Cheil Credit Bank
Summary
Cheil Credit Bank, also known as First Credit Bank and formerly as Kyongyong Credit Bank, is a North Korean state-controlled financial institution headquartered in Pyongyang with representative offices in Beijing, Shenyang, and Shanghai. First designated by OFAC in September 2017 under Executive Order 13810 for operating in North Korea's financial services sector, the bank was dramatically re-expanded on November 4, 2025, when OFAC added 53 cryptocurrency addresses to its Specially Designated Nationals listing, linking it to over $12.7 million in USDT-TRC20 flows between June 2023 and May 2025 — funds attributed primarily to DPRK overseas IT workers and cybercrime proceeds destined for the regime's weapons programs.
Connected Entities
1 entities · 10 linked investigations- + 1 more
Timeline(12 events)
2017-09-21
President Trump signs Executive Order 13810, authorizing broad sanctions against North Korea's financial sector following DPRK's sixth nuclear test on September 3, 2017.
U.S. Treasury / Federal Register2017-09-26
OFAC designates Cheil Credit Bank (First Credit Bank) to the SDN list under E.O. 13810 for operating in North Korea's financial services sector. Bank is assigned SDN ID 22985 and DPRK4 program code.
OFAC Recent Actions2017-11-07
Japan's Ministry of Finance independently designates Cheil Credit Bank under its own DPRK sanctions regime.
OpenSanctions — Cheil Credit Bank entity record2023-06-01
Approximate start of the period during which OFAC-designated Cheil Credit Bank cryptocurrency addresses began receiving USDT inflows consistent with IT worker salary disbursements. Activity would continue through May 2025.
TRM Labs — US Treasury Sanctions DPRK Bankers2023-12-01
Australia designates Cheil Credit Bank under its DPRK Sanctions Regime.
OpenSanctions — Cheil Credit Bank entity record2025-02-21
North Korea's Lazarus Group hacks Bybit exchange for approximately $1.5 billion in cryptocurrency, the largest crypto heist in history. FBI confirms attribution to TraderTraitor/APT38. Funds are laundered through thousands of wallets and cross-chain bridges.
TRM Labs — The Bybit Hack2025-04-01
Approximate start of Tether's proactive blocklisting operation targeting DPRK-linked addresses. 26 of the 53 Cheil Credit Bank cryptocurrency addresses are blocklisted by Tether in April–May 2025, freezing a portion of the active balances.
Elliptic — OFAC lists 53 crypto addresses of sanctioned North Korean Cheil Credit Bank2025-05-01
FinCEN designates Huione Group as a primary money laundering concern under Section 311 of the U.S. Patriot Act. Cheil Credit Bank cryptocurrency addresses show on-chain exposure to Huione Pay and Huione Guarantee.
Money Laundering Watch — FinCEN Bars Huione Group2025-11-04
OFAC adds 53 cryptocurrency addresses (primarily USDT TRC-20 on the Tron blockchain) to Cheil Credit Bank's SDN listing. Simultaneously designates bank employees Jang Kuk Chol and Ho Jong Son for managing approximately $5.3 million in cryptocurrency on the bank's behalf. Korea Mangyongdae Computer Technology Company, Ryujong Credit Bank, and five additional DPRK banking representatives are designated in the same action. Collective inbound flows to the 53 wallets totaled over $12.7 million (June 2023 to May 2025). Balance at time of designation: approximately $5.4 million.
OFAC Recent Actions — November 4, 20252025-11-04
U.S. Department of State issues concurrent statement describing Cheil Credit Bank's cryptocurrency network as part of the DPRK's sanctions-evasion architecture funding WMD and ballistic missile programs.
U.S. Department of State — Disrupting Illicit DPRK Bankers2025-11-17
Federal Register publishes formal notice of the November 4, 2025 OFAC sanctions action adding 53 cryptocurrency addresses to Cheil Credit Bank's SDN record.
Federal Register — Notice of OFAC Sanctions Action2025-12-01
Chainalysis and Elliptic year-end reporting places total DPRK cryptocurrency theft in 2025 at approximately $2.02 billion — a record annual figure — out of $3.4 billion stolen across all actors globally. DPRK attacks account for 76% of all crypto service compromises by value.
Chainalysis — 2025 Crypto Theft Reaches $3.4 BillionDecision Log
- hash: GAZLtZUiyc2MstPp4fptLwk1YK41GdY9ycqGdz1V3ajT
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/3/2026, 12:07:57 AM
last updated: 6/3/2026, 12:08:02 AM
avoid.net — verified advice for a post-truth world