US Imposes Sanctions on North Korean IT Specialist for Alleged Cyber Espionage and Cryptocurrency Theft

The US Treasury Department's Office of Foreign Assets Control has designated Song Kum Hyok, a North Korean national, as a 'malicious cyber actor' and added him to its 'Specially Designated Nationals' list. According to the Treasury Department, Song worked to place North Korean IT workers in various companies around the world, where they would send funds back to North Korea and potentially exploit their employers for additional revenue. The cryptocurrency industry has been significantly impacted by such schemes, with several major thefts attributed to North Korean hackers. The Treasury Department stated that North Korea generates substantial revenue by deploying IT workers who fraudulently obtain employment with companies worldwide, including in the technology and virtual currency sectors.

Recently, a crypto investigator reported that 'multiple projects' were likely exploited due to the hiring of North Korean IT workers as developers. Although the Treasury Department's release mentioned past crypto project hacks, it did not specify any particular projects or include crypto wallets in its sanctions list. However, it noted that the department had previously sanctioned the Lazarus Group, which has been linked to several crypto hacks, including the $625 million theft from Axie Infinity and the $1.5 billion hack of Bybit.

The US Treasury Department emphasized that North Korean IT workers often work on virtual currency projects and use crypto exchanges and trading platforms to manage and launder funds. Ari Redbord, the global head of policy and government affairs at TRM Labs, stated that embedded IT workers 'have served as on-ramps to both illicit revenue generation and eventual intrusion activity, particularly in the crypto space.' He noted that the explicit reference to North Korean IT workers operating out of China and Russia indicates a 'growing alignment' between the DPRK and certain jurisdictions. Redbord added that the designation of Song represents the operational layer behind these schemes, highlighting the importance of disrupting such networks.