US imposes sanctions on cryptocurrency changers for N. Korea

The US Treasury Department’s Office of Foreign Assets Control (OFAC) has sanctioned three individuals for providing support to North Korea through illicit financing and malicious cyberactivity.

“North Korea launders the stolen virtual currency and deploys information technology (IT) workers to fraudulently obtain employment to generate revenue in virtual currency to support the regime and its unlawful weapons of mass destruction and ballistic missile programs. Today’s actions have been taken in close coordination with the Republic of Korea,” Caliber.Az quotes the US Treasury's press release.

“North Korea’s use of illicit facilitation networks to access the international financial system and generate revenue using virtual currency for the regime’s unlawful weapons of mass destruction (WMD) and ballistic missile programs directly threatens international security,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson.

“The United States and our partners are committed to safeguarding the international financial system and preventing its use in North Korea’s destabilizing activities, especially in light of North Korea’s three launches of intercontinental ballistic missiles (ICBMs) this year alone.”

Wu Huihui (Wu) is being designated pursuant to Executive Order (E.O.) 13722 for providing material support to the Lazarus Group, which was previously designated pursuant to that same authority on September 13, 2019. Cheng Hung Man (Cheng) is being designated pursuant to E.O. 13722 for providing material support to Wu.

The Lazarus Group targets institutions such as financial, manufacturing, publishing, media, entertainment, and international shipping companies, as well as government and military and critical infrastructure, using tactics such as cyber espionage, data theft, monetary heists, and destructive malware operations. The group is controlled by the Reconnaissance General Bureau (RGB), North Korea’s primary intelligence bureau and main entity responsible for the country’s malicious cyber activities, and is involved in the trade of DPRK arms. On March 23, 2022, the Lazarus Group carried out the largest virtual currency heist to date, stealing almost $620 million in virtual currency from a blockchain project linked to the online game Axie Infinity.

Since at least late 2017, North Korea has been engaged in virtual currency thefts and fraud schemes to generate revenue for its unlawful ballistic missile and weapons of mass destruction programs. According to public reporting, DPRK cyber actors were able to steal an estimated $1.7 billion worth of virtual currency through various hacks in 2022 alone. North Korea often launders the stolen virtual currency through a complicated process to convert stolen virtual currency into fiat currency. North Korea leverages a network of over-the-counter (OTC) virtual currency traders to convert cryptocurrency into fiat currency. Frequently, DPRK actors use these networks of OTC traders, including People’s Republic of China (PRC)-based OTC traders, to conduct transactions on their behalf to avoid detection by financial institutions or competent authorities.

Wu is a PRC-based OTC virtual currency trader who facilitated the conversion of virtual currency stolen by DPRK actors working with the Lazarus Group to fiat currency. In 2021, Wu processed multiple transactions that converted millions of dollars’ worth of virtual currency into fiat currency for DPRK cyber actors. Cheng is a Hong Kong-based OTC trader who worked with Wu to remit payment to companies in exchange for virtual currency. Cheng utilized front companies to enable DPRK actors to bypass countering illicit finance requirements at financial institutions and access the U.S. financial system. Cheng worked with Wu and other virtual currency OTC traders who facilitate conversion of virtual currency stolen by DPRK hackers into fiat currency for use by North Korea government.