South Korea’s Ministry of Foreign Affairs sanctioned the North Korea-based Kimsuky group on June 1, 2023 and listed two Bitcoin addresses as identifiers, alongside a joint advisory with South Korean and U.S. agencies on related cyber-espionage activity. Chainalysis describes Kimsuky as active since at least 2012, targeting government, political, and academic organizations while also using scams, theft, cryptojacking, and sextortion-like tactics to fund operations. The observed wallet activity included mainstream exchange and mining-pool interactions; the source says repeated small payments could indicate sextortion or fraud, while mining-pool use may support laundering of illicit cryptocurrency.