U.S. Treasury Sanctions Two Individuals Linked to North Korean Crypto Laundering

TLDR

• U.S. Treasury sanctioned two individuals, Lu Huaying and Zhang Jian, for allegedly laundering cryptocurrency for North Korea through a UAE front company
• The sanctions freeze assets and prohibit Americans from doing business with the sanctioned individuals and their company, Green Alpine Trading LLC
• North Korean hackers, including Lazarus Group, are increasingly targeting crypto sector including potential Bitcoin ETF companies
• The Treasury highlighted ongoing efforts to disrupt North Korea’s money laundering operations that fund weapons and missile programs
• FBI warns of sophisticated social engineering campaigns by North Korean actors against DeFi and ETF-related targets

The U.S. Treasury Department announced new sanctions Tuesday against two individuals allegedly involved in a cryptocurrency money laundering operation linked to North Korea. The sanctions target Lu Huaying and Zhang Jian, who authorities say operated a network that converted digital assets into cash for the North Korean regime.

According to the Treasury’s Office of Foreign Assets Control, the two individuals used a front company called Green Alpine Trading LLC, based in the United Arab Emirates, to facilitate their operations. The UAE government provided assistance in identifying and targeting these individuals, demonstrating international cooperation in addressing North Korean financial networks.

The sanctions immediately freeze any U.S.-based assets belonging to Huaying and Jian and prohibit American citizens and companies from conducting business with them or their company. This action represents part of the Treasury’s broader strategy to disrupt North Korea’s ability to fund its weapons and missile programs through cryptocurrency.

Acting Under Secretary Bradley T. Smith emphasized that North Korea employs complex criminal schemes to support its missile program, with digital assets playing an increasingly important role in these operations. The Treasury’s announcement comes as authorities note a rise in sophisticated cyber operations from North Korean actors.

The FBI recently warned that North Korean cybercriminals are advancing their tactics, particularly in targeting companies involved with cryptocurrency exchange-traded funds (ETFs). These attacks often involve elaborate social engineering campaigns designed to be harder to detect, showing an evolution in their approach to cyber theft.

North Korean hacker groups, particularly the Lazarus Group, have established a pattern of targeting cryptocurrency exchanges and platforms. These groups have allegedly used various tools, including mixing services like Tornado Cash, to obscure the movement of stolen funds.

Blockchain analysts and researchers have documented numerous instances of North Korean-linked hackers targeting cryptocurrency exchanges. Their investigations reveal complex networks used to convert stolen digital assets into usable currency for the regime.

The Treasury’s action builds on previous efforts to counter North Korean cyber operations. Earlier investigations have shown that these hacking groups have managed to steal billions of dollars worth of cryptocurrency through various attacks on exchanges and DeFi platforms.

The newly sanctioned individuals allegedly played a crucial role in converting cryptocurrency into traditional currency, providing a vital service for North Korean operations. The use of a UAE-based front company highlights the international nature of these money laundering networks.

Recent blockchain analysis suggests that North Korean hackers have become more sophisticated in their approaches to laundering cryptocurrency. On-chain sleuth ZachXBT detailed how the Lazarus Group processed over $200 million in hacked crypto funds, converting them into fiat currency through complex schemes.

The Treasury’s announcement notes that North Korean actors continue to adapt their methods as authorities implement new countermeasures. These adaptations include using multiple layers of front companies and sophisticated trading techniques to avoid detection.

The involvement of traditional financial institutions in these schemes remains a concern for authorities. The Treasury’s statement indicates that North Korean operators often attempt to integrate their cryptocurrency operations with legitimate financial networks.

These sanctions come as part of a broader set of actions against North Korea. Just one day before this announcement, the U.S. implemented additional sanctions targeting North Korean banks and officials involved in supporting Russia’s military operations in Ukraine.

The Treasury emphasized the importance of international cooperation in addressing these threats. The collaboration with UAE authorities in this case demonstrates the global nature of both the threat and the response to North Korean financial operations.

The most recent evidence shows that North Korean cyber operations continue to target the cryptocurrency sector actively, with particular interest in organizations involved in the growing institutional adoption of digital assets.