Free tools Windows power users keep installed
One-click scans. No signup required.
On August 27, 2025, the U.S. Treasury Department sanctioned four people and entities it said supported a North Korean government-orchestrated IT-worker operation. Treasury cited nearly $600,000 in cryptocurrency-to-dollar transfers allegedly facilitated by two people, and separately reported more than $1 million in profits generated since 2021 by an overseas worker delegation. The figures describe different parts of the network; they are not a finding of $1.6 million in stolen cryptocurrency.
For U.S. employers, the case is also a warning about fraudulent remote hiring: an apparently qualified developer may use a false identity or location to obtain company access, while U.S.-based facilitators help conceal where the work is being done. Treasury’s announcement describes the sanctions action; the FBI has separately warned that some such workers have used access for data theft or extortion.
What Treasury sanctioned
The August 27, 2025 action targeted a network Treasury said supported North Korean revenue generation linked to weapons programs. It designated two individuals and two entities:
| Person or entity | Treasury’s description | Designation basis described by Treasury |
|---|---|---|
| Vitaliy Sergeyevich Andreyev | Russian national who allegedly facilitated payments to Chinyong and worked with Kim Ung Sun on cryptocurrency-to-dollar conversions. | Executive Order 13687, for materially assisting, sponsoring, or providing financial, material, or technological support to Chinyong. |
| Kim Ung Sun | Russia-based Democratic People’s Republic of Korea (DPRK) economic and trade consular official who allegedly worked with Andreyev on transfers. | Executive Order 13687, for acting or purporting to act for or on behalf of the Government of North Korea. |
| Shenyang Geumpungri Network Technology Co., Ltd. | A Chinese front company, according to Treasury, consisting of a delegation of DPRK IT workers and serving Chinyong. | Treasury cited its ownership or control relationship with Chinyong, or its role acting on Chinyong’s behalf. |
| Korea Sinjin Trading Corporation | A DPRK company Treasury said was subordinate to the Ministry of People’s Armed Forces General Political Bureau and received government directives about overseas IT workers. | Designated as part of the network Treasury described in the announcement. |
The action expanded on an earlier designation of Chinyong Information Technology Cooperation Company, which Treasury described as associated with the DPRK defense ministry and as deploying IT-worker delegations in countries including Russia and Laos. See Treasury’s account of the designations.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Why the $600,000 and $1 million figures are different
Treasury described two amounts with different subjects and time periods. Neither should be treated as the total proceeds of the entire operation.
| Amount | What Treasury said it measures | Period |
|---|---|---|
| Nearly $600,000 | Multiple transfers allegedly facilitated by Andreyev and Kim through cryptocurrency-to-U.S.-dollar conversions. | Since at least December 2024. |
| More than $1 million | Profits generated by the Shenyang Geumpungri IT-worker delegation for Chinyong and Sinjin. | Since 2021. |
The first is a transfer figure associated with two facilitators; the second is a multi-year profit figure attributed to the worker delegation and related entities. Treasury did not say that they are additive, that all the profits were cryptocurrency, or that every dollar came from U.S. companies. Calling the combined amount “$1.6 million in stolen crypto” would go beyond the announcement. Treasury’s release is the source for both figures.
How fraudulent remote work can generate revenue and access
False identities and intermediaries
U.S. authorities describe workers and facilitators using stolen U.S. identities, forged or altered documents, false names and nationalities, alias email accounts, fabricated social profiles, fake company websites, job-platform accounts, and intermediary businesses. A worker can be technically capable and still be participating in a fraudulent employment arrangement: technical skill does not establish the worker’s identity, location, or authority to work under the name presented.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
The Justice Department’s nationwide enforcement announcement describes these broader tactics. In a separate indictment announcement, DOJ described a multi-year operation involving North Korean nationals and U.S.-based facilitators; an indictment is an allegation, not a conviction. See DOJ’s indictment announcement.
Laptop farms and remote access
In a recurring arrangement described by DOJ, a U.S.-based intermediary receives an employer-issued laptop and hosts it at a residence or other location. An overseas worker then accesses the machine remotely, making activity appear to originate in the United States. This can defeat a location check that relies only on the computer’s apparent network location. The laptop host may also supply an address, identity, or other logistical support.
Payment and conversion
Some workers are paid through ordinary payroll or freelance channels, while intermediaries help move proceeds across borders. Cryptocurrency can be used for settlement or conversion, but it is only one possible part of the financial chain. A blockchain transaction may be visible while the real-world person controlling a wallet remains difficult to identify; the August action specifically described conversions and transfers, not simply anonymous on-chain payments. Treasury has also described other DPRK-linked networks using over-the-counter cryptocurrency traders and fiat conversion services: Treasury release and Treasury release.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
What happens after a fraudulent hire
Employment fraud and cyber exploitation are related risks, but they are not interchangeable: authorities do not say every DPRK IT worker deploys malware or steals data. The FBI has warned that in some cases workers have used access for:
- theft or exfiltration of proprietary data and source code;
- unauthorized remote access or malware deployment;
- data extortion; and
- theft of cryptocurrency or other valuable digital assets.
The FBI’s January 23, 2025 advisory discusses these behaviors and recommends stronger identity and hiring controls: FBI advisory. DOJ has announced separate cases involving different alleged schemes, including more than $900,000 in digital assets stolen after workers obtained employment at a blockchain research company; that amount is not part of Treasury’s $600,000 transfer figure. See DOJ announcement.
Recommended Free Tools
What an OFAC designation means for U.S. businesses
The Office of Foreign Assets Control (OFAC) designation is an administrative sanctions measure, not a criminal conviction. Under the sanctions described in Treasury’s announcement, property and interests in property of designated persons or entities that are in the United States, or within the possession or control of U.S. persons, are blocked. U.S. persons are generally prohibited from transactions involving blocked property unless OFAC authorizes them. Consult Treasury’s announcement and applicable OFAC rules for the specific legal obligations.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
For employers, payment providers, and financial institutions, the relevant issue is not whether a counterparty is Chinese or Russian by itself. It is whether a designated person or entity, blocked property, or otherwise prohibited activity is involved and whether the transaction falls within U.S. sanctions jurisdiction. Businesses may need to review counterparties and intermediaries, ownership and control, payment instructions, and any relevant accounts or assets. Sanctions screening should not be limited to the name on a contract.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the August action fits the wider campaign
Treasury’s August 2025 action was one step in a wider, multiagency effort, not a stand-alone case. Treasury announced earlier actions on January 14, July 8, and July 24, 2025, followed by another action in November 2025. The releases describe evolving networks and should not be read as a single case or a single set of proceeds: January action, July 8 action, July 24 action, and November action.
On March 12, 2026, Treasury announced sanctions on six individuals and two entities in another IT-worker-related action. That release cited nearly $800 million generated in 2024 by DPRK government-orchestrated schemes as a broader estimate; it is not the amount attributed to the August 2025 network. See Treasury’s March 2026 announcement.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Practical controls for employers
Before hiring
- Verify identity using more than one independent source, and compare documents with employment, tax, and payment records.
- Check whether the claimed location aligns across interviews, payroll, device delivery, and network information. A mismatch calls for review, not an automatic accusation.
- Investigate inconsistencies in names, addresses, work history, phone numbers, or online profiles; thin or polished profiles alone are not proof of fraud.
- Verify staffing agencies, subcontractors, and worker-supply vendors independently, including who will actually perform the work.
- Do not rely on a video interview as sole proof of identity. The FBI has warned that AI or face-swapping technology may be used to conceal a candidate’s identity; automated detection also can produce false positives.
- Collect only identity data needed for verification, restrict access to it, and establish retention rules.
At onboarding and during employment
- Ship devices only to verified addresses and retain direct control of devices during onboarding.
- Enroll devices in endpoint management before granting access; prohibit unauthorized remote desktop and remote-management software.
- Use hardware-backed authentication where practical, separate contractor and production environments, and grant the least access needed.
- Monitor for unexpected countries, impossible travel, unusual login patterns, residential proxy use, and unapproved remote-access tools.
- Review changes to payroll details, requests for cryptocurrency payment, and third-party payment instructions rather than treating any one of them as proof of wrongdoing.
- Restrict access to source repositories, cloud credentials, signing keys, production systems, and customer data. Require code review and separation of duties for sensitive work.
- Preserve identity, device, authentication, repository, cloud, and payment logs.
Remote administration can be legitimate. The escalation signal is unauthorized or unlogged access inconsistent with the role—not merely the presence of remote-access software. Likewise, cryptocurrency payment requests and location inconsistencies merit scrutiny but are not, in isolation, proof of DPRK involvement.
If you suspect an incident
- Restrict or suspend the account while preserving evidence; avoid actions that destroy logs or device data.
- Isolate the assigned device and preserve forensic images.
- Revoke active tokens, credentials, SSH and API keys, and session cookies.
- Review lateral movement, repository access, and cloud activity; check for copying, compression, encryption, or exfiltration of company data.
- Contact legal counsel, incident-response specialists, relevant financial institutions, and the FBI. The FBI advisory directs questions to local field offices: FBI advisory.
- Screen relevant counterparties and wallets against current sanctions information where applicable, and assess any payment or blocking obligations with qualified counsel.
What the case means for personal finance and business risk
For a small company, the practical exposure may be lost payroll, compromised code or customer information, response costs, or a sanctions problem involving a payment chain—not just cryptocurrency theft. Identity checks, controlled device access, and limited permissions are hiring and cybersecurity safeguards at the same time. More verification can reduce fraud risk but also means handling sensitive personal data; location checks can catch inconsistencies but should not penalize legitimate cross-border work without further review.
Separate DOJ matters show that U.S.-based facilitators can face criminal consequences when prosecutors allege they knowingly supplied identities, hosted laptops, installed unauthorized remote-access software, or helped workers bypass vetting. A later sentencing announcement described a separate case involving more than $5 million in illicit revenue and at least 80 stolen U.S. identities; those figures are not part of the Treasury action discussed here. See DOJ’s sentencing announcement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
