DPRK Crypto Laundering: OTC Conversion, Front Companies and IT-Worker Proceeds

DPRK crypto laundering uses over-the-counter traders to turn stolen assets into purchasing money, while IT workers generate a separate stream of earnings through jobs obtained under false identities, according to federal indictments. The alleged schemes cheat exchange victims and employers who think they are paying workers hired under their real identities. An employer sees a salary payment. A broker sees a conversion request. A supplier sees money for goods. The insider who knows who directed that payment can connect parts of the scheme that a wallet address leaves out.

DPRK Crypto Laundering Starts With Different Sources of Money

The indictments announced in April 2023 described separate conspiracies involving a representative of North Korea’s Foreign Trade Bank. One concerned cryptocurrency stolen from exchanges and used to buy goods. The other concerned earnings from IT work obtained under fake identities. Both allegedly generated revenue for the North Korean government.

In the employment conspiracy, the indictment alleged that North Korean IT workers obtained jobs at blockchain development companies, including companies in the United States. They used false identity documents and virtual private networks to hide their location from hiring platforms and payment facilitators. They asked for payment in cryptocurrency, including USDT and USDC, stablecoins pegged to the U.S. dollar, and funneled their earnings back through the bank representative.

For the employer, the connection is between the person presented during hiring, the work being paid for and the destination of the pay.

The Justice Department’s June 2025 account of its civil complaint described unwitting employers paying salaries to workers whose real identities and locations had been concealed. The complaint alleged that workers then moved the earnings through accounts opened under fictitious identities, small transfers, chain hopping between blockchains and token swapping between virtual currencies. It also described purchases of non-fungible tokens to hold and hide value, and commingling proceeds to obscure their origin.

How OTC Conversion Pays for Goods

OTC conversion connects cryptocurrency to the money a seller accepts. In the stolen-asset conspiracy, the indictment alleged that over-the-counter traders helped turn exchange-hack proceeds into U.S. dollar payments for goods purchased through Hong Kong front companies on North Korea’s behalf.

The alleged arrangement had assigned roles. The Foreign Trade Bank representative directed payments through an intermediary. That intermediary recruited over-the-counter traders to find front companies and facilitate the payments. The person ordering the purchase, the trader moving value and the company receiving the money were different participants in the transaction.

For an over-the-counter desk, this makes the payment instruction as consequential as the incoming cryptocurrency. Who asked for the conversion? Which company was supposed to receive dollars? What purchase did the payment fund? We connect those commercial questions to the transaction trail with an insider who knows the business.

The conversion record connects the payment for goods to the cryptocurrency that funded it. Alongside the invoice and bank transfer, it can show how stolen digital assets paid for goods through a business front.

The supplier or payment counterparty may know the buyer, the instructions and the transaction the broker was asked to fund.

A separate indictment announced that day charged one of the over-the-counter traders with operating an unlicensed money transmitting business on a U.S.-based cryptocurrency exchange. It alleged that the trader conducted over 1,500 trades for U.S. customers without the necessary licenses. The separate charge placed a trader in this alleged network on a U.S. exchange, where customer accounts could hold part of the trail.

North Korean IT Worker Proceeds and Front Company Banking Records

North Korean IT worker proceeds and front company banking records answer different parts of the inquiry: who earned the money, who controlled its movement and which business received it. We connect the employer’s hiring and payment information to the exchange and banking records, keeping the worker-income and purchasing channels distinct.

The civil complaint described an additional intermediary in the employment channel. The government alleged that the chief executive of Chinyong, also known as Jinyong IT Cooperation Company, sent worker funds to the Foreign Trade Bank representative. Chinyong employed delegations of North Korean IT workers abroad and was subordinate to North Korea’s Ministry of Defense. The allegation gives the earnings a path from workers to an IT company executive and then to a banking representative.

The employer sees the identity used to obtain work and the instructions for paying it. The exchange can hold the customer account credited with the cryptocurrency. The bank can hold information about a business receiving ordinary currency. A person inside one of those businesses may know why the payment went to that particular account.

Laptop Farms: The Computer Was in the United States

A separate criminal indictment described how domestic facilitators helped make remote workers appear to be working in the United States. In its October 13, 2026 announcement, the Justice Department said the alleged scheme affected more than 70 U.S. company employers.

According to that indictment, workers used stolen or fabricated identity documents, virtual private networks and proxy infrastructure. U.S.-based facilitators received employer-issued laptops at their homes, configured them, installed remote-access software and transferred earnings to DPRK-controlled accounts. The company sent its equipment to an American home. The worker it thought it had hired was using that equipment from somewhere else.

The department identified employers in health care, communications, cyber support, retail and manufacturing. The alleged scheme reached well beyond blockchain businesses. In the same announcement, the department described laptop farms using laptops and keyboard, video and mouse devices, known as KVM devices.

For an insider in hiring, IT operations or payments, the laptop recipient, the person doing the work and the account receiving earnings connect the employment story to the money. We examine those connections with the people who understand them.

DPRK Crypto Laundering and OTC Broker Conversion Evidence

OTC broker conversion evidence in DPRK crypto laundering connects the incoming asset, the customer behind it, the conversion and the outgoing payment. A public transaction hash shows a transfer. The exchange’s internal ledger can show whose account received the credit, while payment instructions identify where the customer wanted the value sent.

That difference reflects how the business operates. An exchange can record transfers between customers internally without a separate public-chain transaction for each movement.

The useful inquiry follows the work each intermediary performed. Who controlled the wallet? Who executed the trade? Who could approve the dollar payment? Customer-identification information, account ownership, transaction purpose and screening decisions can sit in different systems, held by different businesses.

That is why an insider’s explanation matters alongside a tracing report. A compliance employee may know what an alert identified and who decided to proceed. An operations employee may know who supplied the payment instructions. A manager may know why the business accepted a counterparty after concerns reached the people able to act.

We assess those connections with you, using the records of the business itself. The question is what the institution knew when it accepted, converted or transmitted the value, and who made the decision.

Huione and the Banks Behind the Conversion

Huione shows how a conversion business can connect DPRK-linked cryptocurrency to the banking system. In its final rule concerning Huione Group, the Treasury’s Financial Crimes Enforcement Network identified at least $37.6 million in cryptocurrency received from DPRK cyber actors stemming from DPRK-attributed heists.

The agency also described a DPRK national with deep ties to the country’s foreign intelligence organization working with Huione Pay PLC officials to transfer cryptocurrency and ordinary currency. The agency assessed that senior Huione Pay leadership knew of the person’s DPRK affiliation. It described conversion into ordinary currency and an effort to arrange a dollar remittance to Hong Kong.

The agency described personal relationships with officials, help moving money and leadership’s knowledge of the counterparty. The people handling the conversion were part of the story.

The Financial Crimes Enforcement Network’s broader analysis identified at least $4 billion in illicit proceeds of all kinds received by Huione Group between August 2021 and January 2025.

The rule, effective November 17, 2025, prohibited covered U.S. financial institutions from opening or maintaining correspondent accounts for Huione Group. It also required safeguards against Huione transactions passing through accounts held for foreign banks.

For a bank insider, the downstream customer matters. A transaction involving Huione could reach a U.S. institution through a foreign bank’s account. The Financial Crimes Enforcement Network’s measure addressed that indirect access as well as accounts held for Huione itself. The banking relationship and the customer behind the payment belong in the same examination.

Can a Whistleblower Report Money Laundering?

Yes. The anti-money laundering whistleblower program covers information about Bank Secrecy Act violations and covered sanctions violations. We assess the institution, the conduct and the insider’s knowledge together, including what the business did with information already in its hands.

Under the program’s award law, qualifying whistleblowers can collectively receive 10% to 30% of qualifying collections from covered enforcement actions exceeding $1 million. We assess how that reward opportunity fits what you know about the payments and the institution.

The Hudson Institute’s 2021 paper Countering Global Kleptocracy: A New US Strategy for Fighting Authoritarian Corruption explains why a whistleblower can matter when a financial institution is complicit in, or negligent toward, laundering:

In this setting, that witness may understand the instruction behind a payment, the real customer behind an account or the decision behind a screening override. We use that knowledge to build the case around what the institution knew and did.

For fraud against the government, we assess the appropriate whistleblower route with you. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

When You Know Who Directed the Payment

If you work for an employer, exchange, over-the-counter desk or bank and know who stood behind these payments, talk to our whistleblower experts about the people directing the money. We turn your knowledge of the payments and the decisions behind them into a case, bringing in money laundering whistleblower lawyers who understand cryptocurrency and sanctions. Our experts stay beside you from the first conversation through pursuing your strongest case.