US Treasury: North Korea Laundered Hacked Virtual Assets Through Cambodian Financial Institution

Blacklisting and Financial Sanctions Announced
Targeting North Korean Hacker Group "Lazarus"
Billions of Dollars in Virtual Assets Stolen

The U.S. Department of the Treasury has identified Cambodia's private financial group, Huione Group, as a money laundering channel for virtual assets stolen by the North Korea-linked cyber hacker organization Lazarus Group, and has announced upcoming financial sanctions. This marks the first time the U.S. government has officially acknowledged and taken action against North Korea's systematic use of third-country financial systems to launder illicit funds.

According to the Financial Times (FT) on July 2 (local time), the Financial Crimes Enforcement Network (FinCEN) under the U.S. Treasury Department recently officially designated the Cambodia-based Huione Group as a laundering route for approximately $4 billion worth of virtual assets stolen by the North Korean hacking organization Lazarus. The agency also announced that the group would be placed on the blacklist. Once blacklisted, all transactions with U.S. financial institutions are completely prohibited, and access to the dollar settlement system is denied.

Previously, in May, the U.S. Treasury Department had designated Huione Group as a "Financial Institution of Primary Money Laundering Concern," signaling impending sanctions. This is the first time that a third-country financial institution has been officially sanctioned as a money laundering channel for North Korean hacker organizations.

The latest action by the U.S. Treasury Department specifically targets Lazarus. The department believes that Lazarus, which is linked to the North Korean regime, has served as a financial lifeline for the isolated country under sanctions, and that billions of dollars stolen by the group have been funneled into illegal programs such as ballistic missile and weapons of mass destruction (WMD) development.

Lazarus, believed to have been active since 2009, has been identified as the perpetrator behind major cybercrimes, including the 2014 Sony Pictures hack in the United States, the 2016 Bangladesh Central Bank hack, and the 2017 WannaCry ransomware outbreak. The total amount of funds stolen by the group is estimated to reach several billion dollars. Victor Cha, Korea Chair at the Center for Strategic and International Studies (CSIS), pointed out, "In 2024 alone, North Korea stole a record $1.34 billion in virtual assets," adding, "There is a high likelihood that these funds will be diverted to WMD programs, including nuclear and ballistic missile development."

FT reported, "North Korea has now emerged as one of the major players in international cybercrime, and U.S. law enforcement authorities consider North Korea, along with Russia, China, and Iran, as one of the world's four major cyber threat nations."

This action is significant because U.S. authorities have specifically traced how virtual assets stolen by Lazarus through hacking are funneled into and laundered through the global financial system, and have now officially sanctioned the entities involved.

U.S. Treasury Secretary Scott Besant stated, "Huione Group has served as a 'marketplace for cybercrime,' used by North Korea and international criminal organizations to launder billions of dollars," adding, "This measure aims to cut off the flow of criminal funds itself by blocking Huione's access to the U.S. financial network."