Audit log

Every state-changing event for Amnokgang Technology Development Company: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-03 00:07:56Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,915,046

   sig

   3EHJwShUfyYd…Yc7tAwkKcopyexplorer ↗

   hash

   9UF87iUemayQ…tX14FTCccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (20408 B) ▸

   {"actor":"system:backfill","investigation_id":"43d19c56-214d-420f-9471-04ff41a65e54","kind":"publish","page_slug":"amnokgang-technology-development-company","published_at":"2026-06-03T00:07:56.680Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Amnokgang Technology Development Company","sections":[{"content":"On March 12, 2026, OFAC designated Amnokgang Technology Development Company under Executive Order 13722 and related North Korea sanctions programs, adding it to the Specially Designated Nationals (SDN) list. OFAC described the entity as a DPRK IT company that manages delegations of overseas IT workers and conducts illicit procurement activities to obtain and sell military and commercial technology through overseas networks. The designation was part of a broader action targeting six individuals and two entities involved in DPRK government-orchestrated IT worker fraud schemes. Simultaneously, OFAC updated the entry for previously designated Sim Hyon Sop, a China-based representative of Korea Kwangson Banking Corp (KKBC), adding 11 new cryptocurrency addresses across Ethereum and Tron networks. The action was publicly announced via U.S. Treasury press release sb0416.","heading":"OFAC Sanctions Designation","severity":"critical","sources":[{"credibility":1,"name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0416"},{"credibility":2,"name":"OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html"}]},{"content":"Amnokgang Technology Development Company was incorporated in 1982 and is registered in North Korea. Its known addresses include the Pothonggang District in Pyongyang and a secondary listing in South Hamgyong province. The entity operates under several aliases documented on the OFAC SDN list: Amnokgang Technology Development Corporation, Korea Amnokgang Technology Development Company, Korea Aprokgang Technology Company, and Yalu River Technology Development Company. The Chinese transliteration is listed as 鸭绿江技术开发公司 and the Korean-script form as 압록강기술개발회사. OpenSanctions classifies the entity under 'Other information technology and computer service activities.' It appears on both the U.S. OFAC SDN List and the U.S. Trade Consolidated Screening List (CSL) as of the last recorded update in May 2026.","heading":"Entity Background and Structure","severity":"critical","sources":[{"credibility":1,"name":"Amnokgang Technology Development Company — OpenSanctions","type":"regulatory","url":"https://www.opensanctions.org/entities/ofac-57056/"},{"credibility":1,"name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0416"}]},{"content":"According to OFAC, Amnokgang arranged for North Korean nationals to obtain overseas employment under false identities, forming a systematic labor export scheme that generated revenue remitted to the DPRK state. U.S. Treasury estimates the broader DPRK IT worker scheme generated nearly $800 million in 2024 alone. Individual IT workers are reported to earn up to $300,000 annually per prior DOJ investigations of the wider scheme. Amnokgang is specifically linked to IT workers operating out of Boten, Laos, led by designated DPRK national Yun Song Guk since at least 2023. Yun coordinated several dozen financial transactions totaling more than $70,000 with Vietnamese facilitator Hoang Minh Quang in connection with IT services performed by his group. A Spain-based individual, York Louis Celestino Herrera, allegedly collaborated with Yun from 2024 onward on IT service contracts, further extending Amnokgang's operational network into Europe.","heading":"IT Worker Fraud Operations","severity":"critical","sources":[{"credibility":1,"name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0416"},{"credibility":2,"name":"US sanctions North Korea IT worker networks in Laos, Vietnam — The Record from Recorded Future News","type":"news_article","url":"https://therecord.media/us-sanctions-north-korea-it-worker-networks-laos-vietnam"},{"credibility":2,"name":"OFAC Sanctions DPRK IT Worker Network Funding WMD Programs — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html"}]},{"content":"OFAC designated seven cryptocurrency addresses associated with Amnokgang across two blockchain networks. Three Ethereum addresses were designated: 0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D, 0x0330070FD38Ec3bB94F58FA55D40368271E9e54A, and 0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573. Four Tron addresses were designated: TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7, TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP, TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP, and TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft. TRM Labs reported these addresses conducted over $12 million in transactions based on blockchain analysis. Chainalysis noted that the designated addresses received downstream funds from a suspected DPRK hack in addition to IT worker wages, and that funds were routed through Southeast Asian movement services. TRM further reported that on-chain flows from the Amnokgang addresses were traced to OFAC-sanctioned Cheil Credit Bank, high-risk cryptocurrency exchanges, Chinese darknet marketplaces, and other illicit financial services. The scheme employed mainstream cryptocurrency infrastructure including compliant exchanges, hosted wallets, DeFi services, and cross-chain bridges.","heading":"Cryptocurrency Addresses and On-Chain Activity","severity":"critical","sources":[{"credibility":2,"name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/"},{"credibility":2,"name":"Beyond IT Worker Fraud: OFAC's Latest DPRK Designations Show Broader Sanctions and National Security Risk — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/beyond-it-worker-fraud-ofacs-latest-dprk-designations-show-broader-sanctions-and-national-security-risk"},{"credibility":2,"name":"OFAC lists 53 crypto addresses of sanctioned North Korean Cheil Credit Bank — Elliptic","type":"research","url":"https://www.elliptic.co/blog/ofac-lists-53-crypto-addresses-of-sanctioned-north-korean-cheil-credit-bank"},{"credibility":1,"name":"Amnokgang Technology Development Company — OpenSanctions","type":"regulatory","url":"https://www.opensanctions.org/entities/ofac-57056/"}]},{"content":"A key support node for Amnokgang's crypto money laundering was Quangvietdnbg International Services Company Limited, a Vietnam-based company whose CEO, Nguyen Quang Viet, was also designated by OFAC on March 12, 2026. According to OFAC, between mid-2023 and mid-2025 Nguyen converted approximately $2.5 million into cryptocurrency for North Korean nationals, including illicit earnings from IT workers associated with Amnokgang. The Korea Times reported that Quangvietdnbg operated via Facebook for client recruitment and Telegram channels with approximately 1,345 members for transaction coordination. The company allegedly purchased bulk Payoneer accounts under American names to avoid detection and conducted peer-to-peer cryptocurrency trading on platforms including Paxful and Facebook Marketplace. Vietnamese authorities revoked Quangvietdnbg's business license shortly after the U.S. sanctions designation. Additional Vietnamese nationals Do Phi Khanh and Hoang Van Nguyen were designated for opening bank accounts that received IT worker earnings.","heading":"Vietnam Facilitator Network: Quangvietdnbg","severity":"critical","sources":[{"credibility":2,"name":"How North Korea laundered money through Vietnamese crypto company — The Korea Times","type":"news_article","url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company"},{"credibility":1,"name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0416"},{"credibility":2,"name":"US sanctions North Korea IT worker networks in Laos, Vietnam — The Record from Recorded Future News","type":"news_article","url":"https://therecord.media/us-sanctions-north-korea-it-worker-networks-laos-vietnam"}]},{"content":"Amnokgang operates within a documented, multi-entity DPRK financial evasion infrastructure. OFAC's simultaneous update to the entry of Sim Hyon Sop, a China-based representative of Korea Kwangson Banking Corp (KKBC) — originally sanctioned in April 2023 — added 11 new cryptocurrency addresses to his designation, reflecting continued activity laundering both IT worker wages and hack proceeds. TRM Labs noted that Amnokgang's designated addresses received downstream funds from a suspected DPRK cyberattack, suggesting operational overlap between the IT worker revenue pipeline and North Korea's parallel cryptocurrency theft program. The addresses also show transaction links to Cheil Credit Bank, a DPRK financial institution sanctioned by OFAC in September 2017, underscoring Amnokgang's integration into long-standing North Korean state financial infrastructure. Prior DOJ actions against the broader scheme — including a December 2024 indictment of 14 DPRK nationals and a 2024 Nashville arrest — provide judicial context for the scale of the network Amnokgang supports, though no Amnokgang-specific criminal charges have been publicly filed as of June 2026.","heading":"Connections to Broader DPRK Sanctions Infrastructure","severity":"high","sources":[{"credibility":2,"name":"Beyond IT Worker Fraud: OFAC's Latest DPRK Designations — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/beyond-it-worker-fraud-ofacs-latest-dprk-designations-show-broader-sanctions-and-national-security-risk"},{"credibility":2,"name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/"},{"credibility":1,"name":"Fourteen North Korean Nationals Indicted — U.S. Department of Justice","type":"court_filing","url":"https://www.justice.gov/archives/opa/pr/fourteen-north-korean-nationals-indicted-carrying-out-multi-year-fraudulent-information"},{"credibility":1,"name":"Treasury Disrupts North Korean Digital Assets Money Laundering Network — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/jy2752"}]},{"content":"OFAC designated Amnokgang under authority specifically tied to WMD financing. The Treasury Department stated that the broader IT worker scheme generated nearly $800 million in 2024 to fund North Korea's WMD programs. Amnokgang's dual mandate — managing overseas IT worker labor exports and procuring military and commercial technology through overseas networks — reflects a combined revenue-generation and material acquisition function within the DPRK state apparatus. Per prior FBI and DOJ advisories, individual DPRK IT workers employed through schemes like Amnokgang's can earn up to $300,000 per year, with collective earnings across hundreds of workers constituting a significant revenue stream for sanctioned programs. The FBI maintains a public DPRK IT Fraud wanted notice and has issued advisories to U.S. businesses on detecting and avoiding DPRK IT worker infiltration.","heading":"WMD Financing and National Security Implications","severity":"critical","sources":[{"credibility":1,"name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0416"},{"credibility":1,"name":"DPRK IT WORKERS — Federal Bureau of Investigation","type":"regulatory","url":"https://www.fbi.gov/wanted/cyber/dprk-it-workers"},{"credibility":1,"name":"U.S. imposes sanctions over North Korean scheme to use remote workers to fund weapons program — CBS News","type":"news_article","url":"https://www.cbsnews.com/news/north-korea-us-sanctions-remote-workers-weapons-program/"}]}],"sources_used":[{"credibility":1,"name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0416"},{"credibility":1,"name":"Amnokgang Technology Development Company — OpenSanctions (OFAC SDN data)","type":"regulatory","url":"https://www.opensanctions.org/entities/ofac-57056/"},{"credibility":2,"name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/"},{"credibility":2,"name":"Beyond IT Worker Fraud: OFAC's Latest DPRK Designations Show Broader Sanctions and National Security Risk — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/beyond-it-worker-fraud-ofacs-latest-dprk-designations-show-broader-sanctions-and-national-security-risk"},{"credibility":2,"name":"How North Korea laundered money through Vietnamese crypto company — The Korea Times","type":"news_article","url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company"},{"credibility":2,"name":"US sanctions North Korea IT worker networks in Laos, Vietnam — The Record from Recorded Future News","type":"news_article","url":"https://therecord.media/us-sanctions-north-korea-it-worker-networks-laos-vietnam"},{"credibility":2,"name":"OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html"},{"credibility":1,"name":"U.S. imposes sanctions over North Korean scheme to use remote workers to fund weapons program — CBS News","type":"news_article","url":"https://www.cbsnews.com/news/north-korea-us-sanctions-remote-workers-weapons-program/"},{"credibility":1,"name":"DPRK IT WORKERS — Federal Bureau of Investigation","type":"regulatory","url":"https://www.fbi.gov/wanted/cyber/dprk-it-workers"},{"credibility":1,"name":"Fourteen North Korean Nationals Indicted for Fraudulent IT Worker Scheme — U.S. Department of Justice","type":"court_filing","url":"https://www.justice.gov/archives/opa/pr/fourteen-north-korean-nationals-indicted-carrying-out-multi-year-fraudulent-information"},{"credibility":1,"name":"Treasury Disrupts North Korean Digital Assets Money Laundering Network — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/jy2752"},{"credibility":2,"name":"OFAC lists 53 crypto addresses of sanctioned North Korean Cheil Credit Bank — Elliptic","type":"research","url":"https://www.elliptic.co/blog/ofac-lists-53-crypto-addresses-of-sanctioned-north-korean-cheil-credit-bank"},{"credibility":2,"name":"US Sanctions DPRK Facilitators Behind $800M Crypto Laundering Scheme — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/us-sanctions-dprk-facilitators-behind-210105972.html"},{"credibility":2,"name":"US sanctions DPRK IT facilitators over crypto transactions in $800 million scheme — The Block","type":"news_article","url":"https://www.theblock.co/post/393518/us-sanctions-dprk-facilitators"}],"summary":"Amnokgang Technology Development Company is a North Korean state-controlled IT firm established in 1982 and headquartered in Pyongyang. The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned it on March 12, 2026, for managing overseas DPRK IT worker delegations that allegedly generated nearly $800 million in illicit revenue in 2024 to fund North Korea's weapons of mass destruction programs. Seven cryptocurrency addresses across Ethereum and Tron networks were designated, with TRM Labs reporting over $12 million in tracked on-chain transactions through those addresses.","timeline":[{"date":"1982-01-01","event":"Amnokgang Technology Development Company incorporated in Pyongyang, North Korea.","source":"OpenSanctions / OFAC SDN List","source_url":"https://www.opensanctions.org/entities/ofac-57056/"},{"date":"2017-09-26","event":"OFAC sanctions Cheil Credit Bank, a DPRK financial institution later identified as a downstream recipient of Amnokgang-linked crypto flows.","source":"Elliptic Blog","source_url":"https://www.elliptic.co/blog/ofac-lists-53-crypto-addresses-of-sanctioned-north-korean-cheil-credit-bank"},{"date":"2023-04-01","event":"OFAC initially designates Sim Hyon Sop, China-based representative of Korea Kwangson Banking Corp (KKBC), who later received funds connected to Amnokgang's IT worker network.","source":"U.S. Department of the Treasury","source_url":"https://home.treasury.gov/news/press-releases/jy2752"},{"date":"2023-06-01","event":"Yun Song Guk begins leading Amnokgang-affiliated IT worker groups operating out of Boten, Laos (approximate start date per OFAC designation).","source":"U.S. Department of the Treasury press release sb0416","source_url":"https://home.treasury.gov/news/press-releases/sb0416"},{"date":"2023-07-01","event":"Nguyen Quang Viet (CEO of Quangvietdnbg) begins converting IT worker earnings to cryptocurrency for Amnokgang-linked North Korean nationals; the conversion activity spans approximately mid-2023 to mid-2025.","source":"U.S. Department of the Treasury press release sb0416","source_url":"https://home.treasury.gov/news/press-releases/sb0416"},{"date":"2024-12-01","event":"DOJ indicts 14 DPRK nationals in connection with multi-year fraudulent IT worker schemes generating revenue for North Korea, providing judicial context for the broader network Amnokgang supports.","source":"U.S. Department of Justice","source_url":"https://www.justice.gov/archives/opa/pr/fourteen-north-korean-nationals-indicted-carrying-out-multi-year-fraudulent-information"},{"date":"2024-01-01","event":"DPRK IT worker schemes — of which Amnokgang is a principal organizational node — collectively generate nearly $800 million in illicit revenue throughout 2024, per OFAC estimate.","source":"U.S. Department of the Treasury press release sb0416","source_url":"https://home.treasury.gov/news/press-releases/sb0416"},{"date":"2024-01-01","event":"York Louis Celestino Herrera, based in Spain, begins alleged collaboration with Yun Song Guk on IT service contracts connected to Amnokgang's labor export network.","source":"U.S. Department of the Treasury press release sb0416","source_url":"https://home.treasury.gov/news/press-releases/sb0416"},{"date":"2026-03-12","event":"OFAC designates Amnokgang Technology Development Company, co-designating Quangvietdnbg International Services Company and six individuals (Nguyen Quang Viet, Do Phi Khanh, Hoang Van Nguyen, Hoang Minh Quang, Yun Song Guk, York Louis Celestino Herrera). Seven Amnokgang cryptocurrency addresses across Ethereum and Tron are simultaneously designated.","source":"U.S. Department of the Treasury press release sb0416","source_url":"https://home.treasury.gov/news/press-releases/sb0416"},{"date":"2026-03-13","event":"Vietnam revokes business license of co-designated Quangvietdnbg International Services Company following U.S. sanctions announcement.","source":"The Korea Times","source_url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company"},{"date":"2026-04-16","event":"The Korea Times publishes detailed reporting on Quangvietdnbg's laundering methods, including Telegram channel operations (1,345 members), bulk Payoneer account purchases, and P2P crypto trading on Paxful and Facebook.","source":"The Korea Times","source_url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c051c3bd-0c06-48ef-be8d-190bc595d688copy