← Amnokgang Technology Development Companyreviewed 2026-10-16 · 23 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Amnokgang Technology Development Company against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
3 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in section: OFAC Sanctions Designation
“On March 12, 2026, OFAC designated Amnokgang Technology Development Company under Executive Order 13722 and related North Korea sanctions programs, adding it to the Specially Designated Nationals (SDN) list.”
reviewerOFAC designated Amnokgang under Executive Order 13722 on March 12, 2026The Treasury press release and OFAC SDN entry (OpenSanctions mirror) both cite E.O. 13810 — 'operating in the information technology industry in North Korea' — as the legal basis for Amnokgang's designation, not E.O. 13722. OFAC's own sanctions-search detail page cites the North Korea Sanctions Regulations (31 CFR 510) rather than naming an EO directly, but the Treasury release text specifically attributes the IT-industry authority to E.O. 13810.Proposed correction (not yet applied)On March 12, 2026, OFAC designated Amnokgang Technology Development Company under Executive Order 13810 and related North Korea sanctions programs, adding it to the Specially Designated Nationals (SDN) list. - #2[disputed][awaiting moderator]in section: Entity Background and Structure
“It appears on both the U.S. OFAC SDN List and the U.S. Trade Consolidated Screening List (CSL) as of the last recorded update in May 2026.”
reviewerAmnokgang appears on the OFAC SDN list and CSL as of a last recorded update in May 2026OpenSanctions shows a 'Last change' date of 2026-07-22 for this entity, consistent with the page's own cited archive snapshot dated 2026-07-26. 'May 2026' does not match either the live OpenSanctions record or the archived version cited by the page.Proposed correction (not yet applied)It appears on both the U.S. OFAC SDN List and the U.S. Trade Consolidated Screening List (CSL) as of the last recorded update in July 2026. - #20[disputed][awaiting moderator]in section: Connections to Broader DPRK Sanctions Infrastructure
“TRM Labs noted that Amnokgang's designated addresses received downstream funds from a suspected DPRK cyberattack, suggesting operational overlap between the IT worker revenue pipeline and North Korea's parallel cryptocurrency theft program.”
reviewerTRM Labs noted that Amnokgang's designated addresses received downstream funds from a suspected DPRK cyberattackA full-text review of the TRM Labs blog post shows it never links Amnokgang to hack/cyberattack proceeds; TRM's only 'hack proceeds' statement in this article concerns Sim Hyon Sop ('Sim remains active, laundering hack proceeds'). The suspected-DPRK-hack-proceeds claim about Amnokgang specifically is Chainalysis' finding (correctly attributed in sections[3]), not TRM Labs'.Proposed correction (not yet applied)Chainalysis noted that Amnokgang's designated addresses received downstream funds from a suspected DPRK cyberattack, suggesting operational overlap between the IT worker revenue pipeline and North Korea's parallel cryptocurrency theft program.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #6[unverifiable][awaiting moderator]in section: IT Worker Fraud Operations
“Yun coordinated several dozen financial transactions totaling more than $70,000 with Vietnamese facilitator Hoang Minh Quang in connection with IT services performed by his group.”
reviewerYun coordinated several dozen financial transactions totaling more than $70,000 with 'Vietnamese facilitator' Hoang Minh QuangThe $70,000 transaction total and the Yun/Hoang Minh Quang relationship are confirmed in the Treasury release, but the release does not state Hoang Minh Quang's nationality; the 'Vietnamese' label could not be independently verified from any source consulted. - #8[unverifiable][awaiting moderator]in the timeline
“Yun Song Guk begins leading Amnokgang-affiliated IT worker groups operating out of Boten, Laos (approximate start date per OFAC designation).”
reviewerYun Song Guk began leading the Boten, Laos IT worker group specifically in June 2023Sources consulted say only 'since at least 2023' with no specific month; the page already flags the June 2023 date as approximate, which is an appropriate hedge, but the specific month could not be confirmed from any source. - #22[unverifiable][awaiting moderator]in section: WMD Financing and National Security Implications
“The FBI maintains a public DPRK IT Fraud wanted notice and has issued advisories to U.S. businesses on detecting and avoiding DPRK IT worker infiltration.”
reviewerThe FBI maintains a public DPRK IT Fraud wanted notice and has issued advisories to U.S. businessesThe cited FBI URL returned HTTP 403 to automated fetch (likely a bot-blocking measure rather than evidence the page is gone), so the specific URL could not be verified directly. Independent reporting confirms the FBI has published DPRK-IT-worker wanted postings (e.g., a June 2025 wanted poster for four named individuals) and joint advisories, so the general claim is plausible but the specific cited URL is unconfirmed.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #16[partially supported][awaiting moderator]in section: Vietnam Facilitator Network: Quangvietdnbg
“The company allegedly purchased bulk Payoneer accounts under American names to avoid detection and conducted peer-to-peer cryptocurrency trading on platforms including Paxful and Facebook Marketplace.”
reviewerQuangvietdnbg conducted peer-to-peer cryptocurrency trading on platforms including Paxful and Facebook MarketplaceThe Korea Times article confirms Paxful and bulk Payoneer-account purchases, and describes P2P trading on 'Facebook and Telegram,' but it never names 'Facebook Marketplace' specifically — that is a more specific claim than the source supports. - #17[partially supported][awaiting moderator]in section: Vietnam Facilitator Network: Quangvietdnbg
“Additional Vietnamese nationals Do Phi Khanh and Hoang Van Nguyen were designated for opening bank accounts that received IT worker earnings.”
reviewerAdditional Vietnamese nationals Do Phi Khanh and Hoang Van Nguyen were designated for opening bank accounts that received IT worker earningsThe Treasury release ties both men's designations primarily to supporting Kim Se Un, a previously-sanctioned DPRK nuclear procurement facilitator, under E.O. 13382 — not Amnokgang's IT-worker scheme under E.O. 13810. Only Do Phi Khanh's entry mentions laundering IT worker proceeds; Hoang Van Nguyen's is described as procuring foreign currency for Kim. The page's framing omits the Kim Se Un/nuclear-procurement link and overstates the IT-worker-earnings connection for Hoang Van Nguyen specifically. - #23[partially supported][awaiting moderator]in the timeline
“Vietnam revokes business license of co-designated Quangvietdnbg International Services Company following U.S. sanctions announcement.”
reviewerVietnam revoked Quangvietdnbg's business license on March 13, 2026, the day after the sanctions announcementThe Korea Times article says only that the license was revoked 'shortly after' the sanctions, without giving the exact date of March 13, 2026. The specific day in the timeline could not be independently confirmed from any source consulted, though the general sequence of events is plausible.
confirmed
14 claimsThe cited evidence supports the claim as written.
- #3[confirmed][no action needed]in section: Entity Background and Structure
“Amnokgang Technology Development Company was incorporated in 1982 and is registered in North Korea. Its known addresses include the Pothonggang District in Pyongyang and a secondary listing in South Hamgyong province.”
reviewerAmnokgang incorporated in 1982, headquartered in Pyongyang (Pothonggang District), with a secondary South Hamgyong listing, and documented aliases including Amnokgang Technology Development Corporation, Korea Amnokgang Technology Development Company, Korea Aprokgang Technology Company, and Yalu River Technology Development CompanyOpenSanctions' mirror of the OFAC SDN entry confirms the 1982 founding date, both addresses, the Chinese/Korean-script name variants, and all four named aliases, as well as the 'Other information technology and computer service activities' sector classification. - #4[confirmed][no action needed]in section: IT Worker Fraud Operations
“U.S. Treasury estimates the broader DPRK IT worker scheme generated nearly $800 million in 2024 alone.”
reviewerU.S. Treasury estimates the broader DPRK IT worker scheme generated nearly $800 million in 2024, to fund WMD programsConfirmed directly from the Treasury press release text and corroborated by multiple contemporaneous news reports (The Record, Global Trade Alert, MEXC/Chainalysis summary) of the March 12, 2026 action. - #5[confirmed][no action needed]in section: IT Worker Fraud Operations
“Individual IT workers are reported to earn up to $300,000 annually per prior DOJ investigations of the wider scheme.”
reviewerIndividual DPRK IT workers reported to earn up to $300,000 annually per prior DOJ investigationsThe $300,000 figure traces to the May 2022 FBI/State/Treasury tri-seal advisory and is repeated in DOJ press materials on IT worker schemes; it is not in the sb0416 release itself but is accurately characterized as a 'prior' DOJ/FBI figure, which is how the page frames it. - #7[confirmed][no action needed]in section: IT Worker Fraud Operations
“Amnokgang is specifically linked to IT workers operating out of Boten, Laos, led by designated DPRK national Yun Song Guk since at least 2023.”
reviewerAmnokgang is linked to IT workers operating out of Boten, Laos, led by Yun Song Guk since at least 2023Confirmed; Yun Song Guk is named in the Treasury release as leading a group of DPRK IT workers from Boten, Laos. - #9[confirmed][no action needed]in section: IT Worker Fraud Operations
“A Spain-based individual, York Louis Celestino Herrera, allegedly collaborated with Yun from 2024 onward on IT service contracts, further extending Amnokgang's operational network into Europe.”
reviewerA Spain-based individual, York Louis Celestino Herrera, allegedly collaborated with Yun from 2024 onward on IT service contractsOFAC's SDN listing gives Herrera a Barcelona, Spain address, and press coverage (Korea Herald, etc.) describes him as based in Spain, though some reporting lists his nationality as Dominican Republic with Spain as an alternate nationality. 'Spain-based' is accurate even though 'Spanish' nationality would be disputed. - #10[confirmed][no action needed]in section: Cryptocurrency Addresses and On-Chain Activity
“Three Ethereum addresses were designated: 0xcB74874f1e06Fcf80A306e06e5379A44B488bA2D, 0x0330070FD38Ec3bB94F58FA55D40368271E9e54A, and 0x9Be599d7867f5E1a2D7Ec6dB9710dF2b98A15573. Four Tron addresses were designated: TNrX2FwrHKoo4XACGkmSzqeK4pdnKYn6Z7, TEEYCuGDyeNkuDj4u6GQRXxXo3Nh29r2vP, TZB4NrX7k9ZsV6PRc1GigAztLL8WHpLvwP, and TDe2UNAvuUnTbbDo7518eMe3TXN5qJW8Ft.”
reviewerSeven cryptocurrency addresses designated (three Ethereum, four Tron) with specific addresses listedAll seven addresses and the 3 ETH / 4 TRON split match OpenSanctions' mirror of the SDN entry exactly, and TRM Labs independently confirms 'seven cryptocurrency addresses' designated for Amnokgang. - #11[confirmed][no action needed]in section: Cryptocurrency Addresses and On-Chain Activity
“TRM Labs reported these addresses conducted over $12 million in transactions based on blockchain analysis.”
reviewerTRM Labs reported over $12 million in tracked on-chain transactions through the Amnokgang addressesDirectly confirmed: TRM Labs' blog states the Amnokgang addresses 'conducted over USD 12 million in transactions.' - #12[confirmed][no action needed]in section: Cryptocurrency Addresses and On-Chain Activity
“Chainalysis noted that the designated addresses received downstream funds from a suspected DPRK hack in addition to IT worker wages, and that funds were routed through Southeast Asian movement services.”
reviewerChainalysis: designated addresses received downstream funds from a suspected DPRK hack and were routed through Southeast Asian movement servicesConfirmed: Chainalysis' blog states Amnokgang-linked addresses 'leveraged Southeast Asian movement services and received downstream funds from a suspected DPRK hack,' correctly attributed in this section to Chainalysis. - #13[confirmed][no action needed]in section: Cryptocurrency Addresses and On-Chain Activity
“TRM further reported that on-chain flows from the Amnokgang addresses were traced to OFAC-sanctioned Cheil Credit Bank, high-risk cryptocurrency exchanges, Chinese darknet marketplaces, and other illicit financial services.”
reviewerTRM reported Amnokgang on-chain flows traced to Cheil Credit Bank, high-risk exchanges, Chinese darknet marketplaces, and other illicit financial servicesConfirmed: TRM's blog explicitly ties Amnokgang funds to 'high-risk exchanges, Chinese darknet markets, and other illicit services' and shows a flow-of-funds figure linking Amnokgang to Cheil Credit Bank. - #14[confirmed][no action needed]in section: Vietnam Facilitator Network: Quangvietdnbg
“According to OFAC, between mid-2023 and mid-2025 Nguyen converted approximately $2.5 million into cryptocurrency for North Korean nationals, including illicit earnings from IT workers associated with Amnokgang.”
reviewerNguyen Quang Viet (Quangvietdnbg CEO) converted approximately $2.5 million into cryptocurrency for North Korean nationals between mid-2023 and mid-2025Confirmed directly from the Treasury release's description of Nguyen Quang Viet's conduct and timeframe. - #15[confirmed][no action needed]in section: Vietnam Facilitator Network: Quangvietdnbg
“The Korea Times reported that Quangvietdnbg operated via Facebook for client recruitment and Telegram channels with approximately 1,345 members for transaction coordination.”
reviewerQuangvietdnbg's Telegram channel had approximately 1,345 members used for transaction coordinationConfirmed: the Korea Times article states the announcement-only Telegram channel had 1,345 members, and describes Facebook-based client recruitment funneling to Telegram. - #18[confirmed][no action needed]in section: OFAC Sanctions Designation
“Simultaneously, OFAC updated the entry for previously designated Sim Hyon Sop, a China-based representative of Korea Kwangson Banking Corp (KKBC), adding 11 new cryptocurrency addresses across Ethereum and Tron networks.”
reviewerOFAC updated Sim Hyon Sop's entry, adding 11 new cryptocurrency addresses across Ethereum and Tron networksConfirmed via Chainalysis (as reported by MEXC News): the March 12, 2026 action added 11 new addresses for Sim Hyon Sop, who was originally designated in April 2023. - #19[confirmed][no action needed]in section: Connections to Broader DPRK Sanctions Infrastructure
“The addresses also show transaction links to Cheil Credit Bank, a DPRK financial institution sanctioned by OFAC in September 2017, underscoring Amnokgang's integration into long-standing North Korean state financial infrastructure.”
reviewerCheil Credit Bank, a DPRK financial institution, was sanctioned by OFAC in September 2017Confirmed: OFAC designated Cheil Credit Bank on September 26, 2017 under E.O. 13810 as one of eight North Korean banks, consistent with both this section and the timeline entry. - #21[confirmed][no action needed]in section: Connections to Broader DPRK Sanctions Infrastructure
“Prior DOJ actions against the broader scheme — including a December 2024 indictment of 14 DPRK nationals and a 2024 Nashville arrest — provide judicial context for the scale of the network Amnokgang supports, though no Amnokgang-specific criminal charges have been publicly filed as of June 2026.”
reviewerDOJ indicted 14 DPRK nationals in December 2024 for a multi-year fraudulent IT worker schemeConfirmed: DOJ unsealed an indictment of 14 DPRK nationals in December 2024 (reported Dec 11-13, 2024) tied to an $88 million scheme; the 2024 Nashville arrest corresponds to Matthew Isaac Knoot, arrested August 8, 2024, for running a 'laptop farm' enabling DPRK IT workers. Both references check out as general judicial context, and the page correctly notes no Amnokgang-specific charges have been filed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.