Department of Justice seeks to confiscate over $15 million cryptocurrency stolen and laundered by North Korean hackers

The Department of Justice announced today that it has obtained five plea agreements and initiated civil forfeiture actions in excess of $15 million for the Democratic People's Republic of Korea (DPRK) for illicit income derived from remote information technology (IT) work and virtual currency theft. The North Korean government used both to fund its weapons programs and other key areas in violation of international sanctions.
According to court documents related to the plea agreement, American and Ukrainian facilitators helped North Korean personnel obtain remote IT jobs at American companies through false means. For example, the facilitators provided their own, false or stolen identities and placed laptops provided by the victim American companies in private homes across the country to create the illusion that North Korean IT workers were working in the United States.
Overall, the defendants' fraudulent employment scheme impacted more than 136 U.S. victimized businesses, generated more than $2.20 million in revenue for the North Korean regime, and resulted in the identity theft of more than 18 Americans.
A North Korean military hacking group known to the private sector as "APT38" carried out multimillion-dollar hacking attacks on four overseas virtual currency platforms in 2023, according to two civil forfeiture lawsuits. As APT38 members continued to launder their ill-gotten gains, the U.S. government froze and seized more than $15 million in virtual currency and sought to eventually return it to its rightful owners.