The US is allowing vetted private firms to target North Korean crypto theft.
That is a notable shift for a fight that has mostly belonged to prosecutors, sanctions officials, and FBI agents.
North Korean actors are estimated to have stolen over $2 billion in digital assets in 2025, according to Chainalysis. One incident, the Bybit breach, accounted for approximately $1.5 billion of that total.
A government that has been busy
The move toward private participation follows a stretch of aggressive enforcement from the Department of Justice, the FBI, and the Treasury’s Office of Foreign Assets Control (OFAC).
Their main targets are North Korean state-linked hacking groups, most notably the Lazarus Group and APT38. Both are tied to a wide range of financial crimes, from large digital asset heists to fraudulent remote IT worker schemes.
Those IT worker schemes deserve a moment of attention. North Korean operatives reportedly land remote tech jobs under false identities, and the wages reportedly flow back to Pyongyang’s weapons programs.
In mid-October 2026, the DOJ carried out coordinated actions in Ohio and Texas under the name Operation Lonestar Roundup. The operation produced over 70 indictments and arrests.
Authorities also seized approximately 187 computers from suspected “laptop farms.” These setups are believed to have been involved in schemes that generated about $3 million for North Korean interests.
A laptop farm, for the uninitiated, is roughly what it sounds like. Machines sit physically inside the US so that overseas workers can log in and look like local employees to the companies paying them.
The FBI has been tracking this playbook closely. Advisories updated in October 2026 flag a rising trend of North Korean entities leaning on US-based facilitators to slip past law enforcement detection.
Following the stablecoins
Stolen funds are frequently moved through crypto, with stablecoins playing a particularly prominent role.
US authorities have sought the forfeiture of over $15 million in stablecoins from activities linked to APT38 since 2023.
The public-private turn
US anti-cybercrime work has been placing growing weight on partnerships with the private sector and on information sharing.
The Crypto-ISAC is one of the mechanisms being used to deepen that collaboration. An ISAC, short for Information Sharing and Analysis Center, is essentially a members’ club where companies in one industry swap threat intelligence so an attack on one becomes a warning for all.
Private-sector partners such as CrowdStrike are part of that effort. The focus includes stronger vetting of remote workers and passing along intelligence that can support law enforcement.
What this means
For crypto exchanges and service providers, the message is that the compliance bar is rising. These firms will need robust vetting processes for transactions to avoid potential legal repercussions.
Stablecoin issuers face a more specific kind of pressure. Because stablecoins have featured so heavily in laundering, they could see increased scrutiny as enforcement tightens, according to the research findings.
The gap between over $15 million in sought forfeitures and over $2 billion in estimated 2025 thefts is the clearest scoreboard for whether this new approach is working.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.