North Korea’s ever-expanding sanctions evasion toolkit

Two decades of sanctions have neither deterred North Korea’s military ambitions nor pushed the country closer to collapse. Instead, a recent investigation points to yet another novel channel through which Pyongyang is evading sanctions, expanding its revenue streams, and sharpening its threat profile against the US and its allies.

A Wall Street Journal documentary (Opens in new window) published earlier this month traced the inner workings of a single North Korean cell that applied to more than 1000 American companies in just over three months, using AI to write cover letters, coach interview answers, and – when hiring managers grew wary – even alter operatives’ faces on video calls. The FBI estimates that thousands of North Korean IT workers are now embedded in this way across the American economy, with the broader scheme worth as much as US$800 million a year.

The scale of this IT worker scheme illustrates a broader pattern that sanctions have struggled to contain. Over the years, Pyongyang has not simply absorbed the pressure of sanctions or waited it out but has innovated to diversify its income streams instead. Economic ties with major powers like China and Russia remain crucial to the survival of North Korea’s economy, yet Kim Jong-un has also been cultivating revenue streams that rely less on allies and more on his own people, in keeping with the country’s historical emphasis (Opens in new window) on self-reliance.

Importantly, the underlying vulnerability – the ease with which remote hiring can be exploited – is not unique to the US. The same tactics that let North Korean operatives infiltrate American payrolls are already expanding (Opens in new window) towards companies in other countries, particularly as remote and freelance work becomes more entrenched globally.

Recognising this threat, the eleven member nations of the Multilateral Sanctions Monitoring Team (MSMT), created in 2024 after Russia’s veto of the UN Panel of Experts’ mandate, issued a joint warning (Opens in new window) about North Korean IT workers’ illicit revenue-generating activities in July. The MSMT previously released a comprehensive report (Opens in new window) in 2025 about North Korea’s illicit cyber operations, ranging from IT worker schemes to financially motivated cybercrime and espionage.

In particular, cryptocurrency theft has been one of the most lucrative income streams for the DPRK, and 2025 marked its strongest growth yet. North Korean hackers stole (Opens in new window) US$2.02 billion in digital assets, a 51% increase from 2024 and enough to push the DPRK’s lower-bound cumulative haul from crypto theft to US$6.75 billion. The February 2025 attack (Opens in new window) on the exchange Bybit was central to that surge, netting an estimated US$1.5 billion in the largest cryptocurrency theft on record.

According to the 2025 MSMT report, Pyongyang relies on globally dispersed networks of North Koreans and “foreign-based facilitators” to carry out these cyber operations, particularly in China and Russia but also in Argentina, Laos, Cambodia, Vietnam, and the UAE. Pyongyang is believed to use the proceeds to trade for weapons, gold, copper, and other raw materials prohibited under UN sanctions.

In addition to the IT job scams and cybercrime, illicit maritime operations represent another evasion channel. Washington continues to nominate (Opens in new window) vessels for UN blacklisting over suspected coal and iron ore shipments that breach Security Council resolutions, bringing the number of ships awaiting designation to fourteen as of July. Investigators point to Automatic Identification System (AIS) manipulation and flag spoofing as routine deception tactics for these vessels, several of which have continued shuttling minerals to Chinese ports well after the practice was flagged publicly.

Beyond this, an increasing number of North Korean workers have been sent (Opens in new window) to Russia to work in factories, restaurants, and construction – serving as yet another income stream for Pyongyang. Last year, Russia issued (Opens in new window) nearly 36,000 education visas to North Koreans, processing laborers as students to circumvent the UN ban on employing DPRK workers overseas.

Taken together, these methods point to a deliberate strategy (Opens in new window) that reaches beyond mere survival to broader economic growth. Kim Jong-un is likely to exploit the Russia relationship for as long as it remains useful, while continuing to build out the country’s other income streams for as long as US- and UN-led sanctions stay in place. The war in Iran will likely have reinforced this logic (Opens in new window) for Pyongyang: diversifying income sources and leaning (Opens in new window) on domestic capabilities (Opens in new window) matters precisely because partners may prove unreliable if a real conflict breaks out.

Years of sanctions have not deterred North Korea from advancing its weapons programs. If anything, the pressure has pushed the regime towards a wider and more resilient set of income sources, several of which barely existed as sanctions-evasion tools a decade ago. The result is a threat that has grown more diffuse and harder to trace to a single chokepoint, and a North Korea with more options at its disposal than at almost any point in the sanctions era.

That expanding cushion makes Pyongyang less likely to capitulate to outside pressure or ultimatums, which in turn makes a return to diplomacy both harder to achieve and more urgent than ever.