Korea Mangyongdae Computer Technology Company
Summary
Korea Mangyongdae Computer Technology Company (KMCTC) is a North Korean state-linked IT firm sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on November 4, 2025, for operating overseas IT worker delegations in China and using Chinese nationals as banking proxies to launder proceeds from fraudulent employment and cybercrime schemes. The company is operated under the MAEI 607 Management Office, which connects it to the DPRK's military-industrial apparatus, and its IT workers are alleged to have generated hundreds of millions of dollars annually for the North Korean regime's weapons programs. KMCTC and its president, U Yong Su, are designated on the U.S. SDN list under Executive Order 13810.
Connected Entities
1 entities · 10 linked investigations- + 2 more
Timeline(13 events)
2017-09-01
Cheil Credit Bank (also known as First Credit Bank) first designated by OFAC on the SDN list, establishing a regulatory baseline for the banking infrastructure later used to launder KMCTC IT worker proceeds.
Elliptic — OFAC Lists 53 Crypto Addresses of Sanctioned North Korean Cheil Credit Bank2018-01-01
UN Sanctions Monitoring Team begins documenting DPRK IT worker revenue-generation schemes, later estimating $250–$600 million generated annually from this period onward.
TRM Labs — US Treasury Sanctions DPRK Bankers and Front Companies2023-05-01
OFAC and South Korea's Ministry of Foreign Affairs sanction Chinyong Information Technology Cooperation Company for employing DPRK IT workers abroad, a precedent action for the KMCTC designation.
Chainalysis — North Korea IT Workers: Inside the DPRK's Crypto Laundering Network2023-06-01
Cheil Credit Bank-linked cryptocurrency wallet addresses begin receiving sustained inbound flows. Over the subsequent two years (June 2023 – May 2025), these addresses collectively receive more than $12.7 million, reflecting patterns consistent with IT worker salary payments.
TRM Labs — US Treasury Sanctions DPRK Bankers and Front Companies2025-01-01
OFAC sanctions Korea Osong Shipping Co. and Chonsurim Trading Corporation for sending DPRK IT workers to Laos, part of the expanding enforcement campaign against DPRK IT worker front companies.
North Korean Remote Worker Scheme — Wikipedia2025-02-01
Lazarus Group executes the Bybit hack, stealing approximately $1.5 billion in a single operation using hybrid techniques combining embedded IT workers and credential theft.
From Digital Kleptocracy to Rogue Crypto-Superpower — 38 North2025-04-01
Tether blacklists 26 cryptocurrency addresses associated with Cheil Credit Bank prior to OFAC's formal designation, an early compliance response that precedes official regulatory action.
Elliptic — OFAC Lists 53 Crypto Addresses of Sanctioned North Korean Cheil Credit Bank2025-11-04
OFAC designates Korea Mangyongdae Computer Technology Company and its president U Yong Su on the SDN list pursuant to E.O. 13810. Eight individuals and two entities total are designated in the same action, including Ryujong Credit Bank and five financial representatives in China and Russia. OFAC simultaneously adds 53 cryptocurrency addresses to Cheil Credit Bank's SDN entry.
U.S. Department of the Treasury — Press Release SB03022025-11-04
U.S. Department of State issues a concurrent statement on disrupting illicit DPRK bankers and institutions laundering cybercrime and IT worker funds, reinforcing the Treasury action with a foreign policy framing.
U.S. Department of State — Disrupting Illicit DPRK Bankers and Institutions2025-11-17
Federal Register publishes OFAC's formal notice of the sanctions action (document 2025-19924), providing the official public record of KMCTC's SDN designation.
Federal Register — Notice of OFAC Sanctions Action2025-12-01
North Korea-linked hackers are reported to have stolen approximately $2.02 billion in cryptocurrency in 2025 — a 51% year-over-year increase — pushing the DPRK's all-time theft total to an estimated $6.75 billion.
The Hacker News — North Korea-Linked Hackers Steal $2.02 Billion in 20252026-01-01
The U.S. and members of the Multilateral Sanctions Monitoring Team (MSMT) at the United Nations publish a report highlighting the DPRK's violations and evasions of UN sanctions through cyber and IT worker activities, referencing the broader ecosystem in which KMCTC operates.
U.S. Department of State — DPRK Violations and Evasions of UN Sanctions2026-03-12
OFAC issues a new round of sanctions targeting six individuals and two entities for DPRK IT worker fraud schemes, including Amnokgang Technology Development Company. The action confirms that the IT worker enforcement campaign continues beyond the November 2025 KMCTC designation.
Chainalysis — OFAC Targets DPRK IT Workers Using Crypto (March 2026)Decision Log
- hash: FuMgGoo9pTjhskToZevJcyuc5KA7DQRn7pXte2NnGFuy
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/3/2026, 12:08:02 AM
last updated: 6/3/2026, 12:08:07 AM
avoid.net — verified advice for a post-truth world