10 Names, One Entity, and a $96B Exchange: North Korea's Cash-Out Just Got Harder

Ten people and one entity just got added to the Treasury's sanctions list, and Chainalysis has already mapped where their money went.

Short version: it went through Garantex. The long version is a story about a pipeline that's been cut three times and grown back twice.

How it went down

Start with the job listings. North Korean IT workers have spent years applying for remote developer gigs using borrowed, fabricated, or rented identities. They pass the interviews. They ship real code. Some of them are genuinely good engineers, which is the uncomfortable part of this story. Then the salary lands in crypto and starts moving.

The money doesn't sit still. It hops chains, splits into smaller chunks, gets swapped through a few low-liquidity pools, and eventually arrives somewhere with thin KYC and a friendly jurisdiction. That somewhere has been Garantex for a while now.

Garantex has a history. The Treasury's Office of Foreign Assets Control sanctioned the exchange back in April 2022, back when it was handling a serious slice of Russia's crypto volume. It kept operating anyway. By the time authorities finally moved on it, estimates put its lifetime volume close to $100 billion. That's not a rounding error. That's a parallel banking system.

Then came March 2025. Tether froze roughly $27 million in USDT tied to the exchange. Garantex's site went dark after coordinated action from US and German authorities. For about a week, it looked like the story was over.

It wasn't. A successor called Grinex showed up within weeks, running on much of the same infrastructure. Same pattern, new logo. The builders never left.

And layered on top of all of this is Lazarus Group, the state-linked crew behind the February 2025 Bybit hack, where roughly $1.5 billion in ether walked out the door in the largest crypto theft on record. Those funds got laundered through mixers, bridges, and a rotating cast of exchanges. Garantex was one of the off-ramps.

So when the Treasury designated those 10 individuals and one entity this time, it wasn't chasing a new problem. It was chasing the same problem with better paperwork. Chainalysis ran the analysis afterward and confirmed what most of us already suspected. The IT worker money and the hack money aren't separate streams. They merge.

What actually broke

Here's the concrete impact, and it's not where most people look.

The designations themselves are paperwork. They freeze assets, they scare banks, they make it legally radioactive for any US person to touch these folks. That matters less than you'd think, because the people on that list weren't exactly shopping at Chase.

The real damage is to the middle layer. Think about the no-questions-asked OTC desks in Dubai and Tbilisi. The payment processors that don't check too hard. The P2P platforms where a $40,000 USDT transfer raises exactly zero eyebrows. Every one of those operations now has to decide whether the modest fee from a sanctioned counterparty is worth a visit from a regulator. Most of them will decide it isn't.

And that's the actual mechanism. Sanctions work by shrinking the number of doors, not by locking one.

Compliance vendors win this round. Chainalysis, TRM, Elliptic. Every new designation creates new work for blockchain forensics teams, and every exchange with a legal department needs to re-screen its books. That's a growth business, and it isn't slowing down.

Who loses? Honest Russian users, mostly. Regular people who used Garantex because it was one of the few functioning on-ramps left to them now get caught in the blast radius of a designation they had nothing to do with. That's the collateral nobody puts in the press release.

But here's my real take, and it's an uncomfortable one. Sanctions are whack-a-mole, and the whack keeps getting better, but the mole keeps getting smarter. Garantex to Grinex took weeks. The next successor will take days. The meta shifted. Keep up.

So why does a mid-sized Russian exchange matter more than a $1.5 billion hack? Because the hack is the loud part. The exchange is where the money actually becomes spendable. Floor price is a distraction. Watch the utility, and in this case the utility is off-ramping stolen and sanctioned funds into something you can buy a laptop with.

Where the money goes next

Watch three things over the next two quarters.

First, whether OFAC follows these 10 individuals and one entity with designations on Grinex itself, its wallets, or the people running it. That's the natural next step. If the Treasury stops at the individuals and leaves the successor exchange untouched, the whole exercise is theater.

Second, watch the stablecoin issuers. Tether's $27 million freeze in March 2025 was the single most effective action in this whole saga, and it took about four minutes of work. Circle has been slower to use that lever. If both issuers start freezing on-chain funds within hours of a designation instead of weeks, the laundering window closes fast. That's a far bigger deal than any press conference.

Third, watch the hiring side. The scheme only works because a North Korean operative can pass a video interview as a mid-level React developer. Remote-work verification is the softest target in this entire chain, and almost nobody is fixing it. Background checks, device fingerprinting, verified payroll rails. That's where the actual prevention lives, and it's boring, so it gets ignored.

The crypto industry has spent a decade arguing that it can't be blamed for what bad actors do on open protocols. Fair point. But Garantex wasn't a protocol. It was a company, with a help desk and a fee schedule, and it processed close to $100 billion while everyone knew exactly what it was.

This is what onboarding actually looks like, just not the kind we want.

Ten names and one entity won't stop the pipeline. Better on-chain tracing and faster issuer freezes might. The gap between those two things is where the next headline lives.