US Department of Justice Moves to Seize $15M in USDT Associated with North Korean Hackers

US Department of Justice Moves to Seize $15M in USDT Associated with North Korean Hackers

The U.S. Department of Justice (DOJ) is initiating proceedings to seize over $15 million in USDT that is linked to hacking activities by North Korean entities. This effort is part of a larger initiative aimed at disrupting North Korea's increasing reliance on cryptocurrency theft and illegal IT work to finance its sanctioned programs.

Key Takeaways:

The DOJ is pursuing the recovery of $15.1 million in USDT associated with the North Korean hacking group APT38.
The funds were traced back to four significant hacks of cryptocurrency platforms in 2023 and were initially seized by the FBI in March 2025.
Five individuals in the U.S. have pleaded guilty to assisting North Korean IT operatives in breaching American companies.

On Friday, the DOJ announced two civil forfeiture complaints that involve $15.1 million in Tether, which was stolen during a series of cyberattacks in 2023 linked to North Korea's state-sponsored hacking unit, known as Advanced Persistent Threat 38 (APT38). This group has a reputation for targeting international cryptocurrency firms.

FBI's Efforts to Forfeit Stolen USDT from 2023 Crypto Breaches

Federal investigators have traced these digital assets back to funds that were stolen from four cryptocurrency platforms during the year 2023. The FBI originally seized the USDT in March 2025 and is now seeking judicial approval to permanently forfeit these assets to ensure their return to the affected victims.

While the DOJ has not specified which platforms were hacked, the incidents coincide with several notable breaches from that year. These include the $100 million theft from Poloniex in November 2023, the $37 million CoinsPaid hack in July, the Alphapo payment attack—with losses estimated at around $100 million—and another theft of approximately $138 million from a Panamanian exchange in November 2023.

The DOJ has yet to confirm which of these thefts are relevant to the current forfeiture actions.

According to the DOJ announcement, North Korean operatives have been actively laundering the stolen funds through a variety of methods, including mixers, cross-chain bridges, cryptocurrency exchanges, and over-the-counter (OTC) brokers.

The DOJ noted, “Efforts to trace, seize, and forfeit the relevant stolen virtual currency are ongoing, as the APT38 participants continue to launder these funds.”

Legal Actions Against Those Assisting North Korean Hackers

The U.S. Department of Justice's enforcement actions extend beyond the hackers themselves. It has also disclosed that five individuals have pleaded guilty to charges related to aiding North Korea in infiltrating American firms through deceptive remote IT work, which has become a vital source of revenue for the North Korean government.

The four U.S. citizens implicated—Audricus Phagnasay (24), Jason Salazar (30), Alexander Paul Travis (34), and Erick Ntekereze Prince (38)—accepted plea agreements for their involvement in a wire fraud conspiracy. They provided their identities to North Korean IT workers and allowed their company-issued laptops to be controlled from their residences, giving the impression that these workers were located in the United States and granting them access to sensitive corporate networks.

Ukrainian Individual Enters Plea Deal for Selling Stolen Identities

In an additional development, Ukrainian national Oleksandr Didenko pleaded guilty to charges of wire fraud conspiracy and aggravated identity theft. He admitted to stealing U.S. citizens' identities and selling them to North Korean IT workers, which facilitated those operatives in securing employment at 40 different companies. Didenko agreed to forfeit over $1.4 million.

Overall, these schemes have impacted 136 U.S. companies, generating more than $2.2 million for the North Korean government and compromising the identities of over 18 American citizens.

Officials have frequently cautioned that North Korean IT workers can command salaries of up to $300,000 per year, channeling hundreds of millions of dollars into programs under the supervision of the regime’s Ministry of Defense.

North Korea's cryptocurrency theft operations have significantly escalated in 2025, with hackers reportedly stealing over $2 billion thus far this year, as per insights from blockchain analytics firm Elliptic.