{"investigation":{"slug":"nguyen-quang-viet-dprk-it-worker-facilitator-ofac-designated","entity_name":"Nguyen Quang Viet (DPRK IT Worker Facilitator — OFAC Designated)","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.75,"status":"draft","content_type":"investigation","summary":"Nguyen Quang Viet is a Vietnamese national and CEO of Quangvietdnbg International Services Company Limited who was designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on March 12, 2026, for allegedly facilitating cryptocurrency conversion services that laundered proceeds of a North Korean (DPRK) overseas IT-worker fraud scheme. Treasury alleges Nguyen converted approximately $2.5 million into cryptocurrency between mid-2023 and mid-2025 for North Koreans, including illicit earnings tied to DPRK entity Amnokgang Technology Development Company, as part of a wider network Treasury said helped generate roughly $800 million in 2024 for North Korea's weapons of mass destruction and ballistic missile programs. Both Nguyen and his company are listed on the OFAC Specially Designated Nationals (SDN) list, and Vietnamese authorities reportedly revoked the company's business license shortly after the designation.","sections":[{"content":"On March 12, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control designated Nguyen Quang Viet and his company, Quangvietdnbg International Services Company Limited, under North Korea sanctions authorities (Executive Order 13810), as part of a broader action naming six individuals and two entities based in North Korea, Vietnam, Laos, and Spain. Treasury stated that Nguyen served as CEO of the Vietnam-based firm and 'facilitates currency conversion services for North Koreans,' and that between mid-2023 and mid-2025 he converted approximately $2.5 million into cryptocurrency for North Koreans, including illicit earnings from IT workers associated with the DPRK entity Amnokgang Technology Development Company. Both Nguyen and Quangvietdnbg appear on OFAC's Specially Designated Nationals (SDN) list under the North Korea sanctions program, meaning any U.S. persons or entities are generally prohibited from transacting with them and any U.S.-based assets are subject to blocking.","heading":"OFAC Sanctions Designation","sources":[{"url":"https://home.treasury.gov/news/press-releases/sb0416","name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses","type":"regulatory","credibility":1},{"url":"https://www.federalregister.gov/documents/2026/03/17/2026-05114/notice-of-ofac-sanctions-action","name":"Notice of OFAC Sanctions Action — Federal Register","type":"regulatory","credibility":1},{"url":"https://www.opensanctions.org/entities/NK-WMBfe4dSbSHU9ChvyRtTmk/","name":"Nguyen Quang Viet — OpenSanctions profile","type":"research","credibility":1}],"severity":"critical"},{"content":"According to Treasury and multiple news reports, the sanctioned network operated by having DPRK-backed IT workers use fraudulent documentation, stolen identities, and fabricated personas to obtain remote employment with legitimate companies, including firms in the United States and allied countries. Wages earned by these workers were then allegedly funneled back to North Korea, generating revenue Treasury says the regime used to fund its weapons of mass destruction and ballistic missile programs. Treasury alleged Nguyen and Quangvietdnbg served as a currency-conversion node in this pipeline — converting wage proceeds, including funds tied to the DPRK IT-worker management entity Amnokgang Technology Development Company, into cryptocurrency. Treasury said the overall network was linked to roughly $800 million generated through IT-worker schemes in 2024. Reporting by Korea Times, citing on-chain and open-source research, described Quangvietdnbg as operating a Payoneer-to-cryptocurrency conversion service, maintaining a Telegram channel and Facebook presence to appear as a legitimate financial services business, and allegedly seeking bulk purchases of verified Payoneer accounts registered under American names — consistent with efforts to receive and launder U.S.-sourced wage payments. These operational details are drawn from a single Tier-2 investigative report and have not been independently corroborated in other sources reviewed, so they should be treated with somewhat lower confidence than the Treasury designation itself.","heading":"Alleged Role in DPRK IT-Worker Fraud Network","sources":[{"url":"https://www.coindesk.com/business/2026/03/13/u-s-sanctions-6-people-2-companies-that-laundered-usd800-million-in-crypto-for-north-korea","name":"U.S. sanctions network that allegedly laundered $800 million in crypto for North Korea — CoinDesk","type":"news_article","credibility":2},{"url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company","name":"How North Korea laundered money through Vietnamese crypto company — Korea Times","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html","name":"OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — The Hacker News","type":"news_article","credibility":2},{"url":"https://www.koreatimes.co.kr/world/20260313/us-sanctions-6-individuals-2-entities-over-n-korean-it-worker-fraud","name":"US sanctions 6 individuals, 2 entities over N. Korean IT worker fraud — Korea Times","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the U.S. designation, Vietnamese authorities reportedly revoked Quangvietdnbg International Services Company Limited's business license. This is reported by a single Tier-2 source (Korea Times) and has not been confirmed via an official Vietnamese government notice reviewed in this investigation; it is presented as alleged. Under the OFAC designation, any assets of Nguyen or Quangvietdnbg subject to U.S. jurisdiction are blocked, and U.S. persons are generally prohibited from engaging in transactions with them absent a specific license from OFAC.","heading":"Aftermath — Business License Revocation and Asset Freezing","sources":[{"url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company","name":"How North Korea laundered money through Vietnamese crypto company — Korea Times","type":"news_article","credibility":2},{"url":"https://home.treasury.gov/news/press-releases/sb0416","name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses","type":"regulatory","credibility":1}],"severity":"high"},{"content":"The designation of Nguyen Quang Viet was part of a coordinated Treasury action naming six individuals and two entities located in North Korea, Vietnam, Laos, and Spain, all alleged to have facilitated DPRK overseas IT-worker fraud schemes. This March 2026 action follows a pattern of prior U.S. government actions — including DOJ indictments and earlier OFAC/FBI advisories — targeting DPRK IT-worker fraud and associated cryptocurrency laundering infrastructure, reflecting sustained U.S. government focus on this revenue stream for North Korea's weapons programs. On-chain analytics firm Chainalysis also published analysis of the March 2026 action, noting the network's use of dozens of wallet addresses across Ethereum, Tron, and Bitcoin, along with exchanges, DeFi services, and cross-chain bridges to move funds — consistent with typical DPRK-linked laundering typologies documented in other cases.","heading":"Broader Context — DPRK IT Worker Sanctions Wave","sources":[{"url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis","type":"research","credibility":2},{"url":"https://cointelegraph.com/news/us-treasury-sanctions-north-korea-it-worker-crypto-fraud-network","name":"US Sanctions Ring Enabling North Korea IT Worker Fraud — Cointelegraph","type":"news_article","credibility":2},{"url":"https://www.koreajoongangdaily.com/korea/us-sanctions-6-individuals-2-entities-for-roles-in-north-korean-it-worker-fraud-treasury-dept/12550196","name":"U.S. sanctions 6 individuals, 2 entities for roles in North Korean IT worker 'fraud' — Korea JoongAng Daily","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2022-09","event":"Quangvietdnbg reportedly posted its first cryptocurrency exchange service announcement on social media, per Korea Times' review of the company's public posting history.","source":"Korea Times","source_url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company"},{"date":"2023","event":"Alleged start of the mid-2023 to mid-2025 period during which Nguyen Quang Viet converted approximately $2.5 million into cryptocurrency for North Koreans, per OFAC.","source":"U.S. Treasury Department press release","source_url":"https://home.treasury.gov/news/press-releases/sb0416"},{"date":"2025-09-22","event":"Quangvietdnbg allegedly posted seeking a verified U.S. Payoneer account, according to Korea Times' review of the company's social media activity.","source":"Korea Times","source_url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company","date_evidence":"September 22, 2025: Post seeking verified U.S. Payoneer account appeared"},{"date":"2026-03-12","event":"U.S. Treasury/OFAC publicly announced sanctions designating Nguyen Quang Viet and Quangvietdnbg International Services Company Limited, along with five other individuals and one other entity, for facilitating DPRK IT-worker fraud and related crypto laundering.","source":"U.S. Treasury Department press release","source_url":"https://home.treasury.gov/news/press-releases/sb0416","date_evidence":"Documentation: Referenced in 'Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses' (March 12, 2026)"},{"date":"2026-03","event":"Vietnamese authorities reportedly revoked Quangvietdnbg's business license shortly after the U.S. sanctions announcement.","source":"Korea Times","source_url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company"},{"date":"2026-03","event":"OFAC sanctions action formally published in the Federal Register.","source":"Federal Register","source_url":"https://www.federalregister.gov/documents/2026/03/17/2026-05114/notice-of-ofac-sanctions-action","date_original":"2026-03-17"},{"date":"2026-04","event":"Korea Times published an investigative report detailing Quangvietdnbg's alleged operations, social media presence, and Payoneer-to-crypto conversion activity.","source":"Korea Times","source_url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company","date_original":"2026-04-16"}],"sources_used":[{"url":"https://home.treasury.gov/news/press-releases/sb0416","name":"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses","type":"regulatory","archive_url":"http://web.archive.org/web/20260826185518/https://home.treasury.gov/news/press-releases/sb0416","credibility":1,"archive_timestamp":"2026-08-26T18:55:18+00:00"},{"url":"https://www.federalregister.gov/documents/2026/03/17/2026-05114/notice-of-ofac-sanctions-action","name":"Notice of OFAC Sanctions Action — Federal Register","type":"regulatory","archive_url":"http://web.archive.org/web/20260317082439/https://www.federalregister.gov/documents/2026/03/17/2026-05114/notice-of-ofac-sanctions-action","credibility":1,"archive_timestamp":"2026-03-17T08:24:39+00:00"},{"url":"https://www.opensanctions.org/entities/NK-WMBfe4dSbSHU9ChvyRtTmk/","name":"Nguyen Quang Viet — OpenSanctions profile","type":"research","archive_url":"https://web.archive.org/web/20260924044558/https://www.opensanctions.org/entities/NK-WMBfe4dSbSHU9ChvyRtTmk/","credibility":1,"archive_timestamp":"2026-09-24T04:45:58+00:00"},{"url":"https://www.coindesk.com/business/2026/03/13/u-s-sanctions-6-people-2-companies-that-laundered-usd800-million-in-crypto-for-north-korea","name":"U.S. sanctions network that allegedly laundered $800 million in crypto for North Korea — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260409000414/https://www.coindesk.com/business/2026/03/13/u-s-sanctions-6-people-2-companies-that-laundered-usd800-million-in-crypto-for-north-korea","credibility":2,"archive_timestamp":"2026-04-09T00:04:14+00:00"},{"url":"https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company","name":"How North Korea laundered money through Vietnamese crypto company — Korea Times","type":"news_article","archive_url":"http://web.archive.org/web/20260417060815/https://www.koreatimes.co.kr/foreignaffairs/northkorea/20260416/how-north-korea-laundered-money-through-vietnamese-crypto-company","credibility":2,"archive_timestamp":"2026-04-17T06:08:15+00:00"},{"url":"https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html","name":"OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260901035414/https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html","credibility":2,"archive_timestamp":"2026-09-01T03:54:14+00:00"},{"url":"https://www.koreatimes.co.kr/world/20260313/us-sanctions-6-individuals-2-entities-over-n-korean-it-worker-fraud","name":"US sanctions 6 individuals, 2 entities over N. Korean IT worker fraud — Korea Times","type":"news_article","archive_url":"http://web.archive.org/web/20260317052100/https://www.koreatimes.co.kr/world/20260313/us-sanctions-6-individuals-2-entities-over-n-korean-it-worker-fraud","credibility":2,"archive_timestamp":"2026-03-17T05:21:00+00:00"},{"url":"https://cointelegraph.com/news/us-treasury-sanctions-north-korea-it-worker-crypto-fraud-network","name":"US Sanctions Ring Enabling North Korea IT Worker Fraud — Cointelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260422104734/https://cointelegraph.com/news/us-treasury-sanctions-north-korea-it-worker-crypto-fraud-network","credibility":2,"archive_timestamp":"2026-04-22T10:47:34+00:00"},{"url":"https://www.koreajoongangdaily.com/korea/us-sanctions-6-individuals-2-entities-for-roles-in-north-korean-it-worker-fraud-treasury-dept/12550196","name":"U.S. sanctions 6 individuals, 2 entities for roles in North Korean IT worker 'fraud' — Korea JoongAng Daily","type":"news_article","archive_url":"http://web.archive.org/web/20260714134813/https://www.koreajoongangdaily.com/korea/us-sanctions-6-individuals-2-entities-for-roles-in-north-korean-it-worker-fraud-treasury-dept/12550196","credibility":2,"archive_timestamp":"2026-07-14T13:48:13+00:00"},{"url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260420025036/https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","credibility":2,"archive_timestamp":"2026-04-20T02:50:36+00:00"},{"url":"https://www.financemagnates.com/trending/us-sanctions-north-korea-it-worker-network-vietnam-firm-accused-of-laundering-25m-crypto/","name":"US Sanctions North Korea IT Worker Network; Vietnam Firm Accused of Laundering $2.5M Crypto — Finance Magnates","type":"news_article","archive_url":"http://web.archive.org/web/20260320023559/https://www.financemagnates.com/trending/us-sanctions-north-korea-it-worker-network-vietnam-firm-accused-of-laundering-25m-crypto/","credibility":2,"archive_timestamp":"2026-03-20T02:35:59+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-23T23:25:04.793665+00:00","updated_at":"2026-09-24T04:46:15.383124+00:00"}}