| in or about December 2020 until in or about April 2022 | Co-located North Korean IT worker team (traveled to the United Arab Emirates) stealing and laundering virtual currency from victim companies | United Arab Emirates (where team was located) | KIM KWANG JIN; KANG TAE BOK; JONG PONG JU; CHANG NAM IL |
| February 2022 | Virtual token company based in Serbia (IT worker theft) | Serbia | Jong Pong Ju (alias "Bryan Cho"); Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, Chang Nam Il charged |
| In 2022 | Theft from Company 2, a blockchain research and development company headquartered in Atlanta, Georgia, by a remote developer | U.S. (Atlanta, Georgia) | Chang Nam Il, a North Korean citizen (Bong Chee Shen persona) |