- 9 Dec 2025
- Elara Crowthorne
- 0
OFAC Sanctions Checker for Crypto Wallets
Check if a cryptocurrency wallet address is linked to North Korean sanctions. Enter a wallet address to verify its status against the U.S. Treasury's OFAC sanctions list.
North Korea isn’t just building missiles-it’s building crypto heists. In 2025 alone, U.S. officials estimate that North Korean hackers stole over $2.1 billion in cryptocurrency, using fake IT workers, shell companies, and global money trails to fund weapons programs. The Office of Foreign Assets Control (OFAC) responded with its most aggressive sanctions campaign yet, targeting not just wallets and exchanges, but the human networks behind the thefts.
How North Korea Uses IT Workers to Steal Crypto
It sounds like a spy movie, but it’s happening right now. North Korean operatives are getting hired as remote software developers by U.S.-based crypto startups and Web3 firms. They apply with fake resumes, stolen identities, and polished GitHub profiles. Names like "Joshua Palmer" and "Alex Hong" aren’t real people-they’re disposable personas, reused across dozens of operations. These workers don’t just write code. They sit inside company networks for months, quietly mapping systems, stealing API keys, and gathering credentials. Once they have access, they trigger ransomware, drain wallets, or siphon funds directly into crypto addresses controlled by Pyongyang. Some are paid in stablecoins like USDC, which are easy to convert and harder to trace than Bitcoin. Security firms track these groups under names like Famous Chollima, UNC5267, and Wagemole. They’re not rogue hackers. They’re state-run teams, directly linked to the Workers’ Party of Korea. Their goal isn’t just money-it’s survival. Every dollar stolen helps buy missile parts, uranium, and cyber weapons.The Sanctioned Players: Who’s on the List
On August 27, 2025, OFAC added six new names to its sanctions list. Among them:- Kim Ung Sun-a North Korean operative who moved nearly $600,000 in crypto to cash through OTC brokers in Russia and the UAE.
- Vitaliy Sergeyevich Andreyev-a Russian national who helped launder funds using shell companies and fake invoices.
- Shenyang Geumpungri Network Technology Co., Ltd-a Chinese front company that hired fake IT workers and routed payments through Hong Kong.
- Korea Sinjin Trading Corporation-a trading entity tied to the DPRK’s Ministry of State Security.
How the Money Moves: The Laundering Pipeline
The stolen crypto doesn’t stay on-chain. It flows through a carefully engineered laundering pipeline:- Stolen funds enter wallets controlled by embedded IT workers.
- They’re split into small transfers to avoid detection-sometimes under $10,000 per transaction.
- Money moves through decentralized exchanges (DEXs) and privacy tools like Tornado Cash (even after its shutdown).
- It’s then funneled into centralized exchanges like Binance or Kraken, using fake KYC documents.
- Finally, it’s converted to cash via OTC brokers in Russia, the UAE, or Southeast Asia-many of which OFAC has already sanctioned.
Front Companies and Global Hubs
North Korea doesn’t operate from Pyongyang. It operates from:- Shenyang, China-where IT firms like Chinyong Information Technology Cooperation Company hire workers under the guise of software outsourcing.
- Laos and Cambodia-where remote work visas are easy to get and oversight is minimal.
- Russia-where sanctions evasion infrastructure is well-established, with IP addresses, servers, and bank accounts used to mask origins.
- The UAE-where free zones allow anonymous company registration and crypto transactions with little scrutiny.
Why This Matters to U.S. Companies
If you run a crypto startup or hire remote developers, you’re a target. North Korean operatives don’t break in through firewalls-they walk in the front door. They apply for jobs, pass interviews, and get paid in crypto. By the time the company realizes something’s wrong, the keys are gone. The FBI has warned that over 120 U.S. tech firms have unknowingly hired DPRK-linked workers since 2021. Some lost hundreds of thousands in assets. Others had their source code stolen and sold to competitors. The threat isn’t just financial-it’s existential for startups. Companies now need to screen not just for criminal records, but for behavioral red flags: workers who refuse video calls, use burner email domains, or have inconsistent work histories across platforms like RemoteHub and WorkSpace.ru. Even a single compromised account can lead to total system collapse.
The Bigger Picture: Crypto as a Weapon
North Korea’s crypto thefts aren’t random crimes. They’re state policy. The regime’s annual budget for cyber operations is estimated at over $1 billion. That’s more than what some small nations spend on defense. Crypto is their weapon of choice because:- It’s borderless-no customs checks, no paper trails.
- It’s anonymous-at least on the surface.
- It’s liquid-can be converted to cash in hours.
- It’s ignored-until it’s too late.
What’s Next? More Sanctions, More Tracking
As of October 2025, OFAC and the FBI are still mapping out the full network. New designations are expected every few weeks. Investigators are tracing:- IP addresses linked to North Korean state-run data centers.
- Wallets that repeatedly interact with known DPRK addresses.
- Employees who work for multiple sanctioned front companies.
How to Protect Your Business
If you’re hiring remote developers or using crypto payments, here’s what you need to do now:- Verify identities-Require video interviews and government ID checks. Don’t accept LinkedIn alone.
- Monitor wallet activity-Use blockchain analytics tools to flag transactions tied to known DPRK addresses.
- Screen contractors-Check names against OFAC’s SDN list and use services like Elliptic or Chainalysis for real-time alerts.
- Limit access-Never give new hires full wallet or API access. Use role-based permissions.
- Report suspicious activity-File a SAR (Suspicious Activity Report) with FinCEN if you suspect DPRK involvement.
Are OFAC sanctions on North Korean crypto networks still active in 2025?
Yes. OFAC has expanded its sanctions campaign throughout 2025, adding new individuals, companies, and cryptocurrency addresses every month. As of October 2025, over 40 entities and 150 digital wallets are officially designated. The U.S. government considers these sanctions an ongoing priority, with additional designations expected as investigations continue.
Can North Korea still steal crypto despite these sanctions?
Yes, but it’s getting harder. Sanctions have frozen key wallets, shut down major laundering routes, and forced North Korean operators to use more complex methods. However, they’ve adapted-using newer privacy tools, shifting to non-Ethereum chains, and targeting smaller, less secure crypto startups. The thefts are down from their peak in early 2025, but the threat remains high.
How do I check if a crypto wallet is linked to North Korea?
Use blockchain analytics tools like TRM Labs, Chainalysis, or Elliptic. These platforms flag wallets tied to OFAC-sanctioned addresses. You can also cross-reference wallet addresses with the U.S. Treasury’s SDN list. Most crypto exchanges now integrate these tools automatically, but if you manage your own wallets, you should run manual checks before accepting large transfers.
Is it illegal to do business with someone who unknowingly worked with a DPRK-linked contractor?
Not if you had no knowledge and took reasonable steps to screen. OFAC enforces sanctions based on intent and due diligence. If you used verified background checks, screened contractors through trusted platforms, and avoided high-risk jurisdictions, you’re unlikely to be penalized. But if you ignored red flags-like fake IDs or unusual payment requests-you could face fines or criminal charges.
What happens if my company gets hacked by a North Korean IT worker?
You must report the incident to the FBI’s Internet Crime Complaint Center (IC3) and FinCEN within 72 hours. You may also need to freeze affected wallets and notify your insurance provider. Failure to report can lead to penalties under U.S. sanctions law, even if you were the victim. The government treats these attacks as national security threats, not just cybercrime.
Can I still hire remote developers from China or Russia?
You can, but you must screen them more carefully. Many legitimate developers work in these countries. The risk comes from companies that use fake profiles, avoid video calls, or have inconsistent work histories. Always verify identity with government-issued documents, check references, and use platforms that require verified profiles. Avoid freelancers who only accept crypto payments or refuse to sign contracts.
