A United States federal court has ordered the forfeiture of roughly 212,700 USD in stablecoins linked to wages earned by North Korean IT workers, handing the Justice Department a partial but symbolically important win in its effort to seize more than 7.74 million USD in digital assets tied to an alleged sanctions evasion network.
NK News reported on September 7 that US District Judge Rudolph Contreras ruled that funds seized from a crypto wallet beginning with the characters 0x81c4 should be forfeited to the US government. The September 3 ruling granted part of the Justice Department’s request for default judgment, while rejecting its attempt to immediately take control of other assets named in the case.
## What the Court Found
Prosecutors said the wallet received approximately 158,123 USDC from at least 10 addresses used to receive payments for North Korean IT workers, plus another 54,574 USDT from at least four worker payment addresses. The two dollar-pegged stablecoins carried a combined face value of roughly 212,700 USD.
The government argued the funds were proceeds of a scheme in which North Korean workers obtained overseas IT jobs, concealed their identities and locations, and routed earnings through cryptocurrency before money was ultimately sent toward North Korea.
Contreras found that prosecutors had provided enough detail to establish how the 0x81c4 wallet connected to the alleged operation. The court described the underlying allegations as a wire fraud and money laundering operation involving foreign entities conducting transactions on behalf of sanctioned individuals in violation of the International Emergency Economic Powers Act. For purposes of the default judgment, that was sufficient to establish the seized funds were traceable proceeds.
## A Partial Win Inside a Bigger Case
The ruling covers only a slice of a much larger pool. The Justice Department filed its civil forfeiture complaint in June 2025, seeking more than 7.74 million USD in cryptocurrency and other digital property allegedly generated and laundered through North Korean overseas IT employment schemes.
The assets had initially been restrained in connection with an April 2023 indictment of Sim Hyon Sop, a representative of North Korea’s Foreign Trade Bank accused of working with IT workers to move crypto earnings back to the country. The complaint covered cryptocurrency, non-fungible tokens and Ethereum Name Service domains, with some funds frozen mid-laundering.
Notably, Contreras denied forfeiture of the remaining property because the government had not adequately identified the other assets in its public notice — a denial without prejudice, meaning prosecutors can come back with a better-specified request.
## How the Salary Pipeline Works
The Justice Department says North Korea deploys IT workers worldwide to take jobs at technology and blockchain companies, sometimes using fraudulent identification documents to hide nationality and location. Unwitting employers paid them for legitimate work — often in stablecoins like USDC and USDT.
Workers then obscured the origin of funds through a familiar laundering playbook: splitting money into smaller amounts, using accounts opened under false identities, swapping tokens, bridging assets between blockchains, buying NFTs and mixing employment proceeds with other funds.
Enforcement pressure has continued. In March, the Treasury Department sanctioned a network it said helped North Korean workers obtain overseas jobs with false personas before their earnings were transferred or laundered in cryptocurrency.
Investigators have also traced the strategy inside crypto development teams. An Ethereum Foundation-backed investigation disclosed in April identified 100 suspected DPRK operatives working within crypto companies, while the Ketman Project alerted 53 teams after examining developer identities and GitHub activity. Security researcher and MetaMask developer Taylor Monahan has warned that North Korean-linked developers operated inside DeFi projects for years, reaching back to early decentralized finance.
The risk has carried into 2026. Consensys temporarily halted product releases in July after discovering a consultant linked to North Korea had accessed its systems for roughly one month, though the investigation found no evidence of asset theft, data theft or malicious code.
## The Intermediaries: Sim and Kim
The forfeiture complaint identified Sim Hyon Sop and Kim Sang Man as the intermediaries moving worker earnings.
Sim served as a representative of North Korea’s Foreign Trade Bank, sanctioned by the US over links to the country’s weapons programs, and was placed on Treasury’s Specially Designated Nationals list in April 2023. Prosecutors accuse him of participating in schemes involving workers employed at companies in the United States and elsewhere, and of working with over-the-counter crypto traders to convert illicit funds into goods for North Korea.
Kim was sanctioned the following month along with Chinyong, also known as Jinyong IT Cooperation Company, which US authorities identify as subordinate to North Korea’s Ministry of Defense and a supplier of overseas IT worker delegations. Kim allegedly served as the conduit between those workers and the Foreign Trade Bank by transferring funds to Sim. Chinyong delegations have operated in countries including Russia and Laos.
An earlier investigation found a suspected North Korean IT worker using the alias Light Fury transferred more than 300,000 USD from a public Ethereum Name Service address to Kim.
The June 2025 complaint framed the targeted property as funds generated by North Korean IT workers — including people unknowingly employed by US companies — before proceeds were sent to Kim or Sim for the benefit of the North Korean government. Tuesday’s ruling does not end that case; it simply converts the first clearly identified wallet into government property, and puts the rest of the 7.74 million USD back on the government’s docket to prove.
contreras granted the 212,700 from wallet 0x81c4 but denied the rest because DOJ didnt properly identify the assets in its public notice. paperwork matters lol
denial was without prejudice tho, they just refile with better descriptions. the 7.74M is still on the table
refiling with better descriptions still takes months. meanwhile whoever ran 0x81c4 has moved the rest through fresh wallets ages ago. DOJ wins the headline, not the funds
shuffled through fresh wallets sure, but stablecoin rails mean every hop is on chain forever. they moved custody, they didnt move the evidence
evidence moved with them tho. circle can freeze USDC the moment treasury asks, hopping wallets buys time, not safety
the 0x81c4 cluster is already mapped though. when DOJ refiles with the wallet tracing attached, Contreras grants it, six months tops
refiling takes months and those wallets will be long drained by then. DOJ moves at court speed, the NK handlers move at telegram speed
true but circle froze the 0x81c4 cluster within days of the filing, that rail is dead for pyongyang now. the USDT half of the 7.74M is the slow part
wild part is these IT workers apparently passed interviews at real companies for years. zero video calls, fake linkedins, and nobody clocked it until treasury started tracing the payroll
some of those fake linkedins used headshots scraped from stock photo sites. one wallet tied to a guy who apparently held three full time remote jobs at once lol
held three remote jobs at once and code review caught less than a bank KYC would have. committing to three repos on the same timezone pattern, nobody flagged it
ketman flagged 53 teams and the EF-backed probe found 100 suspected DPRK operatives inside crypto companies. remote dev background checks are basically theater
53 teams is just what ketman caught. EF probe counted 100 suspected operatives still inside crypto firms, so the real headcount is way past that
100 suspected operatives and firms still run the same takehome assignment hiring loop. the interview process is the actual attack surface here, not the wallets
212k out of 7.74 mil and DOJ already doing victory laps. thats like 3% of the pot lol
What convinced the judge was the tracing: the 0x81c4 wallet pulled 158k USDC from at least 10 worker payout addresses. Stablecoins leave the paper trail banks used to.
^ its a default judgment tho, nobody even showed up to contest it. easy win, wouldnt read much into it
the 212k is pocket change next to the 7.74M ask but its the first time a default judgment actually stuck to DPRK wage funds. precedent matters more than the number here
everyone fixates on the 212k but Contreras denying the rest of the 7.74M ask is the real story. DOJ has to actually trace each wallet, default judgment alone didnt cut it
158k USDC traced through ten payment addresses into one wallet and the total haul is 212k. The other side of that ledger is still payroll for a weapons program, this is a rounding error dressed as a win
the split always got me, 158k USDC from ten payout addresses but only 54k USDT from four. workers clearly got paid easier on one rail than the other
the USDC split makes sense tho. easier to freeze USDT once its flagged, circle compliance has been snappy since they got heat. the USDC rail was the leak
circle compliance being snappy only matters after blacklisting. the workers cycled fresh addresses for months before anyone connected the dots, the freeze was always a lagging indicator
dude held three full time remote dev jobs on the same commit schedule and none of the employers compared notes. background checks are pure theater
212k out of 7.74M and its being framed as a win. took a default judgment to get even that much from wallet 0x81c4, imagine if anyone had actually shown up to contest it
a default judgment means nobody even showed up to contest it. the legal bar was the floor and they still only got 212k. paperwork copium
copium or not, the filing itself is the template. every wallet cluster like 0x81c4 they map in public makes the 7.74M refile harder to wave off, judges read prior tracing too