# Kim Jong-un, the Regime That Traded Gold for Stablecoins

> Some reports slip by unnoticed. Others should wake up every foreign ministry in the West. The one published on June 29, 2026

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Profile
- Published: 2026-07-05
- Canonical URL: https://mad-max.co/en/article/kim-jong-un-le-regime-qui-a-troque-l-or-contre-les-stablecoins

## Introduction: an isolated country, a **digital currency**

### A report that should unsettle

Some reports slip by unnoticed. Others should wake up every foreign ministry in the West. The one published on **June 29, 2026** by the **Chosun Ilbo** clearly belongs to the second category. It documents, in black and white, how **North Korea** has turned its longstanding dependence on stolen currency into a sophisticated **laundering** system running through **stablecoins** — **cryptocurrencies** pegged to the **US dollar** that promise stability and relative anonymity.

This is not a technical footnote for decentralized-finance enthusiasts. It is the portrait of a **regime** that understood, faster than many **democratic governments**, how to exploit the cracks in a global financial system still poorly prepared for the digital-asset revolution. The central figure of this story has no clear media face: it is a state apparatus, the **Office 221**, front companies like **Sinyang**, and, in the background, **Kim Jong-un**, whose **nuclear program** depends directly on these parallel **financial flows**.

### Why this portrait matters now

The shift is stark. According to **Chainalysis**, the crypto-analytics firm, **84 percent** of crimes tied to virtual assets in 2025 involved stablecoins, compared with a share dominated at **72 percent** by Bitcoin back in 2020. In five years, Bitcoin has fallen to just **16 percent** of this criminal usage. The message is unambiguous: criminals, like rogue states, follow stability and efficiency, not speculation.

*I will say it plainly: it took us years to understand that North Korea was not simply an isolated dictatorship armed with rusting missiles, but a formidably agile financial actor. While our regulators debated the legal definition of a digital token, Pyongyang was building an almost industrial architecture for evading sanctions.*

## Office 221, the quiet heart of the system

### A little-known but central unit

**Office 221** is not a name found in mainstream geopolitics textbooks, and that is precisely the problem. This North Korean structure was identified by the **Chosun Ilbo** as having attempted, in **2024**, to sell several tons of gold in order to obtain roughly **300 million dollars** in **Tether**, the world's largest stablecoin by market capitalization.

The operation illustrates a clear logic: convert a traditional physical asset, gold, into a liquid digital asset that can be moved across borders without passing through the monitored **international banking system**. **Sinyang**, another North Korean company, reportedly attempted that same year to pay for **Russian fuel** directly in Tether, sidestepping the classic banking clearance mechanisms that Western sanctions can block.

### The UN documents it, experts confirm it

In **October 2025**, a **United Nations** report had already detailed concrete cases in which North Korea actively used Tether in illegal transactions involving **weapons** and fuel. This is not a hypothesis floated by overzealous journalists: it is a reality documented by the very international body meant to oversee sanctions enforcement.

The **UN Panel of Experts on North Korea** has further estimated, in its annual reports, that a material share of funding for North Korea's **ballistic missile** and nuclear weapons programs comes directly from stolen cryptocurrency, according to an analysis relayed by the specialized platform **sanctions.io**.

*One detail strikes me: Tether's apparent solidity, theoretically backed by dollar reserves, becomes the perfect tool for a pariah regime. Without intending to, we created the ideal currency for sanctions evasion: stable, liquid, hard to freeze entirely. The irony is bitter.*

## Lazarus Group, Pyongyang's digital armed wing

### A track record that induces vertigo

It is impossible to discuss North Korean financial crime without mentioning the **Lazarus Group**, the unit attached to North Korea's **Reconnaissance General Bureau**. According to the **sanctions.io** report published on **June 10, 2026**, actors linked to North Korea stole **2.02 billion dollars** in cryptocurrency during **2025** alone, a **51 percent** increase over the previous year.

The historical cumulative total now stands at **6.75 billion dollars**. More striking still: through **April 2026**, roughly **76 percent** of all major cryptocurrency thefts were attributed to North Korean hackers. These figures are not journalistic exaggeration; they come from a firm specializing in **compliance** and financial sanctions analysis.

### The heist of the century: the Bybit affair

The most emblematic theft remains the one targeting the exchange **Bybit**, in **February 2025**: **1.5 billion dollars** in **Ethereum** stolen, making it the largest cryptocurrency theft in history. The **FBI** attributed the operation to the **TraderTraitor** subgroup, linked to Lazarus Group.

The method is chillingly precise: attackers compromised the laptop of a developer working at **SafeWallet**, the multisignature infrastructure provider used by Bybit, manipulating the **cold wallet** signing process to redirect roughly **500,000 ETH** to attacker-controlled addresses. Another exploit, targeting **Kelp DAO** in **April 2026**, siphoned off an additional **292 million dollars**.

*What worries me most about the Bybit affair is not the amount, staggering as it is. It is the sophistication of the **social engineering**: fake **recruiters**, rigged **hiring tests**, a compromised software supply chain. This is no longer a lone hacker in a basement — it is a state intelligence service organized like a multinational crime syndicate.*

## The laundering machinery explained

### Four well-oiled steps

The **sanctions.io** report details a four-step laundering typology now well identified by analysts in 2026. First, a **rapid cross-chain move**: within hours of a theft, funds are shifted to **Ethereum**, where mixing and liquidity options are greater.

Next comes the use of **alternative mixing services** operating outside US jurisdiction, since **Tornado Cash** was taken offline. The third step is systematic **chain-hopping**: funds move from **Ethereum** to **Avalanche**, then **Binance Smart Chain**, then **Bitcoin**, via bridges and decentralized exchanges with no **identity verification**.

### The final conversion into cash

The last step is **conversion into real currency** through over-the-counter desks, particularly in **Southeast Asia** and the **Middle East**, regions where regulatory coverage of crypto-to-fiat conversion remains thinner. This is where stablecoins play an essential anchoring role: their dollar-pegged value greatly simplifies these complex transactions.

Regulated platforms impose strict identity verification, comparable to that of **traditional banks**. But the decentralized nature of blockchain makes it easy to move funds to **off-platform wallets**, where laundering becomes far simpler, according to the **Chosun Ilbo**.

*I am not a blockchain engineer, and I will not pretend to master every technical gear of this system. But you do not need a doctorate to grasp the essentials: every link in this chain exists because some jurisdiction, somewhere, looks away — willingly or through negligence.*

## The fake IT-worker program

### From job application to infiltration

Another part of the North Korean apparatus deserves attention: the **IT worker program**. What began with agents applying for remote jobs at cryptocurrency companies has evolved into orchestrated fake hiring processes aimed directly at prestigious **Web3** and **artificial intelligence** firms.

The goal is clear: obtain **access credentials**, **source code**, and internal **VPN** access. In **March 2026**, new **OFAC** designations — the US sanctions body — specifically targeted wallet addresses, front companies, and individuals tied to this program.

### A permanent adaptation to sanctions

What strikes financial-security analysts is the regime's **capacity to adapt**. After **OFAC** designated the **Lazarus Group** on the specially designated nationals list on **April 14, 2022**, and after Tornado Cash co-founder **Roman Storm** was convicted in **August 2025** for sanctions violations, Pyongyang never stopped adjusting its methods.

The **UN Panel of Experts** continues to document these operations in its annual reports with specific transaction analyses. The **European Union** and the **United Kingdom** also maintain consolidated sanctions lists modeled on UN designations.

*We would like to believe sanctions work simply because they exist on paper. The harder truth is this: a state can survive, even thrive financially, as long as it finds technological loopholes faster than regulators can close them.*

## A geopolitical backdrop that makes everything worse

### North Korea is not acting alone

It would be naive to treat this parallel financial system as an isolated phenomenon. **North Korea** maintains growing economic and military ties with **Russia**, notably through the documented attempts to pay for Russian fuel in Tether via Sinyang. This convergence between sanctioned regimes illustrates a broader trend: the formation of an alternative financial ecosystem among states hostile to the Western-led international order.

**China**, though not directly named in the transactions documented by the Chosun Ilbo, remains historically the preferred transit route for a large share of North Korean financial flows, legal or otherwise. This sanctions-evasion architecture structurally benefits every actor seeking to weaken Western influence over the global financial system.

### The risk of methodological contagion

What should worry us beyond the North Korean case is the possibility that other regimes, particularly **Iran**, could draw on this methodology for their own sanctioned financing needs. Stablecoin laundering mechanisms are not proprietary to Pyongyang: they are techniques replicable by anyone with the necessary technical skills.

Economic experts cited by the **Chosun Ilbo** flag precisely this systemic risk and call for stricter regulation, even as the crypto industry itself fears this could dilute the main advantage of stablecoins: enabling fast transactions outside traditional centralized financial networks.

*Here is the dilemma few dare to state bluntly: the same technology that could democratize global finance also serves as a lifeline for the world's worst regimes. You cannot applaud the innovation on one hand and look away from its abuse on the other.*

## The Western regulatory response, still timid

### Tools that exist but remain insufficient

American authorities have not been entirely passive. **OFAC** regularly publishes blacklists of wallet addresses following major attribution events, as it did after the Bybit hack. The **FBI** has also issued public service announcements including wallet blocklists representing the most current public intelligence on active laundering addresses.

But these measures consistently arrive after the fact, never ahead of it. The sanctions.io report specifically recommends that crypto compliance teams monitor **chain-hopping** patterns, the use of bridges without identity verification, and new wallets receiving large transfers with no prior history.

### Concrete recommendations from experts

Among the practical recommendations are real-time alerts for any deposit originating from addresses newly listed on OFAC or FBI blocklists, along with heightened scrutiny of transactions involving mixing services, even those not yet formally sanctioned.

Major centralized exchanges should, according to these same recommendations, impose mandatory holding periods on large withdrawals to new addresses and real-time OFAC screening as a baseline requirement. These measures exist in theory, but their application remains uneven across **jurisdictions**.

*I do not claim to have a miracle solution to this problem. What I observe is that every time a regulator closes one door, three windows open elsewhere. The fight against North Korean illicit financing looks like a perpetual game of catch-up that the West is slowly losing.*

## What this means for global security

### The direct link to nuclear weapons

It bears repeating plainly: according to analyses from the **UN Panel of Experts** relayed by sanctions.io, funds from stolen cryptocurrency finance a material share of North Korea's ballistic missile and nuclear weapons programs. This is therefore not a purely financial or technical matter — it is a direct international security issue.

Every **dollar laundered** through Tether or any other stablecoin represents a potential additional dollar available to fund the military ambitions of **Kim Jong-un's** regime, in a context where the Korean peninsula remains one of the most militarized zones on the planet.

### A threat that goes beyond North Korea alone

This case also illustrates a broader truth about the world of 2026: authoritarian regimes, whether North Korea, Iran, or potentially other hostile actors tomorrow, now have access to financial tools that let them bypass a sanctions system designed for a pre-crypto world. The West must urgently close this regulatory gap.

The technological competition between democracies and authoritarian regimes is no longer fought only on military or industrial ground, but also on the quieter terrain of digital financial engineering. It is a front too few Western citizens still perceive as a priority.

*If I had to sum up this case in one sentence, it would be this: while we debate cryptocurrency regulation in our parliaments at democracy's usual slow pace, dictatorships are already using it as a financial weapon. Time is clearly not on our side.*

## The crypto industry's ambiguous role

### Between innovation and complacency

The cryptocurrency industry finds itself in a delicate position. On one hand, it fiercely defends the qualities of stablecoins: speed, low transaction costs, global accessibility. On the other, it must acknowledge that those same qualities make them the ideal laundering tool for actors like North Korea.

According to the **Chosun Ilbo**, the crypto industry fears precisely that overly strict **regulation** could dilute the unique advantage of stablecoins — enabling fast transactions outside traditional centralized financial networks. This tension between commercial innovation and **national security** has not yet found a satisfying resolution.

### Exchanges under pressure

Major exchanges find themselves on the front line. They must show regulators they have robust screening systems in place, while continuing to offer a competitive service against rivals that are sometimes less scrupulous, operating from jurisdictions with permissive regulation.

The case of **Bybit**, victim of the largest cryptocurrency theft in history despite its status as a regulated platform, shows that even the most serious players in the sector remain vulnerable to the growing sophistication of North Korean state-backed attacks.

*I remain skeptical of the crypto industry's promises of self-regulation. Recent history shows that commercial interests and national security rarely align spontaneously, without firm regulatory intervention.*

## Lessons for **Western democracies**

### Investing in digital **financial surveillance**

This North Korean case should serve as a wake-up call for Western democracies. It is no longer enough to sanction after the fact: massive investment is needed in digital financial surveillance capabilities, training experts able to track blockchain flows in real time, and better coordinating efforts among **OFAC**, the **UN**, the **European Union**, and the **United Kingdom**.

The current fragmentation of sanctions regimes, even where they largely overlap, leaves exploitable gaps for actors as determined as the Pyongyang regime. Stronger **coordination** among allied jurisdictions would represent a significant step toward closing those gaps.

### Strengthening **international cooperation**

Beyond technical measures alone, this case calls for deeper diplomatic cooperation among **Western allies** to financially isolate regimes that, like North Korea, use these techniques to fund weapons programs representing a direct threat to international security.

**Transparency** around these mechanisms, like that provided by the Chosun Ilbo report, is an essential first step. Without clear public information on the scale of the phenomenon, it becomes difficult to mobilize public opinion and **policymakers** around ambitious corrective measures.

*I believe deeply that journalistic transparency on these dry, technical subjects remains an underrated tool. If the public understood better how this system works, the political pressure to act would likely be far stronger than it currently is.*

## The relative silence of the great powers

### **Washington** amid competing priorities

It is also worth noting Washington's relative silence on this specific dossier, compared with the media attention devoted to other geopolitical crises. American authorities, absorbed by multiple simultaneous diplomatic and military fronts, may not be giving this financial question the attention it deserves.

This does not mean total inaction: the OFAC designations of **March 2026** attest to that. But the pace of the regulatory response appears structurally slower than the pace of innovation among **malicious actors**, an imbalance that should alarm Western policymakers more than it currently does.

### Europe, spectator more than actor

The European Union, for its part, keeps its sanctions lists aligned with those of the UN, but remains largely a follower rather than an initiator on this specific North Korean stablecoin dossier. A more proactive posture from European regulators would likely help close some of the gaps identified by compliance experts.

The United Kingdom, through its sanctions body OFSI, follows a similar trajectory of mirroring UN designations, without a particularly distinct initiative on the specific question of North Korean stablecoins at this stage.

*I am not laying blame solely on the Europeans here. But I notice, year after year, the same dynamic: the United States sets the pace of sanctions, and the rest of the Western world follows with a lag that is often costly in terms of effectiveness.*

## The human factor behind the numbers

### Engineers under duress

Behind these staggering numbers are individuals: North Korean developers and engineers recruited by force or economic necessity into this vast state **cybercrime** apparatus. The fake IT-worker program documented by sanctions.io suggests a pool of technical talent mobilized in service of geopolitical objectives far beyond their control.

We do not know, and it must be admitted honestly, to what extent these individuals act out of ideological conviction, regime coercion, or simple economic survival in a system where refusing to cooperate with the state can carry grave consequences for them and their families.

### The system's indirect victims

Nor should we forget the indirect victims of this system: users of platforms like Bybit whose funds were compromised, Web3 companies targeted by fake recruiters, and more broadly the public's trust in an already reputationally fragile crypto ecosystem.

Every major documented theft, every new sanctions-evasion technique revealed, erodes a little more of the trust needed for cryptocurrencies to one day fulfill their original promise of financial inclusion rather than serve as a favored tool for the world's worst regimes.

*I retain a degree of empathy, even facing this damning dossier, for the individuals caught in this North Korean state machinery. That changes nothing about the need to sanction the system as a whole, but we too often forget the human being behind the machine.*

## Toward an inevitable technological race

### Artificial intelligence enters the equation

One final element deserves mention: the growing sophistication of the social-engineering methods used by Lazarus Group, including fake Zoom interviews, fraudulent Calendly links, and rigged code-review requests, suggests increasing use of automated tools, potentially assisted by artificial intelligence, to industrialize these **compromise** campaigns.

This technical evolution signals a likely **escalation** in the months ahead, where the adaptation speed of malicious actors could accelerate further, making the task facing Western compliance and security teams ever more complex.

### An issue that goes beyond finance alone

At its core, this North Korean stablecoin dossier is just one facet of a much larger challenge: the West's ability to maintain its **technological edge** and regulatory pace against **adversaries** who have neither ethical scruples nor democratic constraints to slow their malicious innovation.

It is a stark reminder that national security in the twenty-first century is fought as much in lines of code and **digital wallets** as on traditional battlefields.

*I close this section convinced of one thing: we are still at the very beginning of this digital financial battle, and the West has fallen behind in a way it will need to make up quickly if it wants to prevent other hostile regimes from following North Korea's example with comparable success.*

## The Iranian precedent to watch closely

### A convergence of sanctioned regimes

The North Korean case should not be viewed in isolation from a broader movement. **Iran**, also subject to severe **international sanctions** for decades, has likewise explored similar evasion mechanisms through cryptocurrency, according to several compliance analyses referenced in the **sanctions.io** report. The logic remains identical: turn a traditional asset blocked by sanctions into a fluid, transferable digital asset.

This methodological convergence between **Tehran** and **Pyongyang** illustrates a phenomenon Western analysts are only now beginning to map seriously: the emergence of genuine shared know-how among pariah regimes on best practices for digital financial evasion. This is no longer merely a bilateral matter between the United States and North Korea, but a systemic issue involving several simultaneous adversaries of the Western-led international order.

### Russia, the quiet financial accomplice

The documented attempts by **Sinyang** to pay for Russian fuel in Tether also confirm that **Russia** participates, at least passively, in this parallel financial ecosystem. Moscow, itself under massive Western sanctions since the invasion of Ukraine, shares with Pyongyang a common structural interest: weakening the effectiveness of the dollar-based sanctions system and Western financial institutions.

This convergence between **Russia**, **North Korea**, and potentially **Iran** outlines the contours of an informal financial bloc, united not by shared ideology but by a shared interest in circumventing Western financial dominance. It is a development Western **strategists** can no longer afford to underestimate, given that its implications extend well beyond the Korean peninsula alone.

*What alarms me most about this convergence is its organic rather than orchestrated nature. These regimes do not need to sign a treaty to cooperate financially: their interests converge naturally against the Western sanctions architecture, and that is precisely what makes a collective response so hard to coordinate.*

## Conclusion: a portrait meant as a warning

### An elusive but not invincible regime

The portrait that emerges of financial **North Korea** in 2026 is that of a paradoxical regime: diplomatically isolated, economically impoverished for its population, yet formidably agile in the field of emerging financial technologies. **Office 221**, the **Lazarus Group**, and front companies like **Sinyang** together form an apparatus that has managed to turn the constraint of sanctions into an opportunity for criminal innovation.

But this regime is not invincible. Repeated **OFAC** designations, growing coordination between Western intelligence agencies and blockchain analysis firms like **Chainalysis**, and increased **vigilance** from major exchanges show that a **coordinated response** remains possible, provided the necessary resources are committed.

### What the West must remember

The main lesson of this case is simple to state but hard to implement: the pace of **technological innovation** among hostile regimes today outstrips the pace of the Western regulatory response. Closing this gap will require sustained investment, stronger international coordination, and political will that, for now, still seems insufficient given the true scale of the threat.

North Korea's nuclear program does not finance itself. Every dollar laundered through a stablecoin is a dollar that potentially fuels that program. That may be the single most important sentence to remember from this dossier, and the one that should guide the priorities of Western decision-makers in the months ahead.

*I close this portrait with a simple conviction: financial vigilance has become a pillar of Western defense, on par with tanks or fighter jets. Ignoring this digital front would mean leaving a door wide open to regimes that have fully grasped its strategic importance.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- Chosun Ilbo, North Korea Leverages Stablecoins for Sanctions Evasion — June 29, 2026

- Sanctions.io, The Lazarus Group and DPRK Crypto Theft in 2026 — June 10, 2026

### Secondary sources

- Reuters, regional context on threats from authoritarian regimes in Asia — July 3, 2026

- Institute for the Study of War, China Taiwan Update — July 2, 2026

- USA Today, context on US government transparency issues — July 2, 2026

- Anadolu Agency, context on Western defense coordination — June 29, 2026

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/kim-jong-un-le-regime-qui-a-troque-l-or-contre-les-stablecoins