U.S. Sanctions 3 North Koreans for Supporting Hacking Group Known for Crypto Thefts

The U.S. Treasury Department's sanctions watchdog banned three North Korean individuals for supporting the Lazarus Group, a North Korean hacking team known for crypto thefts that U.S. authorities say have been used to support the nation's weapons program.

Two of the sanctioned individuals, Cheng Hung Man and Wu Huihui, were over-the-counter (OTC) traders who facilitated crypto transactions for Lazarus, the agency said, while a third person, Sim Hyon Sop, provided other financial support. The Treasury investigation identified several bitcoin addresses associated with Wu, while tying an ether, arbitrum and Binance chain address to Sim.

“The DPRK continues to exploit virtual currency and extensive illicit facilitation networks to access the international financial system and generate revenue for the regime,” said Brian Nelson, the department's undersecretary for terrorism and financial intelligence, in a statement, referring to the official name of North Korea.

The Lazarus Group has been accused of mounting a multibillion-dollar campaign against the crypto world, the proceeds of which are said to fund North Korea's weapons program. The Treasury says the hacker group is controlled by North Korea's intelligence organization, the Reconnaissance General Bureau, and it was behind the largest-ever crypto heist when it stole $625 million in digital assets from the Ronin network tied to the Axie Infinity game.

The U.S. Department of Justice later charged Sim with conspiracy for his work with the OTC traders.

UPDATE (April 24, 2023, 14:40 UTC): Adds names and allegations.

UPDATE (April 24, 2023, 15:00 UTC): Adds comments from a Treasury Department official.

UPDATE (April 24, 2023, 15:28 UTC): Adds detail on digital asset addresses.

UPDATE (April 24, 2023, 17:45 UTC): Adds DOJ charge.