North Korea

DeFi Intel Research Desk2026-07-14Asia

Is crypto legal in North Korea? (2026)

No — cryptocurrency has no lawful framework in North Korea. Current status: No lawful framework · comprehensively sanctioned. Oversight sits with None — no domestic crypto regime. Full details — governing law, licensing, tax and dated enforcement history — follow below (last reviewed 2026-07-14).

Framework: North Korea (the Democratic People's Republic of Korea, DPRK) has no published cryptoasset regulatory framework, no licensing regime for crypto-asset service providers, and no lawful on-ramp connected to the global financial system. The DPRK is one of only a handful of jurisdictions on the FATF blacklist — "high-risk jurisdictions subject to a call for action" — a status it has held continuously since 2011. Under that listing FATF urges all countries to apply enhanced countermeasures, including terminating correspondent-banking relationships with DPRK banks and closing any DPRK bank branches and subsidiaries. Comprehensive UN Security Council and U.S. (OFAC) sanctions bar most financial dealings with the country. The relevant "regulation" here is therefore not a domestic licensing story but a sanctions-and-threat story: the North Korean state itself is an industrial-scale participant in the crypto ecosystem — as a thief and money-launderer rather than as a regulator. There is accordingly no lawful way to offer crypto services to DPRK residents, and any such dealing carries direct sanctions exposure.

State-sponsored hacking units grouped under the "Lazarus Group" label — with sub-clusters the FBI tracks as "TraderTraitor" — have carried out the largest crypto thefts on record. According to Chainalysis, DPRK-linked actors stole roughly $1.34 billion across 47 incidents in 2024, about 61% of all crypto stolen globally that year; research firms including Chainalysis and TRM Labs estimate 2025 losses exceeded $2 billion, driven overwhelmingly by the February 2025 Bybit heist. U.S. authorities describe crypto theft as a core funding source for the DPRK's weapons-of-mass-destruction and ballistic-missile programmes.

Tax treatment

North Korea operates a closed, centrally planned economy and publishes no cryptoasset tax guidance. Because there is no lawful private crypto market and no domestic capital-gains regime that could apply to crypto holdings, ordinary "capital-gains rate / holding-period" analysis is not meaningfully applicable, and no authoritative primary source on crypto taxation could be located.

• Capital-gains rate: pending verification — no authoritative DPRK cryptoasset tax guidance located
• Holding-period rule: pending verification

Travel rule applicability

Status: not applicable domestically; DPRK is the target of FATF countermeasures. North Korea does not implement the FATF Recommendation 16 "travel rule"; instead FATF calls on all other jurisdictions to apply enhanced due diligence to any DPRK nexus and to treat such transactions as high-risk. In practice, virtual-asset service providers elsewhere are expected to screen for and block DPRK-linked wallets, including the crypto addresses OFAC adds to its Specially Designated Nationals (SDN) list after major attributions.

Notable enforcement actions (against DPRK crypto activity)

• 2022 — Ronin bridge / Axie Infinity. On 23 March 2022 the Lazarus Group stole roughly $620 million from the Ronin bridge linked to the game Axie Infinity. In April 2022 OFAC added a Lazarus-controlled Ethereum wallet to the SDN list — the first time it sanctioned DPRK-held crypto addresses.
• 2022 — Blender.io. On 6 May 2022 OFAC issued its first-ever sanction against a virtual-currency mixer, Blender.io, which it said processed over $20.5 million of the Ronin proceeds for the DPRK.
• 2022–2025 — Tornado Cash. In August 2022 OFAC sanctioned the mixer Tornado Cash, used by Lazarus to launder stolen funds (OFAC put total throughput at over $7 billion since 2019). A Fifth Circuit ruling in November 2024 held OFAC had overstepped its authority, and OFAC formally delisted Tornado Cash on 21 March 2025.
• 2025 — Bybit. On or about 21 February 2025, DPRK actors ("TraderTraitor") stole approximately $1.5 billion in virtual assets from exchange Bybit — the largest cryptocurrency theft on record. The FBI publicly attributed it on 26 February 2025 (IC3 alert I-022625-PSA).
• 2025–2026 — fraudulent IT-worker scheme. In June 2025 the U.S. Department of Justice filed a civil-forfeiture complaint over more than $7.74 million in crypto laundered on behalf of the North Korean government via a fraudulent remote-IT-worker scheme; OFAC has repeatedly sanctioned facilitators of these networks, which U.S. authorities say generated close to $800 million in 2024.

Public licensed CASP list

None. North Korea maintains no public register of licensed crypto-asset service providers because no domestic licensing regime exists. Rather than a register of authorised operators, the relevant list for compliance purposes is OFAC's SDN list and its published DPRK-linked crypto addresses, which name blocked wallets. There is no lawful CASP to onboard in this jurisdiction.

Comparison to neighbours

Compare North Korea with three geographically adjacent jurisdictions:

Doing business in North Korea — practical notes

There is no lawful crypto market to enter. Offering crypto products or services to North Korea, or transacting with DPRK-linked wallets, exposes firms and individuals to UN and OFAC sanctions and, for U.S. persons, potential criminal liability. Compliance teams treat the DPRK as a hard block: screen counterparties and wallet addresses against the SDN list, apply the FATF countermeasures, and file suspicious-activity reports on any DPRK nexus. This profile is provided as sanctions and threat context, not as a market-entry guide. Firms should also note the DPRK IT-worker risk — operatives using stolen or fabricated identities to obtain remote crypto/engineering jobs — and strengthen hiring due diligence accordingly.

Methodology and sources

This profile was researched and updated by DeFi Intel's research desk on 2026-07-14 from the primary and secondary sources listed below — chiefly U.S. Treasury/OFAC and FBI/IC3 releases, the FATF call-for-action listing, U.S. Department of Justice filings, and blockchain-analytics research (Chainalysis, TRM Labs). Claims that could not be verified against a source are omitted or marked pending — we do not republish unverified third-party datasets. Submit corrections and primary-source links to research@defi-intel.com.

Sources

• FBI / IC3 — North Korea responsible for $1.5 billion Bybit hack (PSA I-022625-PSA, 26 Feb 2025)
• U.S. Treasury — first-ever sanctions on a virtual-currency mixer (Blender.io), targeting DPRK cyber threats (6 May 2022)
• U.S. Treasury — sanctions on virtual-currency mixer Tornado Cash (Aug 2022)
• FATF — High-Risk Jurisdictions subject to a Call for Action (DPRK), 24 Oct 2025
• U.S. DOJ — civil-forfeiture complaint over $7.74M laundered for the North Korean government (IT-worker scheme)
• U.S. Treasury — sanctions on facilitators of DPRK IT-worker fraud targeting U.S. businesses
• Chainalysis — 2024 crypto-hacking report (DPRK $1.34B across 47 incidents, ~61% of global)
• CoinDesk — U.S. officials tie Lazarus Group to the $625M Ronin/Axie Infinity exploit (Apr 2022)