DOJ secured five guilty pleas and seized more cryptocurrency tied to North Korean cyber schemes. The defendants helped place fraudulent IT workers into U.S. jobs, use stolen identities, and hide workers' locations while laundering proceeds. Authorities announced an additional $15 million in USDT linked to APT38 and earlier recovered $80 million from pig-butchering scam operations. Officials say victims will be compensated from seized funds, though the fate of assets for proposed federal crypto reserves remains uncertain.
DOJ Disrupts North Korea’s Crypto Network — Guilty Pleas, $15M in USDT Seized and $80M Recovered from Scam Rings
DOJ secured five guilty pleas and seized more cryptocurrency tied to North Korean cyber schemes. The defendants helped place fraudulent IT workers into U.S. jobs, use stolen identities, and hide workers' locations while laundering proceeds. Authorities announced an additional $15 million in USDT linked to APT38 and earlier recovered $80 million from pig-butchering scam operations. Officials say victims will be compensated from seized funds, though the fate of assets for proposed federal crypto reserves remains uncertain.
08:23 AM, 11/15/2025Security
DOJ Wins Guilty Pleas, Seizes More Cryptocurrency Linked to North Korean Hacks
The U.S. Department of Justice announced it secured several guilty pleas and confiscated additional cryptocurrency assets as part of an ongoing effort to dismantle schemes run by the Democratic People's Republic of Korea (DPRK) to generate funds through illicit activity.
Fraudulent IT Placements and Identity Theft
The five guilty pleas involve individuals who helped place fraudulent information-technology workers into U.S. jobs, obtain stolen U.S. identities for those workers, and obscure their geographic origins while the employees collected pay from dozens of U.S. companies. These operations allowed ill-gotten funds to flow to DPRK-linked actors while evading sanctions.
"Probes conducted by the Federal Bureau of Investigation continue to expose the North Korean government's relentless campaign to evade U.S. sanctions and generate millions of dollars to fund its authoritarian regime and weapons programs," said Assistant Director Roman Rozhavsky of the FBI’s counterintelligence division. He urged companies to strengthen vetting of remote hires to counter this trend.
Crypto Seizures and APT38
Authorities also reported an additional seizure of roughly $15 million in Tether (USDT) tied to North Korean sources. The assets are linked to cyber heists attributed to the group known as Advanced Persistent Threat 38 (APT38), which U.S. officials allege has ties to the North Korean military.
Scam Center Strike Force and Pig-Butchering Operations
Earlier in the week, the DOJ and partner federal agencies launched a coordinated "Scam Center Strike Force" to target the centers behind so-called pig-butchering scams — romance/fraud schemes often concentrated in Southeast Asia and frequently run by transnational criminal groups. That effort recovered about $80 million in stolen funds, and the DOJ said victims will be compensated from seized assets.
Where the Seized Crypto Might Go
It remains unclear how much of the newly seized cryptocurrency will be funneled into the asset reserves the Trump administration has proposed. The administration has been developing a bitcoin strategic reserve for BTC seized in criminal and civil forfeitures and has directed creation of a separate reserve for other digital assets. Officials working on those reserves have indicated that formalizing the plan may require action from Congress.
Implications: The recent convictions and seizures highlight the evolving nexus between state-sponsored cybercrime and global cryptocurrency markets. Companies should tighten remote-worker vetting and financial institutions must continue collaborating with law enforcement to trace and seize illicit digital assets.