Treasury Sanctions 11 Over North Korean IT Worker Crypto Scheme

The U.S. Treasury Department on Wednesday sanctioned 10 individuals and one entity for their roles in North Korean IT worker schemes that defraud U.S. businesses and generate revenue for the country's weapons programs, according to the department's Office of Foreign Assets Control (OFAC).

The action names two Russian nationals who converted millions of dollars in cryptocurrency for North Korean networks, a Russia-based front company, and a set of Ethereum and Tron wallet addresses now listed on the sanctions register. It is the latest step in an escalating enforcement campaign that now spans three jurisdictions.

North Korea places IT workers at legitimate companies using fake documents, stolen identities and invented personas, then seizes most of their wages, Treasury said. The scheme generates hundreds of millions of dollars annually for the regime's weapons of mass destruction and ballistic missile programs. The networks rely on what Treasury described as "sophisticated cryptocurrency transactions," money laundering and artificial intelligence tools to move funds back to Pyongyang.

"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," Treasury Secretary Scott Bessent said in the announcement.

Who was sanctioned, and for how much?

The designations cover several distinct roles in the revenue pipeline, each with quantified transaction volumes attached:

• Vitold Obertas, a Russian intermediary for North Korean financial transactions, carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials.
• Ilya Boykov, also Russian, exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company sanctioned in 2024.
• The First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia, which Treasury said deploys highly trained IT workers who use AI tools and "complex cryptocurrency transfers" to generate revenue. Six Russia-based North Korean IT workers have produced more than $750,000 for the center since 2025.
• Kim Ki Hyok, a North Korean national leading a Russia-based IT worker delegation, has transferred nearly $500,000 in crypto for his delegation since 2024. A second delegation leader was also designated.

The combined newly disclosed conversion volumes approach $7 million — a figure Treasury treats not as the total scale of the scheme but as the measurable slice flowing through named individuals.

What does this change for crypto firms and hiring teams?

The sanctions listings include on-chain identifiers, which is where the operational consequences land. Boykov's entry carries two Ethereum and two Tron addresses; Obertas's carries one Ethereum and three Tron addresses. One Ethereum address appears on both men's entries, a shared cluster that compliance teams can now flag directly.

For exchanges, custody providers and any firm running transaction monitoring, the immediate task is screening those addresses against historical flows and freezing or reporting matches. For hiring managers, the action reinforces what Treasury has signaled repeatedly: the IT worker channel is a primary sanctions and espionage vector, and identity verification for remote engineering contractors is now a compliance function, not merely an HR one.

The action builds on sanctions against a separate North Korean IT worker network in March. Australia and the European Union issued their own designations this month, Treasury noted, meaning parallel obligations now apply across jurisdictions where many crypto firms are domiciled.

A widening target set

North Korean IT workers have increasingly targeted crypto projects directly. In April 2025, Google's Threat Intelligence Group reported that such workers had embedded themselves in crypto projects in the UK, Germany, Portugal and Serbia — including Solana smart contract development — with some operating under as many as 12 fake identities at once.

The deception extends to full-scale compromise operations. In April, Solana-based exchange Drift Protocol said the attack that drained roughly $285 million from its platform was a six-month operation by a North Korean state-affiliated group, whose intermediaries met Drift contributors in person while posing as a quantitative trading firm, Decrypt reported.

Treasury's designation of the Vladivostok-based First Financial and Technical Development Center signals that the department is moving up the chain from individual workers to the corporate infrastructure that employs and pays them. Firms with contractor relationships in Russia should expect continued additions to the SDN list in this corridor.

With OFAC, Australia and the EU all acting within a single month, and the March precedent already on the books, the enforcement window for screening exposed addresses and contractor relationships is effectively now.