North Korea’s IT-worker money on chain: a wallet changed every fortnight, ether staked with a mainstream provider, and 96 ETH nobody can freeze

On 12 March 2026 OFAC, the Treasury’s sanctions office, designated six people and two entities for their part in North Korea’s IT-worker schemes, which the Treasury says brought in nearly $800 million in 2024 for the country’s weapons programmes. The entries carry addresses on Ethereum, Tron and Bitcoin. They belong, according to OFAC, to Sim Hyon Sop, a representative of a North Korean bank who has been on the list since April 2023 and whose entry was extended; to Amnokgang Technology Development Company, which manages teams of IT workers abroad; and to two facilitators, Yun Song Guk and Hoang Minh Quang.

Who the addresses belong to is OFAC’s statement, not ours. Below is what they did on chain, read on 8 October 2026. On Ethereum we count only real USDT and USDC, checked by token contract.

The six Tron addresses newly added to Sim Hyon Sop’s entry were not used at the same time. The first worked from 22 June to 21 July 2025. The second from 23 to 30 July. The third from 29 August to 15 September. The fourth from 16 to 29 September. The fifth from 28 September to 2 October. The sixth from 2 to 16 October. Each was emptied before, or as, the next took over.

Together they received 987,350 USDT. About a fifth came from a cross-chain bridge and an instant-swap service, some from exchange withdrawal wallets. All of it went on to wallets that carry no label.

The last of the six went quiet on 16 October 2025. They were listed, and blacklisted by Tether, on 12 March 2026 — five months later. Every one of them was empty.

Sim’s older Ethereum address, 0x4f47bc496083c727c5fbe3ce9cdf2b0f6496270c, was first listed in April 2023. Its history is finished, and it is the largest in this case: 24.07 million in USDT and USDC between August 2021 and March 2023.

17.70 million of that — 74% — arrived directly from Binance’s withdrawal wallets. In other words, most of the money was sent to him from accounts at one exchange. On the way out, 12.66 million went to a single unlabelled address in 78 transfers between February and October 2022, and about 2.4 million to deposit addresses at Binance.

Nothing has moved there since. We include it because it shows what the rotation on Tron replaced: one address used for nineteen months, then listed, then six addresses used for a few weeks each.

Amnokgang’s four Tron addresses received 4.91 million USDT from 119 senders between March 2023 and January 2026. About 1.27 million came from MEXC’s withdrawal wallet and 0.47 million from Binance’s. On the way out, some went to exchange wallets — 444,000 to KuCoin, 230,000 to MEXC — and most to unlabelled addresses.

The largest of the four, TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7, was blacklisted by Tether on 4 December 2025 — three months before OFAC published it. Between 4 and 15 December five more payments, 28,849 USDT, arrived from MEXC’s withdrawal wallet and were frozen on arrival: somebody kept withdrawing from the exchange into an address that was already dead. The wallet holds 86,958 USDT today; with 316 USDT on a second address, that is everything frozen in this case.

The other three were blacklisted with the rest on 12 March 2026 at 17:55–17:56 UTC.

Amnokgang’s main Ethereum address, 0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573, did something we have not seen on a sanctioned address before: it earned yield in the open. It swapped stablecoins into ether on Uniswap in late 2023, and on 2 October 2024 staked 106 ETH through a mainstream liquid-staking service. It took 36 ETH back in November, staked 36 again in March 2025, and withdrew everything, 108.09 ETH, on 23 July 2025. In May and June 2025 it also put about 140,000 USDT into a yield vault.

Nothing suggests the staking service knew whose address it was; the address was not on any list at the time. That is the point. For most of two years the money sat in ordinary DeFi products, indistinguishable from any other customer’s.

After the withdrawal it sent 13 ETH to another address in the same OFAC entry. 96.06 ETH is still there today, seven months after the listing. Tether can freeze USDT; nobody can freeze ether. The address is sanctioned, the coins are not stuck.

Three things stand out. A careful operator now changes wallets faster than a listing can follow: by the time six addresses were published, their owner was five months past them. Exchanges are on both ends — most of the money on the 2023 address came out of one exchange, and money was still coming out of another into a frozen wallet. And native ether is outside the reach of the freeze that works on stablecoins.

In our database all the listed addresses carry the sanctions label from OFAC’s list, and an address that traded with them shows that link as its risk. You can check any address on the address check page. Other sanctions cases read the same way: Iran’s exchangers, Tren de Aragua, ISIS-K and Hamas-linked wallets.

It does not say who owns any address beyond repeating OFAC’s attribution. It does not say that the exchanges, the staking service or anyone who sent or received money knew whom they were dealing with or broke any rule. It covers USDT and USDC on Tron and Ethereum and native ether on one address; the Bitcoin address (0.58 BTC over its lifetime) and the Arbitrum and BNB Chain entries are outside it. Exchange and service names refer to wallets labelled as theirs in our database.