CoinDesk
The U.S. Treasury sanctioned 10 people and one entity on Oct. 28 over networks accused of routing earnings from North Korean IT workers to Pyongyang. Russian nationals Ilya Boykov and Vitold Obertas allegedly converted about $3.5 million and nearly $2 million in cryptocurrency, respectively, for North Korean-linked activity.
Why it matters
OFAC said the networks funnel foreign wages into North Korea’s weapons programs. Workers allegedly used stolen identities, fraudulent documents and fabricated personas to obtain jobs at legitimate companies, with the regime taking most of their earnings. Treasury also warned that workers have used corporate access to install malware and steal sensitive or proprietary information.
The designations include the First Financial and Technical Development Center, a North Korean-controlled organization in Russia. Six workers designated alongside it generated more than $750,000 for the organization since 2025. OFAC listed eight cryptocurrency addresses across Ethereum and Tron. Chainalysis said operatives have used generative AI to prepare job applications and interviews, and in some cases AI-generated profile photos and deepfake video to conceal their identities.
Market impact
The action targets financial intermediaries as well as workers, putting crypto conversion routes and associated addresses under sanctions scrutiny. Chainalysis traced cryptocurrency earned by a North Korean IT worker to Boykov, who sent it to Garantex, a Russian exchange that is also sanctioned.
For exchanges and companies hiring remote technical staff, the case highlights both sanctions exposure and the risk of covert access to corporate networks. In March, Treasury sanctioned six people and two companies over allegations they laundered $800 million in crypto for North Korea.
Frequently asked questions
-
How much crypto did the two Russian nationals allegedly convert?
Ilya Boykov allegedly converted about $3.5 million, while Vitold Obertas allegedly converted nearly $2 million for North Korean-linked activity.
-
How did the North Korean IT worker schemes allegedly generate revenue?
Workers allegedly used stolen identities and fraudulent documents to secure jobs at legitimate companies. North Korea took most of their wages, which Treasury said helped fund weapons programs.
-
What risks did Treasury associate with the workers’ access to companies?
Treasury said North Korean IT workers have used corporate access to install malware and steal sensitive data and proprietary information.
-
Which crypto networks had addresses listed by OFAC?
OFAC listed eight cryptocurrency addresses across Ethereum and Tron linked to the sanctioned individuals.
-
What role did Garantex play in the case?
Chainalysis traced crypto earned by a North Korean IT worker to Boykov, who sent it to Garantex, a Russian exchange that is now sanctioned.
CryptoSlate
WuBlockchain
WatcherGuru
TheBlock