US judge orders forfeiture of $212,700 in crypto linked to North Korean IT scheme

What happened

Judge Rudolph Contreras of the US District Court for the District of Columbia ordered forfeiture of a cryptocurrency wallet to the US government, prosecutors said on September 8, 2026. The wallet, with an address beginning “0x81c4,” held $212,700 in stablecoins: 158,123 USDC and 54,574 USDT. Prosecutors say the funds correspond to wages earned by at least 14 North Korean information technology, or IT, workers.

The ruling sits inside a wider lawsuit brought by the US Department of Justice (DOJ), which is seeking forfeiture of $7.74 million in cryptocurrency tied to North Korea’s overseas IT worker scheme. The forfeiture complaint names Sim Hyon Sop and Kim Sang Man as intermediaries. Prosecutors allege the pair helped move the workers’ earnings. The complaint describes Sim as a representative of North Korea’s Foreign Trade Bank.

Cryptotimes reported that the judge seized only one of eight wallets named in the case, rejecting forfeiture of the other seven over deficient forfeiture notice. That detail was not confirmed by the other outlets that covered the ruling.

Why it matters

This section is analysis, not confirmed fact. The $212,700 recovered is small next to the $7.74 million DOJ target, but the mechanism matters more than the amount. North Korean operatives have used freelance IT placements to earn wages under false identities, then routed that money through intermediaries and crypto rails toward the regime. Stablecoins made this particular wallet traceable in a way cash never would be.

The partial rejection reported by Cryptotimes points to a procedural gap. If forfeiture notice requirements can trip up a DOJ case with clear identifying detail, other wallets tied to the same scheme may stay outside government reach longer than this case suggests.

Practitioner angle

• Review onboarding and background checks for remote IT contractors, especially staffing agencies and freelance platforms serving Western tech and crypto firms.
• Flag wage payments to freelance IT contractors routed through stablecoin wallets, particularly where identity documents cannot be independently verified.
• Screen counterparties against the names in the DOJ complaint, including Sim Hyon Sop and Kim Sang Man, noting these are allegations, not convictions.
• Crypto exchanges and payment processors should check whether the “0x81c4” wallet or related addresses appear in their own transaction histories and file suspicious activity reports where warranted.

The single most important action: check remote IT contractor onboarding records now for known North Korean scheme indicators, including false identities, frequent VPN use, and wages paid in stablecoins. Do this before the next DOJ complaint names a wallet your institution touched.