U.S. Sanctions 3 North Koreans for Supporting Hacking Group Known for Crypto Thefts

The three were engaged in crypto activities themselves, and the U.S. Treasury Department says they were tied to the networks of DPRK entities laundering stolen crypto or moving illicit funds for that country.

AccessTimeIconApr 24, 2023 at 2:33 p.m. UTC
Updated Apr 24, 2023 at 5:45 p.m. UTC

The U.S. Treasury Department's sanctions watchdog banned three North Korean individuals for supporting the Lazarus Group, a North Korean hacking team known for crypto thefts that U.S. authorities say have been used to support the nation's weapons program.

Two of the sanctioned individuals, Cheng Hung Man and Wu Huihui, were over-the-counter (OTC) traders who facilitated crypto transactions for Lazarus, the agency said, while a third person, Sim Hyon Sop, provided other financial support. The Treasury investigation identified several bitcoin addresses associated with Wu, while tying an ether, arbitrum and Binance chain address to Sim.

“The DPRK continues to exploit virtual currency and extensive illicit facilitation networks to access the international financial system and generate revenue for the regime,” said Brian Nelson, the department's undersecretary for terrorism and financial intelligence, in a statement, referring to the official name of North Korea.

The Lazarus Group has been accused of mounting a multibillion-dollar campaign against the crypto world, the proceeds of which are said to fund North Korea's weapons program. The Treasury says the hacker group is controlled by North Korea's intelligence organization, the Reconnaissance General Bureau, and it was behind the largest-ever crypto heist when it stole $625 million in digital assets from the Ronin network tied to the Axie Infinity game.

The U.S. Department of Justice later charged Sim with conspiracy for his work with the OTC traders.

UPDATE (April 24, 2023, 14:40 UTC): Adds names and allegations.

UPDATE (April 24, 2023, 15:00 UTC): Adds comments from a Treasury Department official.

UPDATE (April 24, 2023, 15:28 UTC): Adds detail on digital asset addresses.

UPDATE (April 24, 2023, 17:45 UTC): Adds DOJ charge.

Edited by Nikhilesh De.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Nikhilesh De

Nikhilesh De is CoinDesk's managing editor for global policy and regulation. He owns marginal amounts of bitcoin and ether.

Jesse Hamilton

Jesse Hamilton is CoinDesk's deputy managing editor for global policy and regulation. He doesn't hold any crypto.