US Treasury Sanctions 11 Over North Korean IT Worker Crypto Laundering
OFAC designated 10 individuals and one entity tied to North Korean IT worker schemes. The list includes two Russians who allegedly converted millions in crypto. Chainalysis traced deposits to mainstream and sanctioned exchanges, including Garantex.
Washington has turned its sanctions tools on the Russian middlemen who turn North Korean IT workers' wages into usable money. The US Treasury's Office of Foreign Assets Control (OFAC) designated 10 individuals and one entity over the schemes, naming two Russian crypto converters alongside North Korean delegation leaders and workers. The action is set out in Treasury's press release, and the designations appear on OFAC's recent actions page.
How the scheme works
The schemes rely on stolen or invented identities, forged documents and fabricated personas to place North Korean workers at legitimate firms. Pyongyang keeps most of the pay. Treasury says that money funds its weapons of mass destruction and ballistic missile programs. Treasury also said workers have used their network access to install malware and steal proprietary data.
Blockchain analytics firm Chainalysis added a technical detail. Operatives used generative AI to write resumes and cover letters, and in some hiring calls they relied on AI-generated photos and deepfake video.
The named targets
Russian national Vitold Viktorovich Obertas allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. Fellow Russian national Ilya Boykov allegedly converted about $3.5 million in crypto for Alis, a North Korean IT worker company sanctioned in 2024.
Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were named for leading Russia-based worker delegations. Kim Ki Hyok reportedly moved close to $500,000 in crypto since 2024.
Treasury also designated the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia. Six workers who have generated more than $750,000 for it since 2025 were designated with it.
On-chain trail
Treasury published wallet addresses on Ethereum and Tron. One Ethereum address links to both Obertas and Boykov.
Chainalysis found that Obertas' wallet received funds from Amnokgang, an IT worker firm OFAC sanctioned on March 12, and made deposits at both mainstream and sanctioned exchanges. Chainalysis did not name the mainstream platforms. It also traced funds from Boykov to Garantex, the Russian exchange under US sanctions since April 2022.
What changes for market participants
Under the designations, US-held property of the named parties is blocked and must be reported to OFAC. Entities owned 50 percent or more by blocked parties are covered as well, and civil penalties can apply even to unintentional violations. For exchanges and compliance teams, the published addresses are the immediate screening task, particularly given Chainalysis' finding of deposits at mainstream venues.
The action follows a March designation of a separate network that Treasury said laundered roughly $800 million in crypto. Australia and the EU announced related designations this month, and Treasury said it coordinated with the Multilateral Sanctions Monitoring Team. The latest round puts the weight on the people who move the money rather than on the workers alone, with the Russian intermediaries who cash out the pay now squarely in scope.
