Cheil Credit Bank
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·C5wCkr…YfcNSummary
Cheil Credit Bank, also known as First Credit Bank and formerly as Kyongyong Credit Bank, is a North Korean state-controlled financial institution headquartered in Pyongyang with representative offices in Beijing, Shenyang, and Shanghai. First designated by OFAC in September 2017 under Executive Order 13810 for operating in North Korea's financial services sector, the bank was dramatically re-expanded on November 4, 2025, when OFAC added 53 cryptocurrency addresses to its Specially Designated Nationals listing, linking it to over $12.7 million in USDT-TRC20 flows between June 2023 and May 2025 — funds attributed primarily to DPRK overseas IT workers and cybercrime proceeds destined for the regime's weapons programs.
Connected Entities
10 entities · 60 linked investigations- Korea Mangyongdae Computer Technology Company→mentioned with→Tether(70%)
- TraderTraitor / UNC4899→mentioned with→Bybit(70%)
- DPRK→mentioned with→TraderTraitor / UNC4899(70%)
- North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→TraderTraitor / UNC4899(70%)
- Xinbi Guarantee→mentioned with→TRON(70%)
- Cheil Credit Bank→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- Cheil Credit Bank→mentioned with→Korea Mangyongdae Computer Technology Company(80%)
- Cheil Credit Bank→mentioned with→Huione Group(80%)
- Cheil Credit Bank→mentioned with→Xinbi Guarantee(80%)
- Bybit→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- + 13 more
Connected Through
10 shared actors · 268 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Tetherorganization
- □North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaignorganization
- □TRONorganization
- □TraderTraitor / UNC4899organization
Timeline(12 events)
21 September 2017
President Trump signs Executive Order 13810, authorizing broad sanctions against North Korea's financial sector following DPRK's sixth nuclear test on September 3, 2017.
U.S. Treasury / Federal Register26 September 2017
OFAC designates Cheil Credit Bank (First Credit Bank) to the SDN list under E.O. 13810 for operating in North Korea's financial services sector. Bank is assigned SDN ID 22985 and DPRK4 program code.
OFAC Recent Actions7 November 2017
Japan's Ministry of Finance independently designates Cheil Credit Bank under its own DPRK sanctions regime.
OpenSanctions — Cheil Credit Bank entity recordJune 2023
Approximate start of the period during which OFAC-designated Cheil Credit Bank cryptocurrency addresses began receiving USDT inflows consistent with IT worker salary disbursements. Activity would continue through May 2025.
TRM Labs — US Treasury Sanctions DPRK BankersDecember 2023
Australia designates Cheil Credit Bank under its DPRK Sanctions Regime.
OpenSanctions — Cheil Credit Bank entity record21 February 2025
North Korea's Lazarus Group hacks Bybit exchange for approximately $1.5 billion in cryptocurrency, the largest crypto heist in history. FBI confirms attribution to TraderTraitor/APT38. Funds are laundered through thousands of wallets and cross-chain bridges.
TRM Labs — The Bybit HackApril 2025
Approximate start of Tether's proactive blocklisting operation targeting DPRK-linked addresses. 26 of the 53 Cheil Credit Bank cryptocurrency addresses are blocklisted by Tether in April–May 2025, freezing a portion of the active balances.
Elliptic — OFAC lists 53 crypto addresses of sanctioned North Korean Cheil Credit BankMay 2025
FinCEN designates Huione Group as a primary money laundering concern under Section 311 of the U.S. Patriot Act. Cheil Credit Bank cryptocurrency addresses show on-chain exposure to Huione Pay and Huione Guarantee.
Money Laundering Watch — FinCEN Bars Huione Group4 November 2025
OFAC adds 53 cryptocurrency addresses (primarily USDT TRC-20 on the Tron blockchain) to Cheil Credit Bank's SDN listing. Simultaneously designates bank employees Jang Kuk Chol and Ho Jong Son for managing approximately $5.3 million in cryptocurrency on the bank's behalf. Korea Mangyongdae Computer Technology Company, Ryujong Credit Bank, and five additional DPRK banking representatives are designated in the same action. Collective inbound flows to the 53 wallets totaled over $12.7 million (June 2023 to May 2025). Balance at time of designation: approximately $5.4 million.
OFAC Recent Actions — November 4, 20254 November 2025
U.S. Department of State issues concurrent statement describing Cheil Credit Bank's cryptocurrency network as part of the DPRK's sanctions-evasion architecture funding WMD and ballistic missile programs.
U.S. Department of State — Disrupting Illicit DPRK Bankers17 November 2025
Federal Register publishes formal notice of the November 4, 2025 OFAC sanctions action adding 53 cryptocurrency addresses to Cheil Credit Bank's SDN record.
Federal Register — Notice of OFAC Sanctions ActionDecember 2025
Chainalysis and Elliptic year-end reporting places total DPRK cryptocurrency theft in 2025 at approximately $2.02 billion — a record annual figure — out of $3.4 billion stolen across all actors globally. DPRK attacks account for 76% of all crypto service compromises by value.
Chainalysis — 2025 Crypto Theft Reaches $3.4 BillionDecision Log
- slot 445505484 · hash QJ44dcEiSfXFe1BuNn2Cynak2S3cCfJSCwbVF6eSt3P
- slot 426293876 · hash GjfxYLHjbQza9GdY8rVSMrmpHPRHArGSPVcAJr5GAcaU
- slot 426293872 · hash CQNQFLbKdTtRsaYKiFUxz9zcFQVPBgQz2WoBz8ubfv4c
- slot 423915064 · hash GAZLtZUiyc2MstPp4fptLwk1YK41GdY9ycqGdz1V3ajT
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 23 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/3/2026, 12:07:57 AM
last updated: 6/3/2026, 12:07:57 AM
6 viewsavoid.net — verified advice for a post-truth world