TLDR

• The US Treasury has sanctioned two individuals, Lu Huaying and Zhang Jian, for allegedly laundering cryptocurrency for North Korea through a UAE front company.
• The sanctions freeze assets and prohibit Americans from doing business with the sanctioned individuals and their company, Green Alpine Trading LLC.
• North Korean hackers, including Lazarus Group, are increasingly targeting the crypto sector, including potential Bitcoin ETF companies.
• Treasury highlighted ongoing efforts to disrupt North Korea’s money laundering operations that finance weapons and missile programs.
• FBI Warns of Sophisticated Social Engineering Campaigns by North Korean Actors Against DeFi and ETF-Related Targets

The US Treasury Department announced new sanctions on Tuesday against two individuals suspected of being involved in a cryptocurrency money laundering operation linked to North Korea. The sanctions target Lu Huaying and Zhang Jian, who authorities say operated a network that converted digital assets into cash for the North Korean regime.

According to the Treasury’s Office of Foreign Assets Control, both individuals used a front company called Green Alpine Trading LLC, based in the United Arab Emirates, to facilitate their operations. The UAE government provided assistance in identifying and targeting these individuals, demonstrating international cooperation in combating North Korean financial networks.

The sanctions immediately freeze all U.S. assets owned by Huaying and Jian and prohibit U.S. citizens and companies from doing business with them or their companies. This action is part of Treasury’s broader strategy to disrupt North Korea’s ability to finance its weapons and missile programs through cryptocurrency.

Acting Undersecretary Bradley T. Smith noted that North Korea uses complex criminal schemes to support its missile program, with digital assets playing an increasingly important role in these operations. The Treasury announcement comes as authorities see an increase in sophisticated cyber operations by North Korean actors.

The FBI recently warned that North Korean cybercriminals are perfecting their tactics, including targeting companies involved in cryptocurrency exchange-traded funds (ETFs). These attacks often involve elaborate social engineering campaigns designed to be harder to detect, demonstrating an evolution in their approach to cybertheft.

North Korean hacker groups, particularly the Lazarus Group, have established a trend of targeting cryptocurrency exchanges and platforms. These groups allegedly used various tools, including mixing services like Tornado Cash, to disguise the movement of stolen funds.

Blockchain analysts and researchers have documented numerous cases of North Korea-linked hackers targeting cryptocurrency exchanges. Their investigations reveal complex networks used to convert stolen digital assets into currency usable by the regime.

Treasury’s action builds on previous efforts to counter North Korean cyber operations. Previous investigations have shown that these hacking groups managed to steal billions of dollars worth of cryptocurrency through various attacks on exchanges and DeFi platforms.

The newly sanctioned individuals are believed to have played a crucial role in converting cryptocurrency into traditional currency, providing a vital service for North Korean operations. The use of a shell company based in the United Arab Emirates highlights the international nature of these money laundering networks.

Recent blockchain analysis suggests that North Korean hackers have become more sophisticated in their approaches to cryptocurrency laundering. On-chain sleuth ZachXBT detailed how the Lazarus Group processed over $200 million in hacked crypto funds, converting them into fiat currency through complex schemes.

The Treasury announcement notes that North Korean actors continue to adapt their methods as authorities implement new countermeasures. These adaptations include the use of multiple layers of shell companies and sophisticated trading techniques to avoid detection.

The involvement of traditional financial institutions in these schemes remains a concern for the authorities. The Treasury statement said North Korean operators often attempt to integrate their cryptocurrency operations with legitimate financial networks.

These sanctions are part of a broader set of actions against North Korea. Just a day before this announcement, the United States implemented additional sanctions targeting North Korean banks and North Korean officials involved in supporting Russian military operations in Ukraine.

The Treasury stressed the importance of international cooperation to address these threats. Collaboration with UAE authorities in this matter demonstrates the global nature of the threat and response to North Korean financial operations.

The most recent evidence shows that North Korean cyber operations continue to actively target the cryptocurrency sector, with particular interest in organizations involved in the growing institutional adoption of digital assets.