Treasury Stays on Offensive Against North Korean Cybercrime, Laundering Efforts

The U.S. Department of the Treasury remains busy as the close of 2024 fast approaches. Last week, the Treasury’s Office of Foreign Assets Control (OFAC) – the department’s financial intelligence and enforcement agency tasked with enforcing economic and trade sanctions in support of domestic national security and foreign policy objectives – levied sanctions against two individuals and one entity connected to a major North Korean money laundering network. This growing network was found to have laundered millions of dollars worth of illicit funds obtained by the Democratic People’s Republic of Korea (DPRK) pilfered by information technology specialists via various means of cybercrime.

A Treasury press release indicated that the two sanctioned individuals operate on behalf of a front company based in the United Arab Emirates (UAE). The individuals in question – Lu Huaying and Zhang Jian –were discovered to have facilitated cross-border money laundering and cryptocurrency conversion services that ultimately funneled the illicit proceeds back to the North Korean government to supplement additional fundraising efforts taken by the regime in wake of the heavy international sanctions that remain present against them. North Korea has developed into one of the most heavily-sanctioned countries in the world for a multitude of reasons, namely human rights violations and its unchecked ballistic weapons development programs. Tensions have grown between the DPRK and the United States and its allies accordingly over the past decade given the constant threat posed by its impulsive leader Kim Jong-Un.

To circumvent these crippling international sanctions, the DPRK has developed a skilled team of technicians who engage in fraudulent activity online to generate revenue and keep the aforementioned government-backed operations afloat. Several years ago, the “FinCEN Files” – a collaborative project with the International Consortium of Investigative Journalists, BuzzFeed News, NBC News and more than 400 other journalists around the world which examined a treasure trove of suspicious activity reports filed by banks with the Treasury Department’s Financial Crimes Enforcement Network – revealed that North Korea had long targeted American banks, including prominent names such as JPMorgan Chase and Bank of New York Mellon, to carry out elaborate money laundering schemes utilizing a string of shell companies and assistance from Chinese firms. FinCEN ultimately conceded that North Korean operatives and other rogue actors were successfully able to launder hundreds of millions of dollars worth of illicit cash through American financial institutions from 2008 to 2017 – a period that included the imposition and tightening of sanctions on the DPRK by the respective Obama and Trump presidential administrations. All told, this discovery ultimately led to a significant overhaul of money laundering rules for financial firms across the United States, with new safeguards now growing to include the development of a beneficial ownership registry to curb illicit finance through the misuse of shell companies.

In the time since these regulatory changes were implemented, the bulk of North Korea’s schemes have revolved around hacking cryptocurrency exchanges and stealing from unsuspecting individuals across these various platforms. Given the growth of the crypto market over recent years, these ventures have proven quite fruitful for the Kim regime. For example, as recently as 2022 one of the DPRK affiliated tech groups made off with a whopping $620 million in a single virtual currency heist, with the bulk of these funds ultimately funneled into North Korea’s weapons programs. In describing the crimes of the newly-sanctioned individuals, the Treasury writes that PRC national Lu Huaying had cashed out cryptocurrency derived from obfuscated DPRK revenue-generation projects into fiat cash on behalf of OFAC-sanctioned Sim Hyon Sop. Between early 2022 and September 2023, Lu Huaying was found to have laundered several million dollars of Sim Hyon Sop’s money himself through a combination of cryptocurrency cash-outs and money mules, with the laundered funds then used as payment for purchases of products and services assessed to be destined for use by the DPRK or its proxies.¹ His counterpart, Zhang Jian, had also helped to facilitate the exchange of fiat currency for Sim, with Zhang himself acting as a courier for Sim Hyon Sop on multiple occasions. The men used an LLC coined “Green Alpine Trading” as the front company to provide their services. Given their decision to act on behalf of the heavily-sanctioned Sim Hyon Sip, who himself was sanctioned for being a major figure in additional efforts to finance the DPRK’s development of weapons of mass destruction, OFAC officially designated these individuals last week. Hyon-Sop remains at large with a federal arrest warrant outstanding after he was charged with Conspiracy to Commit Bank Fraud, Conspiracy to Violate and Violations of International Emergency Economic Powers Act, North Korean Sanctions Regulations, Conspiracy to Launder Monetary Instruments, and Laundering Monetary Instruments in March of 2023.

As a result of the sanctions, all property and interests in property of the sanctioned persons that are in the U.S. or in the possession or control of U.S. persons must be blocked and reported to OFAC. Also, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. The only exempt U.S. persons, and exempt persons located within the U.S., with transactions involving property or interests related to the blocked persons are those that have waivers specifically from OFAC designating as such. In addition, financial institutions or individuals who choose to engage in transactions with the sanctioned persons or entity anyway may also be subject to enforcement action. These prohibited transactions include the contribution or provision of funds, goods, or services by, to, or for the benefit of any designated person, or the receipt of any contribution or provision of funds, goods or services from any such person. The sanctions also place restrictions on persons outside the United States, Non-U.S. persons may not conspire with U.S. persons wittingly or unwittingly to violate U.S. sanctions or engage in conduct to aid anyone to circumvent sanctions already in place.

Summarizing the actions, Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence Bradley T. Smith stated, “As the DPRK continues to use complex criminal schemes to fund its WMD and ballistic missile programs—including through the exploitation of digital assets—Treasury remains focused on disrupting the networks that facilitate this flow of funds to the regime.”¹ Smith continued, “The United States, along with the UAE and our other partners, will continue to target the financial networks that enable the Kim regime’s destabilizing activities.”¹

Citations

1. “Treasury Disrupts North Korean Digital Assets Money Laundering Network.” U.S. Department of the Treasury, 17 Dec. 2024.