A U.S. federal court has ordered the forfeiture of $212,700 in stablecoins linked to wages earned by North Korean overseas IT workers, according to reports from NK News. U.S. District Judge Rudolph Contreras ruled on September 3 that funds seized from a crypto wallet beginning with '0x81c4' should be forfeited to the U.S. government. The ruling granted part of the Justice Department's request for default judgment while rejecting its attempt to immediately take control of other assets included in the case.
The seized wallet held 158,123 USDC and 54,574 USDT that prosecutors traced to payment addresses used by at least 14 workers, as reported by NK News. The two dollar-pegged stablecoins had a combined face value of roughly $212,700. The government argued that the funds were proceeds of a scheme where North Korean workers obtained overseas IT jobs, concealed their identities and locations, and routed their earnings through cryptocurrency before money was ultimately sent toward North Korea. The court found prosecutors had provided enough information to establish how the 0x81c4 wallet was connected to the alleged operation.
The ruling covers only part of a substantially larger pool of assets targeted by federal prosecutors. According to crypto.news, the Justice Department filed its civil forfeiture complaint in June 2025 seeking more than $7.74 million in cryptocurrency and other digital property allegedly generated and laundered through North Korean overseas IT employment schemes. The assets had initially been restrained in connection with an April 2023 indictment of Sim Hyon Sop, a representative of North Korea's Foreign Trade Bank accused of working with IT workers to move crypto earnings back toward the country.
The Justice Department has accused North Korea of deploying IT workers around the world to obtain employment at technology and blockchain companies, sometimes using fraudulent identification documents and other methods to hide their nationality and physical location, as reported by crypto.news. Employers who were unaware of their identities then paid the workers for legitimate IT work, often using stablecoins such as USDC and USDT. Prosecutors said the workers used several methods to obscure where their crypto came from before sending funds toward North Korea, including moving money in smaller amounts, using accounts opened under false identities, swapping tokens, and buying NFTs.
The forfeiture complaint identified Sim Hyon Sop and Kim Sang Man as intermediaries who allegedly helped move earnings generated by overseas workers, according to crypto.news. Sim served as a representative of North Korea's Foreign Trade Bank and was placed on the Treasury Department's Specially Designated Nationals list in April 2023. Kim was sanctioned along with Chinyong, identified as the chief executive of a company subordinate to North Korea's Ministry of Defense that employs delegations of IT workers operating overseas. U.S. authorities have previously linked Kim to crypto transactions involving overseas workers, with an earlier investigation finding that a suspected North Korean IT worker transferred more than $300,000 to Kim.
