Abstract Proposal: North Korea-linked financial cybercrime is now a revenue operation, not a single hack. Drawing on sanitized 2024-2025 cases and Korean-language human intelligence, this session follows the trail from crypto theft and remote-work fraud to scam infrastructure and laundering. Attendees will learn to: 1) spot worker-fraud and laundering signals; 2) collect evidence from identity, endpoint, cloud apps, human resources, payroll, messaging, and financial records; 3) coordinate security, fraud, legal, compliance, and law enforcement response.