The $216,000 paid in cryptocurrency was supposed to go to the coder in Singapore. Instead, it went to a North Korean digital wallet called Sim Hyon Sop, according to crypto-analytics firm TRM Labs, which tracked the transaction.
US prosecutors allege that Sim Engaged in money laundering and sanctions evasion on behalf of the Kim Jong Un regime.
According to two US indictments against him, Sim allegedly used the money to buy communications equipment and a helicopter for Pyongyang. According to the third US indictment against him, he once paid more than $800,000 in $100 tobacco bills to help North Korea make counterfeit cigarettes.
The FBI is offering millions of dollars for his arrest.
Efforts to reach Sim, who US officials say is living in China, were unsuccessful.
According to US officials, Sim is one of several dozen North Korean bankers working abroad who are trying to ensure that Pyongyang’s financial needs are met despite heavy sanctions aimed at completely isolating the country. Thanks to those bankers, North Korea has increased connectivity to the world financial system, according to the Paris-based Financial Action Task Force, which sets standards for anti-money laundering rules.
every year, thousands of secret North Korean employees And cyber thief US law-enforcement officials and cybersecurity analysts say hundreds of millions of dollars were ill-gotten money for Pyongyang from places like Russia, China and Africa. That cash is used to buy luxury goods and fund Kim’s weapons arsenal.
But the money must be laundered and spent in ways that hide all traces of North Korea, otherwise it will be blocked. That’s where people like Sim come in, according to US authorities, who as part of their investigation accessed Sim’s emails and a spreadsheet in which he listed transactions.
He says most of the money transferred through SIMs affects the US financial system, which clears US dollar transactions. In one of Sim’s schemes, U.S. banks including Citibank, JPMorgan and Wells Fargo unknowingly processed at least 310 transactions worth about $74 million for Pyongyang, according to an indictment and related court documents.
Citibank, JPMorgan and Wells Fargo declined to comment.
In a statement to The Wall Street Journal, Jeanine Pirro, the U.S. attorney for the District of Columbia, vowed to “vigorously investigate and charge North Korean agents who use American bank facilities and American infrastructure to defraud the United States, in order to generate revenue for weapons of mass destruction.”
It is proving almost impossible to catch the SIM. The US Treasury, which approved the SIM in 2023, said it moved to Dandong, China after it was expelled from the UAE in 2022. UN sanctions that took effect in late 2019 bar member states from hosting North Korean workers.
China is unaware of SIM’s activities and is opposed to unilateral US Treasury sanctions, Beijing’s Foreign Ministry said in a statement to the Journal.
going forward
Although much is unknown about Sim, the US Justice Department said he is 42 and 6 feet 1 inch tall – unusually tall for someone from North Korea, where the average male height is 5 feet 4 inches.
He attended an elite university in Pyongyang, where he likely learned English and Chinese, according to Ryu Hyon Woo, North Korea’s former acting ambassador to Kuwait, who says he met Sim more than 10 times before moving to South Korea in 2019.
Ryu’s job in Kuwait included facilitating visas for all North Koreans living in the Middle East at the time. It also includes monitoring the movements of North Koreans – who are allowed to leave their home country only with government permission – to ensure that they have fulfilled obligations to Pyongyang and have not fled the country.
Ryu and US officials say Sim was sent abroad to represent an affiliate of North Korea’s state-run Foreign Trade Bank, which is in charge of the regime’s foreign exchange transactions.
The bank, like others on North Korea, is subject to international sanctions for funding Pyongyang’s weapons program. Efforts to obtain comment from the bank were unsuccessful. North Korea has called the sanctions against the country “a foolish attempt to isolate and suppress it economically and to overthrow the socialist system chosen by its people.”
According to the Financial Action Task Force, by mid-2024, more than 50% of North Korean bankers were working outside the country.
In 2016, Sim arrived in the United Arab Emirates, where he lived for some time with his wife and daughter. Ryu said many North Koreans worked as computer programmers in the country and some stole crypto—and someone had to handle their funds.
Ryu said that when he traveled from Kuwait to Dubai, Sim would pick him up in a Toyota Land Cruiser and they would often dine with other North Korean operatives. He said Sim told him how he would launder the money, including how Sim moved it between different countries and shell companies, and paid brokers to obscure the sources of the money.
“Sim was an enthusiastic person,” Ryu said. He was “the most useful person in the Arab region for anything related to money laundering.”
The UAE said it canceled Sim’s residence visa in 2019 in line with UN sanctions against North Korea. But it took almost three more years for them to leave, which the UAE blamed on border closures due to the pandemic. The UAE Foreign Ministry said an investigation was ongoing into his alleged illegal activities.
According to Ryu, US officials and crypto researchers, this is how SIMs typically operate:
According to one of the US indictments, in 2019 Sim purchased a helicopter in Khabarovsk, Russia, to be delivered to a port in North Korea. Sim allegedly used his network to hide his country’s involvement, paying for the $300,000 deal through a Zimbabwean law firm.
crypto laundromat
According to data from Chainalysis, which tracks crypto theft, the biggest source of wealth for North Korea’s bankers is stolen crypto, which has earned the regime more than $6 billion over the past few years.
In one case, Sim tapped funds from a 2017 heist to buy an undisclosed communications device for Pyongyang, according to the U.S. indictment, which charged Sim with conspiracy to commit money laundering.
Under Sim’s instructions, an associate transferred approximately $50,000 worth of Bitcoin from a North Korean-controlled digital wallet to another wallet controlled by an over-the-counter trader, the indictment said, citing communications between the men. The trader allegedly converted the cryptocurrencies into US dollars and deposited them into the bank account of the Hong Kong-based front company. Prosecutors say the money was transferred from there to vendors of communications equipment in Thailand.
The Hong Kong Monetary Authority said it does not comment on individual cases, but it has effective anti-money laundering controls.
Fake Marlboros
According to the FBI and one of the US indictments against Sim, Sim has also been involved in financing the sale of counterfeit cigarettes, another major source of income for Pyongyang. The indictment says North Korea produced millions of packs of counterfeit Marlboro and other brands, selling them in places like the Philippines and Vietnam. To produce counterfeit products, sanctioned North Korean companies must purchase raw tobacco from around the world.
US prosecutors said Sim used a group of companies in China, the United Arab Emirates and elsewhere to buy supplies. Companies controlled by Chinese nationals, in violation of sanctions, would contact producers of raw tobacco and arrange shipments to North Korea.
According to US court documents, banks in the US that unknowingly processed dollar-denominated payments included Citibank, JPMorgan and Wells Fargo, as well as Deutsche Bank, HSBC and Bank of New York Mellon.
Deutsche Bank, HSBC and Bank of New York Mellon declined to comment.
Sometimes banks become suspicious and stop payments. According to the US indictment, as part of an investigation, a US law-enforcement agent went undercover at one of the tobacco suppliers in 2019. It said a representative of a group of companies used by Sim discussed a payment to the supplier that was blocked by a bank.
According to the indictment, the representative told the undercover agent, “No problem.” “We have a lot of ideas.”
The representative reportedly suggested that the supplier could register as a company and open an account in Dubai, Hong Kong or Singapore to receive payments.
Representative Jin Guanghua was arrested in Australia and recently prosecuted in the US. He pleaded not guilty and the jury could not agree on a verdict. An attorney for Jin declined to comment.
IT theft
The case involving a California crypto entrepreneur who needed coding assistance came to light in 2021 when the businessman, Zaki Mannion, was hired to build a blockchain called Cosmos Hub. Mannion told the Journal that the coders he hired remotely said they were based in Singapore.
Manian said that the FBI had contacted him in 2023. According to an analysis by Nick Carlson, a former FBI analyst now at TRM, Mannion paid in crypto to one of the coders, who he said was named Saravut Sanit, ending with SIM.
As the money moved through multiple wallets, Carlson said, before arriving at the SIM-controlled wallet, it was mixed with payments received by other North Korean workers. He said the funds were transferred to the wallet of an over-the-counter merchant based in the UAE, which was approved by the US to convert crypto into cash for SIMs.
iran link
US prosecutors filed their first indictment against SIM in 2023. But China has no extradition treaty with the US crypto researchers say they continue to work with.
In February, a digital wallet controlled by SIM transferred at least $67,000 in crypto to a wallet later identified by Israeli authorities as belonging to Iran’s Islamic Revolutionary Guard Corps, a branch of Iran’s armed forces that the US has designated a terrorist organization, according to an analysis by TRM’s Carlson.
Carlson said North Koreans could swap crypto for dollars with Iranians or settle payment for oil or a service.
In another case tracked by TRM, a digital wallet that U.S. officials said received salaries from North Korean IT workers and then transferred the cryptocurrency to a SIM wallet in July was found to be illegal, indicating that he continued to launder workers’ income.
The FBI recently increased its reward from $5 million to $7 million for anyone who helps capture Sim.
Write to Patricia Cowsman patricia.kowsmann@wsj.com And on Dasal Yun dasl.yoon@wsj.com
