CryptoSlate
US authorities sanctioned 10 individuals and one entity accused of helping turn North Korean IT workers’ earnings into funds for the regime’s weapons programs. Two Russian nationals allegedly facilitated about $5.5 million in cryptocurrency transactions, while a Chainalysis investigation traced stablecoin salary payments through Ethereum wallets to intermediaries linked to Russian exchanges.
Why it matters
The alleged pipeline began inside legitimate businesses. North Korean operatives used stolen identities, fabricated work histories and, in some cases, generative AI to secure remote jobs, including at crypto companies. One suspected developer contributed code to blockchain and DeFi projects while receiving regular cryptocurrency payments. Treasury has warned that workers can exploit corporate access to deploy malware, steal proprietary information and extract sensitive data.
The United Nations Panel of Experts estimated that North Korean IT worker schemes generate $250 million to $600 million annually. The allegations show how routine payroll from legitimate employers can become part of a wider sanctions-evasion and weapons-funding channel.
Market impact
Chainalysis traced stablecoin payments made roughly every two weeks between late 2022 and early 2023. The suspected developer converted stablecoins into Ethereum (ETH), then sent the funds to consolidation addresses linked by the firm to sanctioned entities. The investigation traced another link to Russian national Ilya Boykov and the sanctioned exchange Garantex.
Treasury says Boykov processed the equivalent of $3.5 million in cryptocurrency transactions since 2024. Another Russian national, Vitold Obertas, allegedly converted nearly $2 million in cryptocurrency and handled at least $1.25 million in other currency transactions since January 2025. The US designations include associated Ethereum and Tron addresses, giving exchanges and other intermediaries identifiers to screen for exposure. US persons are generally barred from dealing with designated individuals or their blocked property without authorization.
Frequently asked questions
-
How did investigators trace the suspected North Korean workers’ pay?
Chainalysis identified recurring stablecoin payments to a suspected developer’s wallet, which converted the funds into Ethereum before sending them to consolidation addresses linked to sanctioned entities.
-
What role did Russian intermediaries allegedly play?
Two Russian nationals were accused of facilitating cryptocurrency transactions. Investigators traced funds to intermediaries linked to Russian exchanges, including sanctioned exchange Garantex.
-
How much revenue do North Korean IT worker schemes generate?
A United Nations Panel of Experts estimate cited by Chainalysis puts annual revenue from the schemes at between $250 million and $600 million.
-
Why do the allegations concern crypto companies beyond sanctions compliance?
Suspected operatives secured remote jobs at legitimate businesses, including crypto firms. Treasury warned that workers could use corporate access to deploy malware, steal proprietary information or extract sensitive data.
-
What do the US designations mean for cryptocurrency intermediaries?
Treasury identified Ethereum and Tron addresses associated with designated individuals. Exchanges and other intermediaries can use those identifiers to screen for exposure, while US persons are generally prohibited from dealing with designated parties or blocked property without authorization.
WuBlockchain
CoinTelegraph
TheBlock