Follow the Money

Exposing Russian Financing of North Korean Oil Transfers

Joe Byrne, Alessio Armenzoni, Om Gothi, Denys Karlovskyi, Zach Tvarozna
20 November 2025

On 16 February 2024, as North Korea celebrated its "Day of the Shining Star", a deal was struck for the importation of oil from Russia to North Korea in contravention of UN Security Council resolutions.

Under agreement ‘No. 2-2024’, an obscure Russian oil trading company named Southern Railway Expedition LLC (SRE) would facilitate payments enabling North Korean tankers to load oil at the Toplivo Bunkering Company (TBK) terminal, operating at the port of Vostochny in Russia's Far East.

In the background, a steady stream of North Korean munitions was already flowing to Russia, feeding the Russian artillery units pounding Ukrainian positions in Avdiivka, Kupyansk and Robotyne in its ongoing war of aggression.

In the evening at 18:34 Moscow time of 22 February 2024, Agreement ‘No. 2-2024’ was executed and the first payment from SRE was routed through Russia’s banking system on its way to the accounts of TBK. Two weeks later, North Korean tankers started loading Russian oil in violation of UN Security Council resolutions.

Amid ongoing speculation about the nature of the evolving Russia-North Korea relationship, Open Source Centre (OSC), in collaboration with iStories and OCCRP, can for the first time reveal the payment architecture of this shadow trade—and the Russian companies that fuelled North Korea in violation of UN sanctions Moscow had itself voted for.

_{Source: Planet Labs, Open Source Centre.}

_{Source: Planet Labs, Open Source Centre.}

Russian Oil to North Korea

In March 2024, the North Korean tanker Paek Yang San 1 (IMO: 9129653) made a highly unusual appearance, docking at the TBK terminal in the Russian port of Vostochny. This was not a vessel accustomed to open visits in foreign ports. Its life under North Korean control was spent in the shadows — plying the waters of the Taiwan Strait, conducting clandestine and prohibited ship-to-ship transfers (STS) in the open ocean, often under the cover of darkness. As such, the Paek Yang San 1's arrival was more than an anomaly; it was a clear signal that Moscow and Pyongyang, drawn together by the war in Ukraine, were growing increasingly intertwined.

That same month, across the world in New York, Russian diplomats vetoed the renewal of the mandate for the UN Panel of Experts, the very body tasked with monitoring North Korean sanctions evasion.

With the UN Panel effectively neutered, the operation began in earnest. Hundreds of high-resolution images captured over 2024 revealed the beginning of a major, sustained operation to deliver Russian oil to North Korea, which had, for years, struggled to procure energy for its ailing economy.

_{Source: Planet Labs, Airbus Defence and Space, Vantor, Satellogic, Windward, Starboard Maritime Intelligence, Open Source Centre.}

_{Source: Planet Labs, Airbus Defence and Space, Vantor, Satellogic, Windward, Starboard Maritime Intelligence, Open Source Centre.}

According to UN sanctions still in force today, Russia was compelled to detain the Paek Yang San 1 as it was long suspected of directly violating those resolutions. Instead, Russia loaded the vessel with oil, while a Russian company paid for the transhipment, via a Russian bank.

More violations followed, with seven UN-sanctioned tankers — all prohibited from entering ports — visiting the TBK terminal, loading oil and departing on at least 27 occasions since March 2024.

The direct transport of Russian oil to North Korea simplified the route and process compared to previous procurement methods used by Pyongyang. These operations required vessels to undertake protracted journeys to the Taiwan Strait to conduct STS transfers.

_{Source: Planet Labs, Vantor, Open Source Centre.}

_{Source: Planet Labs, Vantor, Open Source Centre.}

However, despite this simplified supply line, North Korea's petroleum import infrastructure, particularly on its eastern coast, remains underdeveloped. This limits its capacity to quickly import large volumes of product and distribute it across the country.

_{Source: Vantor, Open Source Centre.}

_{Source: Vantor, Open Source Centre.}

_{Source: Open Source Centre.}

_{Source: Open Source Centre.}

Making a Digital Twin

For years, Russia and China had objected to assessments made by the UN Panel of Experts concerning North Korean oil deliveries, claiming that satellite imagery could not accurately assess whether tankers arriving at the country’s ports were laden with oil.

To address these questions, OSC created a highly detailed 3D model of one of the most frequently observed DPRK tankers, the Yu Son (IMO: 8691702). Using a number of advanced analytic techniques, such as multiple camera projection, rotoscopy and photogrammetry, this digital twin of the Yu Son enabled OSC to make highly accurate laden assessments of the vessel when it was in port.

By combining the data from the digital model with the observed sun elevation, shadow lengths and the metadata from the satellite sensor, the resulting 3D analysis shows that in five of the six satellite images of the Yu Son in Russian and North Korean waters, it was undeniably, heavily laden with oil.

Transhipment Services

Less than two weeks before the first North Korean tanker docked in Vostochny, an advance payment was wired to TBK for "transshipment services" to begin in March. The sender was Southern Railway Expedition LLC (SRE), a small Russian oil trader with no discernible online presence.

This initial transfer, the records for which were seen by OSC, iStories and OCCRP reveals this payment was the first of over a dozen. Over the course of the year, these payments from SRE to TBK would create a steady stream of funds totalling nearly 250 million rubles. When mapped against the dates on which North Korean tankers were observed at the TBK terminal in high-resolution imagery, the flow of money nearly perfectly matches the cadence of transhipments.

The largest transaction took place on 29 March 2024. The following month, 13 North Korean tankers visited the port. In August 2024, during a lull in payments, OSC did not identify a single shipment in high-resolution imagery. Across all the other months in which North Korean tankers visited to load oil, SRE made payments to TBK.

The payments and loading operations also coincided with a significant increase in revenue for both SRE and TBK. According to official filings reported by SRE, the company’s net turnover saw a 20-fold increase, surging from 883.5 million rubles in 2023, to 18.03 billion rubles in 2024. Simultaneously, TBK reported a five-fold increase in net turnover from 49.6 million rubles in 2023 to 246.2 million rubles in 2024.

Follow the Money

This operation, however, did not occur in a vacuum. In February 2024, just a month before the Paek Yang San 1's visit to Vostochny, media reports indicated that Russia had released North Korean funds, originally frozen in its banking system following the imposition of UN sanctions. The New York Times alleged, citing intelligence officials, that these funds were earmarked for North Korean oil purchases.

As SRE's payments flowed to TBK, the US Treasury began to designate the entities behind these transactions. The designations revealed a sophisticated "shell game" of banks and cut-outs, reportedly orchestrated by the Central Bank of Russia to obscure its dealings with North Korea.

One scheme allegedly involved a designated Russian bank, TSMRBank (aka Bank for the International Settlements, aka CMR Bank), using a "cut-out" bank in South Ossetia to open accounts for North Korea's sanctioned Foreign Trade Bank (FTB). According to the OFAC designation, TSMRBank’s vice president, Dmitry Yuryevich Nikulin, personally "facilitated cash deposits" and coordinated with DPRK representatives to deliver "millions of dollars and rubles in banknotes". At least some of these secret accounts were used "to pay for fuel exports from Russia to the DPRK".

Data seen by OSC and its journalistic partners shows that the first payments made by SRE to TBK were routed from TSMRBank in February, the very same month media reports claimed the Russian Central Bank had unfrozen North Korean accounts to finance the oil trade.

Following the payments through TSMRBank, millions of rubles also moved through Russia’s PSB Bank to TBK, while PSB also extended close to 900 million rubles in credit facilities to SRE.

Once a major private financial institution, PSB Bank was nationalised in 2017. The following year, the Kremlin assigned it a new, explicit mandate: to service the Russian military-industrial complex. This restructuring consolidated high-risk defense financing into a single entity, insulating other major state banks like Sberbank and VTB from sanctions.

As of late 2021, PSB Bank was already servicing nearly 70% of all state contracts signed by the Russian Ministry of Defense. The bank's integration into the state security apparatus was finalised with the appointment of its CEO, Petr Fradkov, the son of Mikhail Fradkov, who is the former Prime Minister of Russia and former Director of Russia’s Foreign Intelligence Service (SVR) from 2007 to 2016.

Southern Railway Expedition

SRE was registered on 25 January 2019 in Moscow. Despite being involved in 'wholesale trade of solid, liquid and gaseous fuels', SRE maintains virtually no online presence, lacking an active website or social media presence. Meanwhile, the company’s two registered addresses are located in nondescript office blocks in Moscow. At one of these addresses, on 10 Grimau Street (улица Гримау, д. 10), dozens of companies involved in the rail, freight forwarding and oil industry appear to have brass-plate registrations.

Currently, SRE’s sole owner is a Russian national named Nikolay Vladimirovich Gerasimenko. While Gerasimenko has almost no identifiable online presence, he also owns two Moscow-based heating providers and is a shareholder in an oil trading firm in a sparsely populated area on the Caspian coast. The latter company, Energotrade Kalmykia, is partly owned by a company named AG-Invest, which, in turn, is owned by Ruslan Agayev, whose Chechen family rose to prominence as oil magnates through their Yug-Nefteprodukt conglomerate.

According to findings by iStories, Gerasimenko is described in a number of leaked telephone directories as “Nikolai Energotrade Security Officer”, or as “Nikolai Oil Security Chief”, indicating he may also be an managerial-level employee of Energotrade Kalmykia.

Conclusion

For over a decade, Russia supported several UN Security Council resolutions designed to stop Pyongyang's nuclear ambitions. Now, three years into its invasion of Ukraine, Moscow has not merely ignored those resolutions, but worked assiduously to undermine them.

While the precise military technologies flowing to North Korea remain obscured, the reciprocal benefits are stark. Russia has granted the Kim regime invaluable breathing room, revenue, strategic commodities and diplomatic cover. In doing so, it has surrendered some of the international community's most potent leverage against Pyongyang’s illicit programmes: the flow of refined petroleum.

Yet, this realignment was born not of grand strategy, but of necessity. The promised ‘three-day operation’ has metastasized into a grinding war of attrition, claiming over a million Russian casualties. To replenish its arsenals and shield the urban elite from conscription—a demographic Putin fears to touch—he has bartered global security for North Korean munitions, reducing Russian companies and banks to willing conduits for Pyongyang’s illicit trade.

This article has been prepared by the Open Source Centre (OSC) for informational purposes only (the ‘Permitted Purpose’). While all reasonable care has been taken by the OSC to ensure the accuracy of material in this report (the ‘Information’), it has been obtained from open sources, and the OSC makes no representations or warranties of any kind with respect to the Information.

You should not use, reproduce or rely on the Information for any purpose other than the Permitted Purpose. Any reliance you place on the Information is strictly at your own risk. If you intend to use the Information for any other purpose (including, without limitation, to commence legal proceedings, take steps or decline to take steps or otherwise deal with any named person or entity), you must first undertake and rely on your own independent research to verify the Information.

To the fullest extent permitted by law, the OSC shall not be liable for any loss or damage of any nature whether foreseeable or unforeseeable (including, without limitation, in defamation) arising from or in connection with the reproduction, reliance on or use of any of the Information by you or any third party. References to the OSC include its directors and employees.

_{POWERED BY}