A U.S. federal court has ordered the seizure and forfeiture of approximately $212,700 worth of cryptocurrency connected to an alleged North Korean IT worker network accused of hiding earnings and moving funds through digital assets.
The ruling represents a partial victory for the U.S. Department of Justice (DOJ), which has been attempting to recover more than $7.74 million in cryptocurrency and digital assets allegedly linked to a sanctions evasion operation.
The seized assets included:
- 158,123 USDC
- 54,574 USDT
Both stablecoins were traced by prosecutors to cryptocurrency addresses allegedly used to receive payments connected to North Korean overseas IT workers.
Court Approves Seizure of USDC and USDT Wallet Funds
U.S. District Judge Rudolph Contreras approved the forfeiture of funds held in a cryptocurrency wallet identified by the address beginning with “0x81c4.”
Prosecutors argued that the wallet received:
- USDC payments from at least 10 addresses connected to worker payment activity
- USDT payments from at least four additional addresses
The government claimed these funds represented proceeds from a scheme where North Korean workers obtained overseas technology jobs while concealing their identities and locations.
The earnings were allegedly moved through cryptocurrency channels before being transferred toward North Korea.
DOJ Case Targets Larger Crypto Network
The court decision only covers a portion of the assets targeted by U.S. prosecutors.
The Department of Justice originally filed a civil forfeiture complaint in 2025 seeking control of more than $7.74 million in cryptocurrency and other digital property allegedly connected to North Korean overseas IT employment operations.
The investigation involved assets including:
- Cryptocurrency holdings
- NFTs
- Ethereum Name Service domains
Authorities alleged that some assets were frozen while individuals involved in the operation attempted to move or conceal the funds.
Judge Rejects Some Asset Claims Due to Identification Issues
While the court approved the forfeiture of the $212,700 in stablecoins, it did not approve the seizure of all assets requested by prosecutors.
Judge Contreras ruled that the government had not sufficiently identified some additional assets in its public forfeiture notices.
The rejected portion was denied without prejudice, meaning prosecutors may return with additional evidence and request forfeiture again in the future.
How North Korean IT Workers Allegedly Used Crypto Payments
U.S. authorities have accused North Korea of operating international IT worker networks designed to generate foreign income while avoiding sanctions.
According to prosecutors, these workers allegedly:
- Used false identities
- Misrepresented their locations
- Obtained employment with international technology companies
- Received salaries through cryptocurrency payments
Many employers reportedly believed they were hiring legitimate remote workers.
Stablecoins such as USDC and USDT were allegedly used because they provide faster international transfers compared with traditional banking systems.
Crypto Laundering Methods Under Investigation
Authorities claim that funds linked to these operations were moved through several techniques designed to make tracing more difficult.
The alleged methods included:
- Breaking transactions into smaller amounts
- Using accounts registered under false identities
- Swapping cryptocurrencies
- Moving assets across multiple blockchains
- Purchasing NFTs
- Mixing employment income with other funds
Blockchain records allow investigators to track transactions across public networks, making cryptocurrency both a tool for criminals and a source of evidence for law enforcement.
U.S. Authorities Continue Targeting North Korean Crypto Networks
The U.S. government has increased efforts to disrupt networks accused of helping North Korea generate revenue through cyber activities and overseas employment schemes.
Previous investigations have targeted individuals and organizations allegedly involved in:
- Crypto laundering
- Fraudulent employment operations
- Identity manipulation
- Sanctions violations
In separate investigations, security researchers have also examined suspected North Korean developers working inside cryptocurrency and blockchain projects.
Sim Hyon Sop and Kim Sang Man Remain Connected to Case
The forfeiture complaint identified Sim Hyon Sop and Kim Sang Man as alleged intermediaries involved in moving funds generated by overseas workers.
Sim was identified by U.S. authorities as a representative of North Korea’s Foreign Trade Bank, an entity previously sanctioned by the United States.
Authorities accused him of helping move cryptocurrency earnings connected to overseas IT workers.
Kim Sang Man was also sanctioned and identified as being connected with Chinyong, a North Korean organization associated with overseas IT worker operations.
Prosecutors allege that Kim acted as a link between workers and financial channels used to transfer funds.
Blockchain Transparency Helps Investigators Track Crypto Funds
Although criminals may attempt to hide cryptocurrency movements, blockchain transactions remain permanently recorded on public networks.
Investigators can use blockchain analysis tools to:
- Follow transaction histories
- Identify wallet relationships
- Connect addresses with real-world entities
- Build evidence for legal proceedings
The case demonstrates how cryptocurrency investigations increasingly combine traditional law enforcement methods with blockchain forensic technology.
The U.S. court’s decision to seize $212,700 in USDC and USDT highlights the growing role of cryptocurrency investigations in national security and sanctions enforcement.
While the ruling only covers a small portion of the assets targeted by prosecutors, it demonstrates how authorities are using blockchain analysis and legal forfeiture procedures to recover digital funds linked to alleged illegal activity.
As cryptocurrency adoption grows, governments worldwide are developing more advanced systems to track, investigate, and manage digital assets connected to criminal networks.
