The charges relate to, ultimately, the evasion of US sanctions against North Korea but they are also indicative of, for example, money laundering through trade, the equivalent of the Black Market Peso Exchange scheme that really needs to be renamed.

North Korean national SIM, Chinese national WU Huihu , Hong Kong British National (Overseas) CHENG Hung Man, and the as yet unidentified user of the online moniker live:jammychen0150 (“Jammy Chen”) conspired to launder stolen cryptocurrency and then used those funds to purchase goods through Hong Kong-based front companies on behalf of North Korea.

“Today’s indictments reveal North Korea’s continued use of various means to circumvent U.S. sanctions,” said U.S. Attorney Matthew M. Graves for the District of Columbia.

SIM swapping

The first indictment involves a conspiracy between SIM and three OTC traders to launder stolen funds from virtual currency exchange hacks to make payments in U.S. dollars for goods on behalf of the North Korean government. SIM swapped crypto for USD.

The second involves a conspiracy between SIM and various North Korean IT workers to launder proceeds of illegal IT development work, where the IT workers gained employment at U.S. blockchain development companies using fake identities and then laundered their ill-gotten gains through SIM for the benefit of the North Korean regime, and in contravention of sanctions imposed against North Korea by the Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the United Nations. Those sanctions were imposed to impede the development of North Korea’s ballistic missiles, weapons production and research and development programs.

Source: US DOJ; edited

SIM is also accused of conspiracy to launder funds generated by North Korean IT workers who obtained illegal employment in the tech and crypto industry. These IT workers used fake personas to get jobs, including jobs at U.S.-based companies, and then asked to be paid in cryptocurrencies, such as stablecoins like USD Tether (USDT) and USD Coin (USDC), which are pegged to the U.S. dollar. After receiving payment, they funnelled their earnings back to North Korea through Sim.

The "ill-gotten gains" appear to be the salaries that the North Korean workers were paid as a result of their employment. The DoJ does not appear to be alleging that they were involved in any form of criminal activity other than obtaining employment by deception.

All over the world, North Korean workers are forced to hand over their salaries to representatives of the North Korean government, keeping only a tiny percentage with which to support themselves and their families.

The DoJ links the activity of this group to that of North Korea's Lazarus and other cybercrime units.

The DoJ says: to generate revenue for the regime, North Korea also deploys IT workers to obtain illegal employment in the cryptocurrency industry. According to court documents, North Koreans apply for jobs in remote IT development work without disclosing that they are North Korean. These IT workers bypass security and due diligence checks through the false or fraudulent use of identity documents and other obfuscation strategies, such as virtual private networks to hide their true location from online payment facilitators and hiring platforms. The IT workers request payment for their services in virtual currency and then send their earnings back to North Korea via, among other methods, representatives such as SIM."

Unlike the specific workers refered to above, SIM has been connected to cybercrime: "Since 2017, as part of its cyber campaign, North Korean hackers have also executed virtual currency-related thefts to generate revenue for the regime, including through the hacking of virtual asset services providers, such as virtual currency exchanges. A portion of the proceeds from those virtual currency theft and fraud schemes was sent to virtual currency address 1G3Qj4Y4trA8S64zHFsaD5GtiSwX19qwFv, which SIM and his OTC trader conspirators used to fund payments for goods for North Korea."