Back in Black

North Korea's Resurgent Coal Trade

James Byrne, Joe Byrne, Alessio Armenzoni, Hamish Macdonald
7 May 2025

Since September 2024, the Open Source Centre (OSC) has observed at least six foreign-flagged vessels loading coal and iron ore in North Korean ports and exporting their cargo abroad in violation of United Nations Security Council (UNSC) resolutions.

_{Source: Planet Labs, Open Source Centre.}

_{Source: Planet Labs, Open Source Centre.}

Sanctions unanimously adopted by the UNSC in 2016 and 2017 explicitly prohibit the import of these commodities from North Korea, the revenue from which is funnelled to the country's nuclear and ballistic missile programs. Resolution 2397, passed by the Security Council in 2017, explicitly acknowledged that the proceeds of North Korea's commodity sales contributed to the country's nuclear weapons and ballistic missile programs.

Despite the sanctions, satellite imagery and AIS data analysed by OSC show these vessels embarking on journeys to offload North Korean coal and iron ore in foreign ports, almost all of which are in China.

Vessel	IMO	Flag	Foreign Port Visit
ARMANI	1078561	Tanzania	Jingtang, China Binhai, China
CARTIER	1091898	Guyana (False)	Dalian, China
CASIO	9125786	Guyana (False)	Dalian, China
SOPHIA	1079345	Tanzania	Jingtang, China
YI LI 1	1059149	Unflagged	Yantai, China Territorial waters, Malaysia
AN YU	1077402	Unflagged	Gaogang, China

Cumulatively, these six vessels have likely conducted at least 18 voyages for the purpose of delivering these prohibited North Korean commodities, with all except one concluding in Chinese ports.

The 17 Chinese port visits conducted by the vessels were limited to facilities in the five cities of Dalian, Jingtang, Yantai and Gaogang, in addition to the Binhai special economic zone in Tianjin. These sites are located predominantly in northeast China.

The only voyage which deviated from this pattern was made by the YI LI 1 (IMO: 1059149) in March, when it sailed through the East China Sea, past Taiwan, Hong Kong and to the waters of Malaysia, where it is currently anchored.

_{Source: Windward Maritime AI, Skylight, Planet Labs, Satellogic, Maxar Technologies, Airbus Defence and Space, European Space Agency, Open Source Centre.}

_{Source: Windward Maritime AI, Skylight, Planet Labs, Satellogic, Maxar Technologies, Airbus Defence and Space, European Space Agency, Open Source Centre.}

While only one shipment was observed during the month of September, OSC detected a marked increase in these voyages since October 2024, with the fleet of six vessels maintaining a cadence of approximately three shipments per month, departing from North Korea's west coast ports.

_{Source: Open Source Centre.}

_{Source: Open Source Centre.}

Specialised maritime databases indicate that these vessels have a combined deadweight of approximately 330,000 metric tonnes.

By using the approximate price of North Korean coal applied by the former UN Panel of Experts in 2020 ($100 per ton), these shipments could represent over $33 million in value for North Korea.

_{Source: Windward Maritime AI, Skylight, Planet Labs, Satellogic, Maxar Technologies, Airbus Defence and Space, European Space Agency, Open Source Centre.}

Evasion Techniques: Something new, something old

The six vessels have all exhibited behaviours commonly characterised as ‘red flags’ indicative of illicit activity. For the majority of the tracked voyages, the vessels are ‘dark’, meaning they do not broadcast their location via AIS transmission. This represents a common practice amongst vessels involved in sanctions evasion or other illicit activities.

However, three of the six vessels - the YI LI 1, SOPHIA and ARMANI - did broadcast location signals on some of their voyages but appear to be using sophisticated AIS manipulation or ‘spoofing’ techniques' to not only mask their presence in North Korean ports but to create digital ship tracks that appear highly realistic. The spoofing techniques deployed by these ostensibly unconnected vessels are remarkably similar.

In some instances, the vessels, while identified via satellite imagery in North Korean waters, would broadcast AIS transmissions that made it appear that they were either in the Russian port of Nakhodka, or sailing towards Russian waters off the eastern coast of the Korean peninsula.

In the past, vessels laden with North Korean coal have entered Russian ports in an attempt to portray their cargo as Russian origin for ease of export at foreign ports. The spoofing activities exhibited by the YI LI 1, SOPHIA and ARMANI are likely for the same purpose, without the expense of fuel and time necessitated by the journey to Russian ports.

This spoofing technique is perhaps most clearly exhibited in the case of the YI LI 1, a vessel with a deadweight tonnage (DWT) of over 13,000.

YI LI 1: In two places at once

AIS transmissions for the YI LI 1 show it travelling from Qingdao, China on 22 January 2025, sailing eastbound around the southern tip of the Korean peninsula. Transmission stops for a brief period before restarting from what appears to be a South Korean naval base on 26 January, when it appears to sail directly towards Russian waters, and purportedly arrives on 28 January.

However, satellite imagery captured at the location of the YI LI 1’s AIS transmission in Russian waters, confirms that no vessel was present at that time.

The transmission subsequently continues and shows the vessel travelling south and passing under the peninsula again. Then, on 3 February 2024, it broadcast in the Yellow Sea between South Korea and China 00:09 UTC. However, high-resolution satellite imagery taken only seven minutes later at 00:16 UTC, shows the YI LI 1 in the North Korean port of Nampo berthed at the coal terminal.

Despite being present in North Korea, the vessel transmissions continue in the Yellow Sea. During this time, and throughout the likely spoofed journey to Russia, the transmissions are spaced somewhat far apart. On 6 February it began transmitting more consistently as it sailed towards the port of Yantai, China, where it is captured in satellite imagery at a coal terminal on 9 February at the exact location of its transmission on that date. This shipment may constitute a violation of UNSC Resolutions.

_{Source: Windward Maritime AI, Planet Labs, Open Source Centre.}

_{Source: Windward Maritime AI, Planet Labs, Open Source Centre.}

The vessel exhibited the same pattern of life during another observed voyage in late February and early March. On 24 February 2025, its broadcast consistent AIS transmissions appeared to show the vessel departing the port of Yantai, China, before going dark for a short period in the Yellow Sea on the same day. It sporadically broadcasts twice again in the Yellow Sea and then twice as it passes between the southern tip of the Korean peninsula and Jeju Island on 25 February.

It subsequently transmits during a purported journey again towards Russia over the next three days and also from Russian waters in the bay of Nakhodka between 28 February and 7 March. However, satellite imagery taken on 2 March at its location of transmission, again, does not show the presence of the vessel.

The transmissions then indicate the departure from Russian waters on 7 March and a voyage back past the southern tip of South Korea and into the East China Sea, concluding on 13 March. On 10 March, as transmissions placed the vessel in the Tsushima Strait, the YI LI 1 was again captured in satellite imagery in North Korean waters in Nampo, seemingly heavily laden with cargo. The transmission was broadcast four hours before the image was taken, making it impossible for the vessel to have reached Nampo during that time.

Again, throughout this likely spoofed journey to Russian waters, the transmissions are somewhat spaced apart and sporadic. However, from 13 March its transmissions were significantly more regular as it embarked on a long circuitous journey which led the vessel through the East China Sea, past Taiwan, Hong Kong and to the waters of Malaysia, where it has been anchored since 31 March 2025.

_{Source: Windward Maritime AI, Planet Labs, Airbus Defence and Space, Open Source Centre.}

_{Source: Windward Maritime AI, Planet Labs, Airbus Defence and Space, Open Source Centre.}

In both these cases, OSC identified the YI LI 1 in Nampo by comparing high-resolution satellite images of the vessel from October 2024, when it was transmitting in China, with images of the vessel in Nampo to highlight similarities. OSC repeated this process for each vessel identified.

Notably, the corporate network behind the YI LI 1 has previously been linked to the prohibited export of North Korean iron ore in 2024.

The YI LI 1 is operated by the Hong Kong-based Kind Glory Shipping Co Ltd, which also operated the SUNRISE 1 (IMO: 8355504). In June 2024, the SUNRISE 1 was detained by South Korean authorities and on 10 April 2025, the vessel, its owners and two Chinese individuals were sanctioned by South Korea for their involvement in a scheme to smuggle iron ore from North Korea, in violation of UN Security Council Resolution 2397.

Core Commodities

While Pyongyang has added new and highly lucrative revenue streams in the form of crypto and cyber raids, the export of commodities such as coal and iron ore remain a central pillar of the regime’s financial architecture.

This is evidenced by the persistent adaptations in sanctions evasion techniques employed by North Korea and those aiding their violations. This has included the transhipment of DPRK coal at Russian ports, exports using non-IMO registered Chinese barges and lighters, and exports using foreign-flagged vessels, of which several have been recently detained.

In January 2019, North Korean vessels began sailing directly into Chinese waters, and offload coal to flat bottomed barges in China.

Over the next two years, this preferred method would come to represent sanctions evasion on an industrial scale, with significant shipments of coal being exported from North Korea into Chinese territorial waters patrolled by Chinese coast guard.

In 2020, the UN Panel of Experts reported North Korea had exported over 3.7 million metric tonnes of coal worth an estimated $370 million dollars.

As such, the journeys detailed above represent a new stage, and adaptation, in North Korea’s sustained efforts to circumvent UNSC resolutions, again, with China as its core export market.

With high levels of scrutiny on North Korean flagged vessels, the involvement of these foreign-flagged bulk carriers adds significant coal carrying and revenue generation capacity for the North Korean government.

Conclusion

North Korea continues large-scale coal and iron ore exports to China, using sophisticated evasion techniques to circumvent UN sanctions, in order to generate tens of millions of dollars ultimately funnelled towards Pyongyang's prohibited weapons programmes.

However, these activities cannot be viewed in isolation. They form part of a broader, increasingly audacious pattern of behaviour by Pyongyang on the international stage. In recent months, this has included the unprecedented provision of vast quantities of munitions – potentially millions of artillery shells, rockets, and ballistic missiles – to Russia for its war effort in Ukraine, significantly bolstering Moscow's military capabilities.

Alongside this material support, North Korea has demonstrably deployed thousands of its own troops to fight alongside Russian forces.

Simultaneously, the regime relentlessly pursues its own military advancements, evidenced by recent missile tests from a newly built and launched destroyer. State-sponsored cyberattacks, such as Lazarus Group's multi-million dollar cryptocurrency thefts, provide another substantial revenue stream likely supporting these same WMD efforts.

The persistence of this coal and iron ore trade, occurring in an environment where the UN Panel of Experts has been disbanded following a Russian veto and key regional players facilitating sanctions evasion, highlights a stark geopolitical reality. North Korea's actions – spanning illicit trade, direct military support for an aggressor state, weapons proliferation, and global cyber theft – demonstrate a calculated strategy to generate revenue, advance military capabilities, and cement strategic alliances, all whilst exploiting fissures in the international sanctions regime.