DOJ Seizes $15M in Crypto from APT38, Unveils Guilty Pleas in North Korean IT Worker Fraud Scheme

According to the DOJ, a sweeping multinational enforcement action saw five guilty pleas and more than $15 million in civil forfeiture actions tied to North Korea’s illicit remote IT-worker programmes and large-scale cryptocurrency thefts. The schemes, run by the DPRK government and linked to APT38, aimed to fund the regime’s weapons programmes in violation of sanctions.

U.S.-based and Ukrainian facilitators helped North Korean IT workers obtain remote employment at over 136 U.S. companies, generating more than $2.2 million for the DPRK, with facilitators providing false identities, hosting laptops, and aiding vetting. The press release notes that APT38 “carried out multimillion-dollar virtual currency heists at four overseas virtual currency platforms in 2023” and that the U.S. government froze and seized more than $15 million worth of virtual currency for forfeiture.

The DOJ filed two forfeiture complaints targeting over 15 million USDT seized from APT38 operators in March 2025, while several individuals, including Audricus Phagnasay, Jason Salazar, Alexander Paul Travis, Oleksandr Didenko, and Erick Ntekereze Prince, admitted to related offences.