A North Korean military hacking group known as Advanced Persistent Threat 38 carried out multimillion-dollar virtual currency heists at four overseas platforms in 2023.
The Department of Justice froze and seized more than $15 million in virtual currency that prosecutors now seek to forfeit for return to the rightful owners.
Investigators say APT38 continues to move currency through bridges, mixers, exchanges, and over-the-counter traders.
The Department filed two civil complaints to forfeit USDT, a virtual currency stablecoin pegged to the U.S. dollar, that the FBI seized in March 2025 from the group.
One complaint filed on Oct. 24, 2025, seeks forfeiture of 1,159,834.52 USDT, and a second complaint filed Friday seeks forfeiture of 13,980,951.103 USDT.
The seized virtual currency is tied to APT38’s efforts to raise revenue for the North Korean government through heists from virtual currency providers.
These include a July 2023 theft of about $37 million from an Estonia-based payments processor, a July 2023 theft of about $100 million from a Panama-based payment processor, a November 2023 theft of about $138 million from a Panama-based exchange, and a November 2023 theft of about $107 million from a Seychelles-based exchange.
Prosecutors say work to trace, seize, and forfeit related stolen funds is ongoing. The FBI Los Angeles Field Office and the FBI Virtual Assets Unit are investigating the cases.
The Justice Department also announced on Friday that it secured five guilty pleas from people involved with the North Korean scheme.
The facilitators, based in the United States and Ukraine, assisted North Korean actors with obtaining remote IT employment with U.S. companies.
In some cases, they provided their own, false, or stolen identities.
They also hosted U.S. victim company-provided laptops at residences across the United States to create the false appearance that the IT workers were working domestically.
In total, these defendants’ fraudulent employment schemes impacted more than 136 U.S. victim companies.
The schemes generated more than $2.2 million in revenue for North Korea.
The activity compromised the identities of more than 18 U.S. citizens.
On Nov. 4, the Trump administration imposed sanctions on a group of bankers, financial institutions, and others accused of laundering money from cybercrime schemes, money the Treasury Department says helps pay for North Korea's nuclear weapons program.
Over the past three years, the Treasury Department's Office of Foreign Assets Control said North Korean malware and social engineering schemes have diverted more than $3 billion, mostly in digital assets.
Treasury said the amount is unmatched by any other foreign actor. An international report detailed the depth of the crimes in an October report.
Jim Mishler ✉
Jim Mishler, a seasoned reporter, anchor and news director, has decades of experience covering crime, politics and environmental issues.
© 2025 Newsmax. All rights reserved.