How an Elusive Banker Allegedly Kept North Korea’s Dirty Money Flowing

A few years agone, a calif. Cryptocurrency developer hired a self-employed coder remotely for a throw. What he didn’t know: The salary he paid landed in the hands of North Korea.

The $216,000 paid in cryptocurrency was supposed to go to the coder in Singapore. Instead, it went to a digital wallet controlled by a North Korean named Sim Hyon Sop, according to crypto-analytics firm TRM Labs, which tracked the transactions.

U.S. Prosecutors allege that Sim has engaged in money laundering and sanctions evasion on behalf of the Kim Jong Un regime.

Sim has allegedly used money he manages to buy communications equipment and a helicopter for Pyongyang, according to two U.S. Indictments against him. He once paid over $800,000 in $100 bills for tobacco to help North Korea make counterfeit cigarettes, according to a third U.S. Indictment against him.

The FBI is offering millions of dollars for his arrest.

Efforts to reach Sim, who U.S. Officials say is living in China, were unsuccessful.

Sim is one of several dozen North Korean bankers working abroad who are trying to make sure Pyongyang’s financial needs are met, despite heavy sanctions meant to totally isolate the country, according to U.S. Officials. Thanks to those bankers, North Korea’s connectivity to the world financial system has only grown, according to the Paris-based Financial Action Task Force, which sets standards for anti-money-laundering rules.

Every year, thousands of undercover North Korean workers and cyber thieves generate hundreds of millions of dollars in ill-gotten gains for Pyongyang from places such as Russia, China and Africa, U.S. Law-enforcement officials and cybersecurity analysts say. That cash is used to buy luxury goods and fund Kim’s weapons arsenal.

But the money has to be laundered and spent in ways that hide all traces to North Korea, or it will get blocked. That is where people like Sim come in, according to U.S. Officials, who as part of their investigations accessed Sim’s emails and a spreadsheet he kept listing transactions.

They say much of the money Sim moves has touched the U.S. Financial system, which clears U.S. Dollar transactions. In one of Sim’s schemes, U.S. Banks including Citibank, JPMorgan and Wells Fargo unknowingly processed at least 310 transactions worth about $74 million for Pyongyang, according to one of the indictments and related court documents.

Citibank, JPMorgan and Wells Fargo declined to comment.

In a statement to The Wall Street Journal, Jeanine Pirro, the U.S. Attorney for the District of Columbia, vowed to “doggedly investigate and charge North Korea’s agents who use U.S. Bank facilities and U.S. Infrastructure to defraud America, in order to generate revenue for weapons of mass destruction.”

Catching Sim is proving to be nearly impossible. The U.S. Treasury, which sanctioned Sim in 2023, said he moved to Dandong, China, after being kicked out of the United Arab Emirates in 2022. United Nations sanctions that took effect in late 2019 forbid member countries from hosting North Korean workers.

China is unaware of Sim’s activities and is opposed to what it sees as unilateral U.S. Treasury sanctions, Beijing’s Foreign Ministry said in a statement to the Journal.

Although much is unknown about Sim, the U.S. Justice Department said he is 42 and 6 feet 1 inch tall—unusually tall for someone from North Korea, where the average male height is 5 feet 4 inches.

He attended an elite university in Pyongyang, where he likely learned English and Chinese, according to Ryu Hyeon Woo, a former North Korean acting ambassador in Kuwait who says he met Sim more than 10 times before defecting to South Korea in 2019.

Ryu’s job in Kuwait included facilitating visas for all North Koreans living in the Middle East at the time. It also included monitoring the activities of North Koreans—who are only allowed to leave their home country with the government’s permission—to make sure they fulfilled obligations to Pyongyang and didn’t defect.

Ryu and U.S. Officials say Sim was sent abroad to represent an affiliate of North Korea’s state-run Foreign Trade Bank, which is in charge of the regime’s foreign-currency transactions.

The bank, like others in North Korea, is under international sanctions for helping fund Pyongyang’s weapons program. Efforts to obtain comment from the bank were unsuccessful. North Korea has called sanctions against the country “a foolish attempt to isolate and stifle it economically and bring down the socialist system chosen by its people themselves.”

As of mid-2024, more than 50 North Korean bankers were operating outside the country, according to the Financial Action Task Force.

In 2016, Sim arrived in the U.A.E., where he lived for a time with his wife and daughter. Ryu said many North Koreans worked in the country as computer programmers and some stole crypto on the side—and someone had to handle their funds.

Ryu said that when he traveled to Dubai from Kuwait, Sim would pick him up in a Toyota Land Cruiser and they would frequently dine with other North Korean operatives. He said that Sim described to him how he would launder money, including how Sim moved it between different countries and shell companies, and paid brokers to obscure the sources of the funds.

“Sim was a go-getter,” said Ryu. He “was the most useful person in the Arab region for anything relating to money laundering.”

The U.A.E. Said it canceled Sim’s residence visa in 2019 in line with U.N. Sanctions against North Korea. But it took roughly another three years for him to leave, which the U.A.E. Attributed to pandemic border closures. The U.A.E.’s Foreign Ministry said an investigation regarding his alleged illegal activities continues.

Here’s how Sim typically operates, according to Ryu, U.S. Officials and crypto researchers:

In 2019, Sim bought a helicopter in Khabarovsk, Russia, to be delivered to a port in North Korea, according to one of the U.S. Indictments. Sim allegedly used his network to camouflage his country’s involvement, routing the payments through a law firm in Zimbabwe for the $300,000 deal.

The biggest source of funds for North Korea’s bankers is stolen crypto, netting more than $6 billion for the regime over the years, according to data from Chainalysis, which tracks crypto theft.

In one case, Sim tapped funds from a 2017 heist to buy an undisclosed communication device for Pyongyang, according to a U.S. Indictment, which accused Sim of conspiracy to launder money.

Under Sim’s instructions, an associate transferred about $50,000 worth of bitcoin from a North Korean-controlled digital wallet to another wallet controlled by an over-the-counter trader, the indictment said, citing communication between the men. The trader allegedly converted the cryptocurrency into U.S. Dollars and deposited them into a bank account of a Hong Kong-based front company. From there, prosecutors say the money was transferred to the sellers of the communication device in Thailand.

The Hong Kong Monetary Authority said it doesn’t comment on individual cases, but that it has effective anti-money-laundering controls in place.

Sim has also been involved in financing sales of counterfeit cigarettes, another big earner for Pyongyang, according to the FBI and one of the U.S. Indictments against Sim. North Korea produces millions of packs of fake Marlboros and other brands, selling them in places such as the Philippines and Vietnam, the indictment said. To make the fakes, sanctioned North Korean companies must procure raw tobacco from around the world.

The U.S. Prosecutors said Sim used a group of companies in China, the U.A.E. And elsewhere as fronts to purchase the supplies. The companies, controlled by Chinese nationals, would contact producers of raw tobacco and arrange for shipments to North Korea, in violation of sanctions.

Banks in the U.S. That unknowingly processed the dollar-denominated payments included Deutsche Bank, HSBC and Bank of New York Mellon in addition to Citibank, JPMorgan and Wells Fargo, according to U.S. Court documents.

Deutsche Bank, HSBC and Bank of New York Mellon declined to comment.

Sometimes banks would be suspicious and freeze payments. As part of an investigation, a U.S. Law-enforcement agent went undercover at one of the tobacco suppliers in 2019, according to the U.S. Indictment. It said that the representative of a group of companies used by Sim discussed a payment to the supplier that had been blocked by a bank.

“No problem,” the representative told the undercover agent, according to the indictment. “We have a lot of ideas.”

The representative allegedly suggested the supplier could register as a company and open an account in Dubai, Hong Kong or Singapore to receive the payment.

The representative, Jin Guanghua, was arrested in Australia and tried in the U.S. Recently. He pleaded not guilty and the jury couldn’t agree on a verdict. A lawyer for Jin declined to comment.

The case involving the California crypto entrepreneur who needed coding help got rolling in 2021 when the businessman, Zaki Manian, was hired to build a blockchain called Cosmos Hub. The coders he hired remotely said they were based in Singapore, Manian told the Journal.

Manian said that in 2023, he was contacted by the FBI. Payments Manian had made in crypto to one of the coders, who said his name was Sarawut Sanit, ended up with Sim, according to an analysis from Nick Carlsen, a former FBI analyst now at TRM.

As the money moved through multiple wallets, it was merged with payments received by other North Korean workers, before it landed in a Sim-controlled wallet, Carlsen said. He said the funds were then transferred to the wallet of an over-the-counter trader based in the U.A.E. Who has been sanctioned by the U.S. For converting crypto into cash for Sim.

U.S. Prosecutors filed their first indictments against Sim in 2023. But China has no extradition treaty with the U.S. Crypto researchers say he continues to operate.

In February, a digital wallet controlled by Sim made transfers worth at least $67,000 in crypto that ended up in a wallet later identified by Israeli authorities as belonging to Iran’s Islamic Revolutionary Guard Corps, a branch of Iran’s armed forces that the U.S. Designated a terrorist organization, according to an analysis from TRM’s Carlsen.

Carlsen said North Koreans could be swapping crypto for dollars with the Iranians or settling payment for oil or a service.

In another case tracked by TRM, a digital wallet that U.S. Authorities said had received salaries from North Korean IT workers then transferred cryptocurrencies to a Sim wallet in July, indicating he continues to launder workers’ income.

The FBI recently increased its reward for anyone who can help it catch Sim, from $5 million to $7 million.

Write to Patricia Kowsmann at patricia.kowsmann@wsj.com and Dasl Yoon at dasl.yoon@wsj.com

Get 360° coverage—from daily headlines
to 100 year archives.

---

---