China's DPRK IT workers leave a money trail — and it's a security nightmare

DPRK IT workers hired through Chinese agencies are leaving a financial paper trail that could expose them to sanctions enforcement. A new report from Zero Trace Lab tracks how these workers send money back home through Chinese payment systems and crypto exchanges.

The setup is simple. A worker in Pyongyang gets hired by a Western company through a Chinese intermediary. The company pays the agency in RMB. The agency takes a cut and forwards the rest to the worker's Chinese bank account. The worker then moves the money through crypto exchanges back to North Korea.

But the trail is there. Every transaction leaves records. Every exchange keeps KYC data. Every bank account has a paper trail. And sanctions enforcement agencies in the US, EU, and South Korea have been following this money flow for months.

The workers themselves don't control the full chain. They don't pick the exchanges. They don't control the Chinese bank accounts. They're told where to send the money and how to move it. But the records stay.

What's more, the Chinese agencies involved are not anonymous shell companies. They operate openly. They have real names. They have real bank relationships. They can be identified.

The report identifies specific patterns: recurring payment amounts, timing that matches pay cycles, and exchange platforms that consistently receive funds from these workers. It's not a single transaction. It's a system.

For the workers, this means they could be targeted by sanctions enforcement if the trail leads back to them. For the hiring companies, it means they could be on the hook for sanctions violations they didn't know about. The agencies in the middle are the most exposed because they sit between the Western payer and the North Korean receiver.

The report doesn't name specific companies or workers. It maps the pattern. It shows how the money moves. And it shows that the system is not as opaque as the workers assume.

Why this matters for us: when sanctions enforcement finally catches up, it won't just hit Pyongyang — it'll hit the Chinese intermediaries, the payment processors, and the Western companies that hired through them, creating a ripple of freezes and investigations that could shut down entire work pipelines overnight.