US Targets $15 Million in USDT Tied to North Korean Hacking Operations

The US Department of Justice is moving to permanently seize more than $15 million in USDT tied to North Korean hackers, escalating efforts to disrupt Pyongyang’s reliance on crypto theft and covert IT operations.

The action targets two civil forfeiture complaints involving Tether stolen in multiple 2023 breaches attributed to APT38, a state-sponsored hacking unit known for striking crypto platforms.

Authorities say the funds came from hacks on four platforms in 2023 and were first seized by the FBI in March 2025. If a federal court approves the forfeiture, the recovered crypto will be returned to victims. The hacked platforms were not officially named, but the incidents line up with major attacks that year, including breaches of Poloniex, CoinsPaid, Alphapo and a Panama-based exchange.

Investigators say North Korean operatives used mixers, cross-chain bridges, exchanges and OTC brokers to disguise the stolen funds. The crackdown goes beyond crypto wallets. Four US citizens pled guilty to wire fraud conspiracy for letting North Korean IT workers use their identities to land remote jobs at American companies. A Ukrainian national also pled guilty to selling stolen identities, facilitating access to 40 firms.

Officials say these schemes touched 136 US companies and generated more than $2.2 million for North Korea, which increasingly depends on cybercrime to evade sanctions. Analysts estimate the country’s hackers have already stolen over $2 billion in 2025.

Image Credit: Pixabay