North Korean Nationals Charged in Georgia for $1 Million Crypto Theft from Blockchain Firms

According to the U.S. Department of Justice (DOJ), Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il concealed their North Korean citizenship by posing as freelance developers using stolen and fabricated identities. The group initially operated out of the United Arab Emirates in 2019 before landing jobs at an Atlanta-based blockchain startup and a Serbian virtual token company between late 2020 and mid-2021.

Source: FBI

Prosecutors stated that Kim and Jong submitted fraudulent documents to secure these positions, enabling them to access critical internal systems. U.S. Attorney Theodore S. Hertzberg described the tactic as a “unique threat” for companies hiring remote IT staff.

Once employed, the defendants exploited their insider access. In February 2022, Jong siphoned approximately $175,000 worth of crypto from company systems. The following month, Kim manipulated the smart contract source code to steal approximately $740,000. Investigators said the stolen funds were laundered through crypto mixers and sent to exchange accounts controlled by Kang and Chang, which had been created with fake Malaysian IDs.

The charges were filed under the DOJ’s DPRK RevGen: Domestic Enabler Initiative, launched in 2024 to dismantle North Korea’s revenue-generating operations and their US-based enablers.

In a related crackdown, federal agents recently conducted coordinated raids across 16 states, seizing nearly 30 financial accounts, around 200 computers from “laptop farms,” and over 20 fraudulent websites. Additionally, the U.S. DOJ launched an investigation into a data breach at Coinbase involving contracted customer service agents based in India, who allegedly accepted bribes to grant unauthorized access to sensitive user data.

Just last month, the DOJ filed a civil forfeiture complaint to seize over $7.7 million in crypto allegedly earned by North Korean IT operatives posing as remote blockchain developers through similar identity fraud schemes.