A US federal judge has ordered the forfeiture of one cryptocurrency wallet in the Justice Department’s North Korean IT worker case and denied the other seven tranches sought. The reason was not the evidence.
The government published its public notice of forfeiture listing a single address. The court found that notice did not describe the remaining property with reasonable particularity, as the rules require, and denied that portion without prejudice.
Judge Rudolph Contreras of the US District Court for the District of Columbia issued the memorandum opinion on September 3 in United States v. Virtual Currency Associated with North Korean IT Worker Money Laundering and Sanctions Evasion Conspiracies, case 25-cv-1769.
What Was Forfeited
The granted portion covers funds seized from the unhosted address 0x81c4d8816b29147c542dDE87485608204690Acf2, taken from Circle Internet Financial on September 30, 2022.
According to the complaint, that address received approximately 158,122.85 USDC across two separate blockchains from at least 10 addresses used by North Korean IT workers to receive payment, plus 54,574 USDT from at least four such addresses.
The court granted forfeiture under 18 U.S.C. § 981(a)(1)(C), covering property traceable to violations of the International Emergency Economic Powers Act. Having found that theory sufficient, it did not reach the government’s alternative money-laundering ground.
Why the Rest Failed
Supplemental Rule G requires the government both to publish public notice and to send direct notice to potential claimants. Publication may be made on an official forfeiture website for at least 30 consecutive days and must describe the property with reasonable particularity.
The government published on forfeiture.gov from October 21 to November 19, 2025. That notice identified only 0x81c4. The court found it did not reference, much less describe, the other property, that no additional publication appeared in the record, and that the government had not argued any exception applied.
The rule exempts property worth less than $1,000 where direct notice has been sent, but the court said it could not determine which of the remaining accounts, if any, would qualify. The denial is without prejudice.
Direct notice was satisfied for 0x81c4. The government emailed Kim Sang Man and Sim Hyon Sop on June 16, 2025, and the court noted that email is appropriate for international defendants whose locations are hard to establish and where the alleged conduct implies cyber-proficiency.
The Eight Tranches
The property sought comprised Sim Hyon Sop’s virtual currency wallet, two Binance accounts belonging to Kim Sang Man, a Binance account believed to be controlled by Sim, a Binance account holding funds from IT worker payment addresses, and unhosted addresses serving as payment or consolidation points. Some had been seized into US government wallets, others frozen pending the action.
The complaint describes the flow: unwitting employers pay North Korean IT workers in stablecoins to addresses the workers nominate, funds move to consolidation addresses where earnings are commingled, and from there to Kim’s Binance accounts or Sim’s wallet.
Sim is identified as a North Korean Foreign Trade Bank official, and Kim as the chief executive of an organization subordinate to the North Korean Defence Ministry. Both are on OFAC’s Specially Designated Nationals list.
Nobody Contested It
No claimant responded to the complaint, which the government filed on June 5, 2025. The deadline for verified claims in response to the published notice was December 19, 2025, and none were filed. The Clerk of Court entered default on March 23, 2026.
On a default judgment the well-pleaded allegations are taken as true, but default does not automatically entitle the government to judgment—the complaint must still state a claim. The court found the pleading standard met for 0x81c4, describing it as not particularly onerous, and satisfied that the government could identify the parties and their connection to the scheme.
The Crypto Times has reported on Treasury sanctions against this network and on research documenting how DPRK workers obtain developer roles using fabricated identities.
Also Read: BNB Chain DEX Router Reportedly Drained of 62 WBNB in Exploit
