A U.S. federal court has ordered the forfeiture of roughly $212,700 in stablecoins linked to wages earned by North Korean IT workers, giving the Justice Department a partial victory in its attempt to seize more than $7.74 million in digital assets tied to an alleged sanctions evasion network.
NK News reported on Sept. 7 that U.S. District Judge Rudolph Contreras ruled that funds seized from a crypto wallet beginning with “0x81c4” should be forfeited to the U.S. government. The Sept. 3 ruling granted part of the Justice Department’s request for default judgment while rejecting its attempt to immediately take control of other assets included in the case.
Prosecutors said the wallet received approximately 158,123 $USDC from at least 10 addresses used to receive payments for North Korean IT workers and another 54,574 $USDT from at least four worker payment addresses. The two dollar-pegged stablecoins had a combined face value of roughly $212,700.
The government argued that the funds were proceeds of a scheme in which North Korean workers obtained overseas IT jobs, concealed their identities and locations, and routed their earnings through cryptocurrency before money was ultimately sent toward North Korea.
U.S. court approves $212,700 North Korea crypto forfeiture
Contreras found that prosecutors had provided enough information to establish how the 0x81c4 wallet was connected to the alleged operation.
The court said the government’s allegations described a wire fraud and money laundering operation involving foreign entities that conducted transactions on behalf of sanctioned individuals in violation of the International Emergency Economic Powers Act.
For the purpose of the default judgment, the allegations were sufficient to establish that the seized funds constituted or were derived from proceeds traceable to those violations. Contreras therefore entered judgment in favor of the United States for the assets seized from the wallet.
The ruling covered only part of a substantially larger pool of assets targeted by federal prosecutors.
The Justice Department filed its civil forfeiture complaint in June 2025 seeking more than $7.74 million in cryptocurrency and other digital property allegedly generated and laundered through North Korean overseas IT employment schemes.
As crypto.news previously reported, the assets had initially been restrained in connection with an April 2023 indictment of Sim Hyon Sop, a representative of North Korea’s Foreign Trade Bank accused of working with IT workers to move crypto earnings back toward the country.
The complaint covered cryptocurrency, non-fungible tokens and Ethereum Name Service domains. Prosecutors said some of the funds had been frozen or seized while North Korean workers and their associates were attempting to launder the proceeds.
Contreras did not grant forfeiture of the remaining property. The judge found that the government had not adequately identified the other assets in its public forfeiture notice and denied that part of the request without prejudice, leaving prosecutors able to return with another request.
North Korean IT workers allegedly used stablecoins for salaries
The Justice Department has accused North Korea of deploying IT workers around the world to obtain employment at technology and blockchain companies, sometimes using fraudulent identification documents and other methods to hide their nationality and physical location.
Employers who were unaware of their identities then paid the workers for legitimate IT work, often using stablecoins such as $USDC and $USDT, according to the department.
Prosecutors said the workers used several methods to obscure where their crypto came from before sending funds toward North Korea. The alleged techniques included moving money in smaller amounts, using accounts opened under false identities, swapping tokens, moving assets between blockchains, buying NFTs and mixing employment proceeds with other funds.
U.S. authorities have continued targeting the people and infrastructure accused of supporting those operations. In March, the Treasury Department sanctioned a network that it said helped North Korean workers obtain overseas jobs using false personas and stolen identities before cryptocurrency was used to transfer or launder their earnings.
Investigators have separately traced the employment strategy into crypto development teams. An Ethereum Foundation-backed investigation disclosed in April identified 100 suspected DPRK operatives working within crypto companies, while the Ketman Project alerted 53 teams after examining developer identities and GitHub activity.
Security researcher and MetaMask developer Taylor Monahan said in a separate investigation that North Korean-linked developers had worked inside DeFi projects over several years, with the activity extending back to the early period of decentralized finance.
The risk has continued into 2026. Consensys temporarily halted product releases in July after discovering that a consultant linked to North Korea had gained access to its systems for roughly one month. The company’s investigation found no evidence that assets or data had been stolen or that malicious code had been introduced.
Sim Hyon Sop and Kim Sang Man remain tied to U.S. case
The forfeiture complaint identified Sim and Kim Sang Man as intermediaries who allegedly helped move earnings generated by overseas workers.
Sim served as a representative of North Korea’s Foreign Trade Bank, which has been sanctioned by the United States over its links to the country’s weapons programs. The Treasury Department placed Sim on its Specially Designated Nationals list in April 2023.
According to the Justice Department, North Korean IT workers sent funds to Sim after laundering their earnings. Prosecutors have accused him of participating in schemes involving workers who obtained employment at companies in the United States and elsewhere and of working with over-the-counter cryptocurrency traders to use illicit funds to acquire goods for North Korea.
Kim was sanctioned the following month along with Chinyong, also known as Jinyong IT Cooperation Company. U.S. authorities identify him as the chief executive of Chinyong, which is subordinate to North Korea’s Ministry of Defense and employs delegations of IT workers operating overseas.
Prosecutors said Kim served as an intermediary between those workers and the Foreign Trade Bank by transferring funds from workers to Sim. Chinyong delegations have operated in countries including Russia and Laos, according to the Justice Department.
U.S. authorities have previously linked Kim to crypto transactions involving overseas workers. An earlier investigation found that a suspected North Korean IT worker operating under the alias “Light Fury” transferred more than $300,000 from a public Ethereum Name Service address to Kim.
The Justice Department’s June 2025 complaint said the property targeted for forfeiture consisted of funds generated by North Korean IT workers, including people who had been unknowingly employed by U.S.-based companies, before proceeds were sent to Kim or Sim for the benefit of the North Korean government.