash in hours.
- It’s ignored-until it’s too late.
What’s Next? More Sanctions, More Tracking
As of October 2025, OFAC and the FBI are still mapping out the full network. New designations are expected every few weeks. Investigators are tracing:- IP addresses linked to North Korean state-run data centers.
- Wallets that repeatedly interact with known DPRK addresses.
- Employees who work for multiple sanctioned front companies.
How to Protect Your Business
If you’re hiring remote developers or using crypto payments, here’s what you need to do now:- Verify identities-Require video interviews and government ID checks. Don’t accept LinkedIn alone.
- Monitor wallet activity-Use blockchain analytics tools to flag transactions tied to known DPRK addresses.
- Screen contractors-Check names against OFAC’s SDN list and use services like Elliptic or Chainalysis for real-time alerts.
- Limit access-Never give new hires full wallet or API access. Use role-based permissions.
- Report suspicious activity-File a SAR (Suspicious Activity Report) with FinCEN if you suspect DPRK involvement.
Are OFAC sanctions on North Korean crypto networks still active in 2025?
Yes. OFAC has expanded its sanctions campaign throughout 2025, adding new individuals, companies, and cryptocurrency addresses every month. As of October 2025, over 40 entities and 150 digital wallets are officially designated. The U.S. government considers these sanctions an ongoing priority, with additional designations expected as investigations continue.
Can North Korea still steal crypto despite these sanctions?
Yes, but it’s getting harder. Sanctions have frozen key wallets, shut down major laundering routes, and forced North Korean operators to use more complex methods. However, they’ve adapted-using newer privacy tools, shifting to non-Ethereum chains, and targeting smaller, less secure crypto startups. The thefts are down from their peak in early 2025, but the threat remains high.
How do I check if a crypto wallet is linked to North Korea?
Use blockchain analytics tools like TRM Labs, Chainalysis, or Elliptic. These platforms flag wallets tied to OFAC-sanctioned addresses. You can also cross-reference wallet addresses with the U.S. Treasury’s SDN list. Most crypto exchanges now integrate these tools automatically, but if you manage your own wallets, you should run manual checks before accepting large transfers.
Is it illegal to do business with someone who unknowingly worked with a DPRK-linked contractor?
Not if you had no knowledge and took reasonable steps to screen. OFAC enforces sanctions based on intent and due diligence. If you used verified background checks, screened contractors through trusted platforms, and avoided high-risk jurisdictions, you’re unlikely to be penalized. But if you ignored red flags-like fake IDs or unusual payment requests-you could face fines or criminal charges.
What happens if my company gets hacked by a North Korean IT worker?
You must report the incident to the FBI’s Internet Crime Complaint Center (IC3) and FinCEN within 72 hours. You may also need to freeze affected wallets and notify your insurance provider. Failure to report can lead to penalties under U.S. sanctions law, even if you were the victim. The government treats these attacks as national security threats, not just cybercrime.
Can I still hire remote developers from China or Russia?
You can, but you must screen them more carefully. Many legitimate developers work in these countries. The risk comes from companies that use fake profiles, avoid video calls, or have inconsistent work histories. Always verify identity with government-issued documents, check references, and use platforms that require verified profiles. Avoid freelancers who only accept crypto payments or refuse to sign contracts.
25 Comments
Just had a dev quit last week. Said they were "moving to Bali" but their GitHub was all fake profiles and one repo with 3 commits from 2019. We didn't screen properly. Now we're using video interviews and TRM Labs. Worth it.
So let me get this straight - we’re sanctioning people for stealing crypto so North Korea can buy missiles... but we’re still letting Chinese firms hire "IT workers" with zero background checks? Classic.
bro what if the real villain is capitalism?? like why are startups so desperate for cheap devs they’ll hire someone with a fake LinkedIn and no video call?? it’s not the hackers, it’s us. we built the system that lets them walk in the front door. 🤡
OFAC is doing a great job. I mean, really. We’re talking about a regime that starves its own people to fund nukes, and we’re letting them cash out on USDC like it’s a damn grocery store. Time to freeze every wallet with a Korean IP. No exceptions. 🇺🇸🔥
Use Chainalysis. Set alerts. Limit API access. Done. You don’t need to be a genius, just consistent.
It’s not just about crypto. It’s about the erosion of trust in remote work. Every fake profile undermines real developers trying to make an honest living. This isn’t cybersecurity - it’s moral decay dressed up as globalization.
I’ve hired remote devs from Russia and China for years. Most are brilliant. But I’ve learned to ask: "Can we do a live code review?" and "What’s your favorite debugging story?" If they dodge, I walk away. It’s not about geography - it’s about transparency.
The laundering pipeline described is structurally analogous to traditional financial intermediation, albeit with cryptographic obfuscation. The use of decentralized exchanges as transitional nodes introduces non-repudiation challenges that traditional AML frameworks are ill-equipped to address. This necessitates a paradigm shift toward on-chain behavioral analytics.
They’re not stealing crypto. They’re stealing our complacency. Every time we say "it’s not our problem," we’re handing them a key to the next server. This isn’t a cybercrime issue - it’s a civilizational one.
My cousin works at a startup in Manila. They hired a "developer" from Pyongyang through a freelance site. Paid in USDC. Two weeks later, the whole backend was wiped. No one reported it. They were too scared. This is happening everywhere.
Let’s not pretend this is just about North Korea. It’s about the global race to the bottom in hiring practices. We want cheap labor, so we ignore red flags. We want innovation, so we skip due diligence. Then we’re shocked when the house burns down. We built the tinder.
Dear friends, we are living in a world where the line between nation-state warfare and corporate negligence has dissolved into a blur of wallet addresses and fake resumes. Is it not tragic that our most advanced technologies are being weaponized by those who deny their own people clean water? We must act - not out of fear, but out of moral clarity. 💔
From India, we see this too. Many freelancers here get hired by US firms with no verification. Some are legit. Some aren't. I always ask for a 10-min Zoom call. If they say "I don't have a camera," I say thanks but no thanks. Simple.
OMG I just realized - the same people using "Joshua Palmer" as a name are probably the ones posting on r/forhire with "$50/hr for 100 hrs!" 🤯 We’re literally funding nukes with our freelance budgets. This is wild.
Just a reminder: most people in China and Russia aren’t spies. Don’t let fear make you racist. But yeah, do the background checks. It’s not hard.
OFAC is just a distraction. The real problem? The U.S. government lets companies outsource security to startups that can’t afford real IT. So the spies walk in. Then we blame the hackers. Pathetic.
Did you know the same wallets that got frozen in 2024 are now reappearing under new names? The feds know this. They’re letting it happen to justify more surveillance. Wake up.
Can we talk about how insane it is that we’re sanctioning a Chinese company called "Shenyang Geumpungri Network Technology Co., Ltd" - but we still let Chinese students work at Silicon Valley startups? Double standards much? 🤦♀️
My team just got hit. Lost $320k in ETH. We didn’t even know the dev was fake until the wallet drained. Now we’re using blockchain monitoring + mandatory video interviews. It’s not expensive. It’s survival.
Just hire people you can talk to. If they won’t do a video call, they’re not worth the risk. Simple as that.
The OFAC designation list is publicly accessible. Every crypto firm should integrate it into their onboarding workflow. The technical barrier is negligible. The moral imperative is absolute.
It is imperative that all entities engaged in cryptocurrency transaction processing implement rigorous compliance protocols in accordance with 31 CFR § 595.201 et seq. Failure to do so constitutes a material breach of U.S. sanctions law.
I used to think remote work was the future. Now I see it as a minefield. I’m not scared of hackers. I’m scared of how easy it is to hide in plain sight. We’re all just trusting strangers on the internet. And some of them are building bombs.
Statistical analysis of wallet clustering patterns indicates a 92.7% correlation between IP geolocation anomalies and sanctioned DPRK-linked addresses. The data is unequivocal. The response must be systemic, not reactive.
Y’all are acting like this is new. It’s not. They’ve been doing this since 2017. We just didn’t care until our wallets got empty. Now we’re mad? Pathetic.