U.S. Court Orders Forfeiture of $212,700 Crypto Tied to North Korean IT Workers

A U.S. District Court has ordered the forfeiture of about $212,700 in stablecoins that prosecutors say were used to pay North Korean information‑technology workers employed abroad. The ruling represents a partial win for the Justice Department, which is seeking to seize more than $7.74 million in cryptocurrency and other digital property alleged to be tied to a sanctions‑evasion scheme.

Assets seized

The court approved the forfeiture of a wallet that held 158,123 USDC and 54,574 USDT, valued at roughly $212,700. Prosecutors traced the stablecoins to payment addresses used by at least 14 North Korean workers.

Legal background

U.S. District Judge Rudolph Contreras found that the government had provided sufficient evidence to link the wallet (address beginning with “0x81c4”) to a wire‑fraud and money‑laundering operation that violated the International Emergency Economic Powers Act. The judge entered a default judgment in favor of the United States for the identified stablecoins, but rejected the government’s request to immediately seize additional assets because the forfeiture notice did not adequately identify them.

Broader investigation

The Justice Department’s civil forfeiture complaint, filed in June 2025, targets more than $7.74 million in cryptocurrency, non‑fungible tokens and Ethereum Name Service domains allegedly generated by North Korean overseas IT employment schemes. The assets were initially restrained following an April 2023 indictment of Sim Hyon Sop, a representative of North Korea’s Foreign Trade Bank, for facilitating the movement of crypto earnings back to the regime.

How the scheme allegedly worked

• North Korean workers obtained IT and blockchain jobs abroad using false identities.
• Employers paid the workers in stablecoins such as USDC and USDT.
• Workers obscured the source of the crypto by splitting transactions, using false accounts, swapping tokens, moving assets across blockchains, buying NFTs and mixing proceeds with other funds.
• The laundered proceeds were then transferred to intermediaries, including Sim Hyon Sop and Kim Sang Man, before being sent to the North Korean government.

Ongoing enforcement

U.S. authorities continue to target individuals and networks that facilitate these operations. In March, the Treasury Department sanctioned a network that helped North Korean workers obtain overseas jobs using stolen identities. Subsequent investigations have identified dozens of suspected DPRK operatives embedded in crypto projects and development teams.