UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
UNITED STATES OF AMERICA :
:
Plaintiff, : Civil Action No.: 25-1769 (RC)
:
v. : Re Document No.: 9 :
VIRTUAL CURRENCY ASSOCIATED : WITH NORTH KOREAN IT WORKER : MONEY LAUNDERING AND SANCTIONS : EVASION CONSPIRACIES, :
:
Defendant. :
MEMORANDUM OPINION
GRANTING IN PART AND DENYING IN PART PLAINTIFF’S MOTION FOR ENTRY OF DEFAULT JUDGMENT
I. INTRODUCTION
This in rem forfeiture action arises out of an investigation by the Federal Bureau of Investigation. Plaintiff United States of America (the “Government”) seeks the forfeiture of virtual currency, nonfungible tokens, and Ethereum Name Service domains (hereafter, “Defendant Property”), which were allegedly involved in a conspiracy or multiple conspiracies to launder money to support the government of the Democratic People’s Republic of Korea (“North Korea”). The Government alleges that the Defendant Property constitutes proceeds of wire fraud and violations of the International Emergency Economic Powers Act (“IEEPA”) and that those proceeds were property involved in money laundering or any conspiracy or conspiracies related thereto. No claimant responded to the Government’s complaint, and the Clerk of Court entered default on March 23, 2026. The Government has now moved for default
2
judgment. For the reasons set forth below, the Court grants the Government’s motion in part and denies it in part.
II. FACTUAL BACKGROUND
A. Statutory and Regulatory Framework The IEEPA authorizes the President to impose economic sanctions in response to an “unusual and extraordinary threat . . . to the national security, foreign policy, or economy of the United States” originating outside its borders, including by “investigat[ing], regulat[ing], or prohibit[ing]” certain transactions, among them “any transactions in foreign exchange.” 50 U.S.C §§ 1701(a), 1702(a). To activate these powers, the President must declare a national emergency with respect to the threat. 50 U.S.C. § 1701(a). The President has done so with respect to North Korea’s proliferation of Weapons of Mass Destruction (“WMDs”). See, e.g., 91 Fed. Reg. 38231 (June 24, 2026).
The Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) places individuals determined to be WMD proliferators on the Specially Designated Nationals and Blocked Persons List (“SDNs”). 31 C.F.R. § 544.201. Once designated by OFAC, an SDN’s property interests in the United States are blocked. Id. §§ 544.201, 544.308. Department of the Treasury regulations bar the “provision of funds, goods, or services by, to, or for the benefit of any person” designated as an SDN, unless OFAC licenses the transaction. Id. § 544.201(b)(1); see also id. §§ 544.202(c), 544.301, 544.405.
Section 206 of the IEEPA makes it “unlawful for a person to violate, attempt to violate, conspire to violate, or cause a violation of any license, order, regulation, or prohibition issued under” the statute. 50 U.S.C. § 1705(a). Additionally, property “which constitutes or is derived from proceeds traceable to” an IEEPA violation is subject to forfeiture. 18 U.S.C.
3
§ 981(a)(1)(C). “This chain of interlocking statutes can thus be summarized as follows: property that ‘constitutes or is derived from proceeds traceable to’ violations of executive orders … promulgated pursuant to the IEEPA is subject to forfeiture.” In re 650 Fifth Ave. & Related Props., 830 F.3d 66, 87 (2d Cir. 2016) (citing 18 U.S.C §§ 981(a)(1)(C), 1956(c)(7)(D); 50 U.S.C. § 1705).
B. Factual Background
The Government outlines in its verified complaint a money laundering scheme operated by North Korea whereby North Korean IT workers utilize fraudulent or fraudulently obtained identification documents to gain employment and access financial services through unwitting employers. Verified Compl. for Forfeiture in Rem (“Compl.”) ¶ 48, ECF No. 1. These unwitting employers often pay the North Korean IT workers in stablecoins, such as USDC and USDT, which retain a consistent value. Id. ¶ 48, 59. To send their illegally obtained virtual currency back to North Korea, the North Korean IT workers, their money laundering co- conspirators, or both transfer the virtual currency through transactions that hide the funds’ source before sending them back to the North Korean government. Id. ¶ 49.
Here, the Government alleges that the North Korean IT workers transfer the laundered funds to one or both of North Korean Defense Ministry subordinate organization CEO, Kim Sang Man, and North Korean Foreign Trade Bank official, Sim Hyon Sop, for the benefit of the North Korean government. Id. ¶¶ 50, 52. Both Kim Sang Man and Sim Hyon Sop are on OFAC’s SDN list. Id. ¶ 51. According to the FBI, this laundering scheme involved moving funds from virtual currency addresses to which North Korean IT workers requested payment from their unwitting employees (“IT Worker Payment Addresses”) to virtual currency addresses used by the North Koreans to commingle these earnings (“IT Worker Consolidation Addresses”).
4
Id. ¶ 60. The funds from these virtual currency addresses would then be sent to one of Kim Sang Man’s two Binance accounts or to Sim Hyon Sop through his own virtual currency wallet. Id. ¶ 61.
The Defendant Property in the instant case consists of eight tranches of virtual currency that have either been seized and are in U.S. government wallets or have been frozen and await transfer to the U.S. government pursuant to this civil forfeiture action. Id. ¶ 77. These consist of Sim Hyon Sop’s virtual currency wallet, Kim Sang Man’s Binance accounts, a Binance account believed to be controlled by Sim Hyon Sop, a Binance account that contained funds from some of the IT Worker Payment Addresses, and unhosted addresses that served as IT Worker Payment and/or Consolidation Addresses that received and contained funds tied to this alleged money laundering conspiracy. Id. ¶ 77.
C. Procedural History
On June 5, 2025, the Government filed this civil forfeiture action in rem against the Defendant Property by filing a verified complaint. See Compl. The Government alleges that that the Defendant Property constitutes proceeds in violation of the IEEPA, codified at 50 U.S.C. § 1701, et seq., the federal money laundering statute, codified at 18 U.S.C. §§ 1956(a)(1)(A)(i), (a)(1)(B)(i), (a)(2)(A), and (h), and the federal wire fraud statute, codified at 18 U.S.C. § 1343. Compl. ¶¶ 7–8. The Government thus contends that the Defendant Property is subject to forfeiture under 18 U.S.C. §§ 981(a)(1)(A), 981(a)(1)(C). Id.
On October 21, 2025, the Government posted a Notice of Civil Forfeiture on its official website, www.forfeiture.gov, for thirty consecutive days. See Notice & Decl. of Publ., Ex. 5-1 at 2–3, ECF No. 5. The Notice identified only the unhosted virtual currency address, 0x81c4d8816b29147c542dDE87485608204690Acf2 (“0x81c4”), and described this as seized
5
from Circle Internet Financial on September 30, 2022. Id. at 2; Compl. ¶ 81(a). Any verified claim in response to the notice by internet had to be filed no later than December 19, 2025. See Fed. R. Civ. P. Supp. G(5)(a)(ii)(B). The Government also identified all known claimants and sent direct notice via email to Kim Sang Man and Sim Hyon Sop on June 16, 2025. Pl.’s Aff. Default, Exs. 7-1, 7–2, ECF No. 7. Because no claimant to the assets has responded to the complaint, on March 23, 2026, the Clerk of the Court entered default. Clerk’s Entry of Default, ECF No. 8. The Government now moves for default judgment and an order of forfeiture against Defendant Property. Mot. for Default J. & Final Ord. of Forfeiture (“Pl.’s Mot.”), ECF No. 9.
III. LEGAL STANDARD
Default is appropriate in forfeiture actions when the “party against whom a judgment is sought . . . has failed to plead or otherwise defend” the action. Fed. R. Civ. P. 55(a); see also United States v. All Assets Held in Account No. XXXXXXXX, 330 F. Supp. 3d 150, 155–56 (D.D.C.). Default judgment requires a two-step process. Fed. R. Civ. P. 55. First, a party must “request[] that the Clerk of the Court enter default against a party who has ‘failed to plead or otherwise defend’” the action. Bricklayers & Trowel Trades Int’l Pension Fund v. KAFKA Constr., Inc., 273 F. Supp. 3d 177, 179 (D.D.C. 2017) (quoting Fed. R. Civ. P. 55(a)). The entry of default “establishes the defendant’s liability for the well-plead allegations of the complaint.” United States v. Twenty-Four Cryptocurrency Accts., 473 F. Supp. 3d 1, 4 (D.D.C. 2020). Second, the moving party must request that the court enter default judgment against the defending party. Fed. R. Civ. P. 55(b)(2).
Typically, default judgment is available “only when the adversary process has been halted because of an essentially unresponsive party. In that instance, the diligent party must be protected lest he be faced with an interminable delay and continued uncertainty as to his rights.”
6
Jackson v. Beech, 636 F.2d 831, 836 (D.C. Cir. 1980) (quoting H.F. Livermore Corp. v. Aktiengesellschaft Gebruder Loepfe, 432 F.2d 689, 691 (D.C. Cir. 1970)); see also Gilmore v. Palestinian Interim Self-Gov't Auth., 843 F.3d 958, 965 (D.C. Cir. 2016). Nonetheless, a defendant’s failure to respond or appear does not automatically entitle the plaintiff to default judgment. See United States v. $6,999,925.00 of Funds Associated with Velmur Mgmt. Pte. Ltd., 368 F. Supp. 3d 10, 17 (D.D.C. 2019) (citing Jackson v. Corr. Corp. of Am., 564 F.Supp.2d 22, 26 (D.D.C. 2008)). Instead, the complaint must state a claim for relief. Id. (citing Jackson, 564 F.Supp.2d at 27).
Per Federal Rule of Civil Procedure Supplemental Rule G, the Court’s first inquiry in an in rem forfeiture action is whether notice has been adequately served and if any party filed a timely claim. See United States v. $4,620 in U.S. Currency, 779 F. Supp. 2d 65, 67 (D.D.C. 2011). In that event, the Court then evaluates whether the complaint establishes a reasonable belief of forfeitability. United States v. $1,071,251.44 of Funds Associated with Mingzheng Int’l Trading Ltd. (“Mingzheng”), 324 F. Supp. 3d 38, 47, 50 (citation modified).
IV. ANALYSIS
The Government asks the Court to grant forfeiture of the Defendant Property. Because the Government properly notified all the interested parties and alleged that the funds seized from 0x81c4 are subject to forfeiture, the Government’s motion for default judgment is granted in part. However, the Government did not meet its notice requirement for all other Defendant Property (“Remaining Defendant Property”). Accordingly, although the Government’s motion for default judgment is granted as to 0x81c4, it is denied as to the Remaining Defendant Property.
7
A. Notice
Under Supplemental Rule G, the Government must generally (1) publish public notice of a forfeiture and (2) provide direct notice to potential claimants of the property to be forfeited. Fed. R. Civ. P. Supp. R. G(4)(a), (b). To satisfy the first requirement, the Government may publish notice on an official government forfeiture website for at least thirty consecutive days. Fed. R. Civ. P. Supp. R. G(4)(a)(iii)–(iv). The publication should “describe the property with reasonable particularity,” “state the times … to file a claim and to answer,” and “name the government attorney to be served with the claim and answer.” Fed. R. Civ. P. Supp. R. G(4)(a)(ii). However, publication is not required if “the defendant property is worth less than $1,000 and direct notice is sent under Rule G(4)(b) to every person the government can reasonably identify as a potential claimant” or “the court finds that the cost of publication exceeds the property's value and that other means of notice would satisfy due process. Fed. R. Civ. P. Supp. R. G (4)(a)(i)(A)–(B).
In the instant case, the Government published a notice on its official forfeiture website, http://www.forfeiture.gov, for thirty consecutive days spanning October 21, 2025 through November 19, 2025. See Notice & Decl. of Publ., Ex. 5-1 at 2–3. The online notice of forfeiture listed the virtual currency address of 0x81c4 and described when the seizure occurred, the timing under Rule G(5) to file a claim and answer, and the name and address of the government attorney whom potential parties should serve. Id at 2. No claims were filed in response. Pl.’s Mot. ¶ 6. As such, the Government has met Supplemental Rule G’s public notice requirement for the funds seized from 0x81c4.
But the same cannot be said for the Remaining Defendant Property. The Government listed only0x81c4 in its notice. That notice does not reference, much less describe “with
8
reasonable particularity,” the Remaining Defendant Property. Fed. R. Civ. P. Supp. R. G(4)(a)(ii)(A). Furthermore, the record does not reflect that the Government has published any additional public notice of the forfeiture relating to the Remaining Defendant Property. And the Government does not argue that the Remaining Defendant Property falls within the exceptions to the public notice requirement set forth in Supplemental Rule G. As noted, publication is not required where the defendant property is worth less than $1,000 and direct notice has been sent to potential claimants. Fed. R. Civ. P. Supp. R. G (4)(a)(i)(A). The Court cannot now state with certainty which accounts in the Remaining Defendant Property, if any, qualify for the public notice exception. Therefore, the Government has not met its burden of demonstrating that it has satisfied the public notice requirement with respect to the Remaining Defendant Property or that it is consequently entitled to a default judgment as to those funds.
The Court turns back to the funds seized from 0x81c4, for which proper public notice was given. In addition to such public notice, the Government was required to “send notice of the action and a copy of the complaint to any person who reasonably appears to be a potential claimant.” Fed. R. Civ. Supp. R. G(4)(b)(i). This notice “must be sent by means reasonably calculated to reach the potential claimant”. Fed. R. Civ. P. Supp. R. G(4)(b)(iii). However, the rule requires only that that “the government attempt to provide actual notice; it does not require that the government demonstrate that it was successful in providing actual notice.” Mingzheng, 324 F. Supp. 3d at 47 (quoting Mesa Valderrama v. United States, 417 F.3d 1189, 1197 (11th Cir. 2005)). Furthermore, email is sufficient for notifying international defendants whose location cannot be easily identified. See Twenty-Four Cryptocurrency Accts., 473 F. Supp. 3d at 6 (holding that email is appropriate notice when “the case involves international defendants whose locations are hard to pin down and the nature of the crime necessarily entails some degree
9
of cyber-proficiency on the part of the Defendant Properties’ owners”); United States v. 155 Virtual Currency Assets, No. 20-CV-2228 (RC), 2021 WL 1340971, at *5 (D.D.C. Apr. 9, 2021). Here, the Government represents that it has identified all known potential claimants, Pl.’s Mot. ¶ 3, and that it gave them notice of this forfeiture action via email on June 16, 2025, Pl.’s Aff. Default, Exs. 7-1, 7–2. As such, the Government has satisfied the Supplemental Rule G requirements for direct notice for 0x81c4.
B. Adequacy of the Complaint Notice having been satisfied as to 0x81c4, the Court turns to whether the Government has met its substantive pleading specifications under Supplemental Rule G. To do so, the complaint must (1) “be verified;” (2) state the grounds for jurisdiction and venue; (3) “describe the property with reasonable particularity;” (4) “identify the statute under which the forfeiture action is brought;” and (5) “state sufficiently detailed facts to support a reasonable belief that the government will be able to meet its burden of proof at trial.” Fed. R. Civ. P. Supp. R. G(2).
The Government meets all requirements. As to the first four, the Government’s complaint is verified, identifies the basis for jurisdiction and venue, describes the property at issue by listing the unhosted address from which the tokens were seized, and identifies 18 U.S.C. §§ 981(a)(1)(A), 981(a)(1)(C) as the statutes under which it seeks forfeiture. See Compl. ¶¶ 1, 4–7, 81(a).
To satisfy the fifth pleading requirement, which is “not particularly onerous,” the Government’s complaint must establish the legal basis for its claims by stating sufficiently detailed facts to support a reasonable belief that it would be able to meet its burden at trial. Mingzheng, 324 F. Supp. 3d at 51; see also Fed. R. Civ. P. Supp. R. G(2)(f). The Government’s complaint alleges that the funds seized from 0x81c4 are subject to forfeiture under
10
18 U.S.C. § 981(a)(1)(C) as property constituting or derived from proceeds traceable to violations of (or conspiracy to violate) sanctions against North Korea promulgated under the IEPPA, and under 18 U.S.C. § 981(a)(1)(A) as property involved in, or traceable to property involved in, money laundering or conspiracy to launder money. See Compl. ¶¶ 7–8. As explained below, the Government has alleged sufficient facts to meet its Supplemental Rule G burden and support a reasonable belief that it would be able to show at trial by a preponderance of the evidence that the funds seized from 0x81c4 constitute or are derived from proceeds traceable to IEEPA violations.
First, the Government extensively alleged a scheme by North Korea to evade U.S.
sanctions through IT workers that target private companies to gain employment, ask to be paid in stablecoins, and then launder and send the cryptocurrency to North Korea’s Foreign Trade Bank. Id. ¶ 59. The Government’s complaint cites the Department of State, the Department of the Treasury, U.N. Security Council Panel of experts, and the FBI on various findings regarding North Korea’s use of the IT industry to generate illicit revenue. See id. ¶¶ 24–27.
Second, the Government alleges how the funds seized from 0x81c4 form part of North Korea’s sanction-evasion scheme. While the Government is not required to disclose the identity of each party to a transaction, “it should be clear that the Government knows their identity and their connection to the sanction evasion scheme.” United States v. 1,827,242.65 of Funds Associated with Co. 1, No. 20-cv-2019, 2022 WL 59393, at *7 (D.D.C. Jan 6, 2022). In its complaint, the Government provides two examples of how the scheme worked to send illicit funds to North Korea’s FTB via Kim Sang Man, illustrating how North Korean IT Workers utilized fraudulent identity information to gain employment at two different U.S.-based IT development companies and send their income to IT Worker Consolidation Addresses, which
11
then sent funds to Kim Sang Man’s Binance accounts. Compl. ¶¶ 66–76. Here, there is enough information to conclude that the Government can identify each party and show how they connect to the illicit scheme. See Mingzheng, 324 F. Supp. 3d at 52–53. Specifically, the Government describes how 0x81c4 received approximately 158,122.85 USDC, on two separate blockchains, from at least ten IT Worker Payment Addresses as well as another 54,574 USDT from at least four IT Worker Payment Addresses. Compl. ¶ 81(b).
Taken together, the Government’s well-pleaded allegations, which must be taken as true for the purposes of a default judgment, see, e.g., Int’l Painters & Allied Trades Indus. Pension Fund v. R.W. Amrine Drywall Co., 239 F. Supp. 2d 26, 30 (D.D.C. 2002), detail a wire fraud and money laundering scheme by foreign entities to conduct unlicensed transactions on behalf of SDNs in violation of the IEEPA and establish that the funds seized from 0x81c4 constitutes or is derived from proceeds traceable to those IEEPA violations. The Government has thereby met its Supplemental Rule G burden by alleging sufficient facts to support a reasonable belief that it could show at trial that the funds seized from 0x81c4 are subject to forfeiture under 18 U.S.C. § 981(a)(1)(C).
The IEEPA-proceeds claim under 18 U.S.C. § 981(a)(1)(C) is independently sufficient to grant the motion for default judgment and forfeiture for the funds seized from 0x81c4. Thus, the Court need not address the Government’s alternative theory of forfeiture under 18 U.S.C. § 981(a)(1)(A).
V. CONCLUSION
For the foregoing reasons, the Court grants in part and denies in part the Government’s motion for default judgment and order of forfeiture (ECF No. 9). Judgment is entered in favor of the United States and against the potential claimants of the funds seized in 0x81c4, and these
12
funds are forfeited to the Government. As to the Remaining Defendant Property, the Government’s motion is denied without prejudice. An order consistent with this Memorandum Opinion is separately and contemporaneously issued.
Dated: September 3, 2026 RUDOLPH CONTRERAS United States District Judge