The U.S. Department of Justice (DOJ) has accelerated its sweeping campaign against North Korea’s sprawling cyber-enabled financial networks, announcing a new series of criminal convictions and another major digital asset seizure tied to the regime’s illicit revenue operations. In a statement released Friday, federal officials reported the confiscation of an additional $15 million in Tether (USDT) linked to cyberattacks conducted by groups associated with the Democratic People’s Republic of Korea (DPRK), specifically the notorious Advanced Persistent Threat 38 (APT38).
The coordinated law-enforcement push, involving the DOJ, Federal Bureau of Investigation (FBI), and other federal agencies, highlights the ongoing escalation in the U.S. government’s effort to dismantle North Korea’s globally dispersed schemes that exploit cryptocurrency ecosystems, stolen identities, and foreign-labor loopholes to circumvent sanctions and generate critical funding for its weapons programs.
Criminal Network Helping DPRK IT Workers Infiltrate U.S. Companies Exposed
Among the major developments were five guilty pleas from individuals charged with facilitating North Korea’s covert global IT-worker program. For years, DPRK has deployed skilled technology workers abroad—often posing as South Koreans, Americans, or remote freelancers in unrelated countries—to secretly earn revenue in hard currency.
According to DOJ officials, these workers infiltrated dozens of U.S. companies, taking remote IT positions using stolen and falsified American identities. Domestic accomplices helped procure these identities, establish payroll accounts, mask IP addresses, and route earnings back to North Korea’s government.
Assistant Director Roman Rozhavsky of the FBI’s Counterintelligence Division emphasized the severity of the threat, stating that U.S. investigations “continue to expose the North Korean government’s relentless campaign to evade sanctions and generate millions of dollars to fund its authoritarian regime and weapons programs.” He urged American companies—especially those dependent on remote workforces—to strengthen their verification processes, monitor anomalies in hiring, and adopt stricter cybersecurity measures.
$15 Million More in USDT Seized—Part of a Growing Wave of Digital Asset Confiscations
The newly seized $15 million in USDT marks yet another significant addition to the federal government’s expanding trove of confiscated digital assets. The funds are directly connected to cyber heists executed by APT38, a division of North Korea’s state-sponsored Lazarus Group, infamous for orchestrating some of the biggest hacks in cryptocurrency history.
APT38 is believed to have targeted a range of DeFi platforms, exchanges, and blockchain bridges around the world, siphoning hundreds of millions of dollars since 2016. The group is known for its sophisticated laundering strategies, using mixers, chain-hopping, and overseas facilitators to obscure connections to the DPRK government.
Federal officials believe Friday’s seizure is part of an ongoing series of asset recoveries expected to continue as investigators follow digital trails across global exchanges and centralized wallets.
Parallel Crackdown on Pig-Butchering Scams Adds Another $80 Million in Recoveries
The DOJ also highlighted progress against a separate category of cyber-enabled fraud: pig-butchering scams, large-scale online romance and investment scams typically run by criminal organizations in Southeast Asia. Earlier this week, U.S. law enforcement unveiled a new initiative—the Scam Center Strike Force—dedicated to tracking, raiding, and dismantling the physical compounds where many of these scams are operated.
Authorities reported the recovery of another $80 million in stolen funds, much of which will eventually be returned to scam victims. These operations revealed complex money-laundering pipelines, often incorporating cryptocurrency for rapid cross-border transfers and anonymity.
Uncertainty Around the Future of U.S. Digital Asset Reserves
One of the unanswered questions following these new seizures concerns the future of the assets themselves. Under current procedures, seized crypto can be auctioned off or liquidated, with some portion redirected toward victim compensation or general government revenue.
However, the Trump administration has proposed a transformational shift: establishing two permanent U.S. digital asset reserves—
- A Bitcoin Strategic Reserve to store all BTC obtained via criminal or civil forfeiture.
- A Digital Asset Reserve for all non-bitcoin crypto such as Ethereum, USDT, and other tokens.
These reserves would function somewhat like strategic commodity stockpiles, potentially giving the U.S. government a long-term stake in blockchain ecosystems while preserving seized value for future use.
Officials involved in designing these reserves have suggested that congressional authorization may still be required before the reserves can be formally implemented, leaving the final disposition of newly seized funds undecided.
A Growing Financial Front in the U.S.–DPRK Conflict
The latest developments underline a broader strategic shift: the enforcement landscape between the U.S. and North Korea has increasingly moved into cryptocurrency infrastructure, where hackers, launderers, false IT workers, and fraud networks operate across borders with unprecedented speed.
Federal agencies have repeatedly warned that the DPRK treats cybercrime as a central financial lifeline, generating revenue that supports its ballistic missile development, nuclear programs, and the survival of its heavily sanctioned economy.
The investigations show no signs of slowing. As crypto adoption grows globally—and as North Korea continues to exploit the space—U.S. authorities appear determined to cut off one of the regime’s most profitable and elusive revenue streams.
