Chainalysis Maps Russian Cash-Out Network Behind North Korean IT Worker Millions

The US Treasury Department sanctioned 10 individuals and one entity on Wednesday for supporting North Korean government-run IT worker schemes that Treasury says funded the country's weapons programs, according to an official press release. Blockchain analytics firm Chainalysis, in a Wednesday report, traced how those operatives cashed out millions of dollars in crypto through Russian intermediaries and the sanctioned exchange Garantex.

The sanctions, issued by Treasury's Office of Foreign Assets Control (OFAC), named two Russian nationals in particular: Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas. Treasury said Boykov converted about $3.5 million in crypto for the sanctioned company Alis since 2024. Obertas, according to the same filing, handled nearly $2 million in crypto conversions for North Korean officials since January 2025.

What did the on-chain trail show?

Chainalysis mapped a long-running network of Russian intermediaries who helped North Korean IT workers convert their earnings into spendable funds. In one documented example, a wallet linked to a North Korean IT worker received regular stablecoin payments, converted them into Ether (ETH), and moved the funds through consolidation addresses to Boykov. Boykov then sent the crypto to Garantex, the Russian exchange under US sanctions, to cash out.

The pattern matters because it shows a repeatable operational pipeline rather than one-off transfers:

• Stablecoin wages paid to wallets tied to North Korean IT workers
• Conversion into Ether through consolidation addresses
• Transfer to Russian intermediaries like Boykov
• Final cash-out at Garantex

That structure, per Chainalysis, let workers hold jobs at foreign firms under false identities while routing proceeds through layers that obscure their origin before reaching a sanctions-exposed exchange.

Why does this keep happening?

North Korean IT workers using fabricated identities to land jobs at crypto companies have posed a persistent security threat for years. The schemes do more than generate payroll — Treasury says the proceeds feed Pyongyang's weapons programs, which is why OFAC keeps escalating designations against the facilitators around the workers themselves.

US law enforcement is running a parallel track. In June 2025, the Department of Justice announced charges against four North Korean nationals over a scheme involving fraudulent IT employment and the theft of more than $900,000 from US and Serbian crypto companies.

The enforcement picture is now two-pronged: DOJ prosecutes the workers and their handlers, while OFAC targets the financial plumbing — the brokers, the front companies and the exchanges — that make the earnings usable. For crypto firms, the operational takeaway is hiring risk. A remote developer with verified documents can still be a sanctioned-country operative whose salary flows into a weapons-program cash-out chain, and firms that pay those wallets risk touching OFAC-designated infrastructure.

With Garantex already sanctioned and the intermediary network now named and mapped on-chain, Treasury's designations give compliance teams concrete addresses and counterparties to screen against — and further OFAC actions against remaining facilitators remain an open enforcement window.