North Korean hackers are suspected of involvement in the theft of Poloniex and CoinsPaid platforms

The Department of Justice has moved to formally request the forfeiture of more than $15.10 million of USDT seized from North Korean hackers linked to the APT38 military cyber unit. The money was recovered earlier this year after the FBI traced stolen assets from a number of hacks of exchanges and payment platforms in 2023.
The Department of Justice filed two civil forfeiture petitions seeking court approval to retain the seized assets and eventually return them to the victims. Investigators said the stolen USDTs were related to the 2023 operation of APT38 Unit, which targeted four offshore virtual currency platforms. The FBI seized the funds in March 2025 after tracing the money laundering path through currency mixers, cross-chain bridges, brokers over the counter and offshore exchanges.
Although the Department of Justice did not name the hacked platform in Friday's statement, the timing and amount point to several high-profile incidents: the theft of more than $100 million from the Poloniex platform in November 2023, the theft of $37 million from the CoinsPaid platform in July 2023, the theft of about $100 million from the Alphapo platform in the same month, and the unconfirmed theft of $138 million from a Panama exchange in late 2023.
The Department of Justice said in a statement that as hackers continue to attempt to launder funds through cross-chain tools, efforts to track down and confiscate additional virtual currencies from APT38 Force operations are ongoing.