Treasury Sanctions 11 Targets Behind North Korea's Fake-Worker Crypto Pipeline

The U.S. Treasury Department on Tuesday sanctioned ten individuals and one company for laundering cryptocurrency and fiat payments earned by North Korean IT workers placed at foreign firms, many of them American, under fake identities and forged paperwork.

The enforcement action, led by the Office of Foreign Assets Control (OFAC), targeted the money-movers rather than the workers themselves. Two Russian nationals sit at the center of the designation.

Vitold Obertas, described by Treasury as a go-between for North Korean financial transactions, allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025. Ilya Boykov allegedly converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT-worker company that the U.S. sanctioned in 2024.

Who else did Treasury name?

Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were designated for leading Russia-based worker delegations. Kim Ki Hyok has reportedly moved close to $500,000 in crypto for his team since 2024.

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who have generated more than $750,000 for it since 2025.

OFAC published wallet addresses on Ethereum and Tron tied to the sanctioned individuals — a direct signal to exchanges and other financial institutions to screen for those accounts. One Ethereum address is linked to both Obertas and Boykov, tightening the connection between the two alleged facilitators.

How do the fake workers operate?

The workers are typically placed at legitimate firms under invented personas. Treasury says the toolkit includes AI-generated resumes, doctored photos and deepfake video used during remote interviews.

Most of their pay flows back to the regime, which Treasury says uses the money to fund its weapons of mass destruction and ballistic missile programs. The fraud carries an operational risk beyond payroll: some workers have gained access to corporate networks, where they planted malware and took proprietary data.

What does the enforcement picture look like?

Tuesday's action follows a March designation of a separate North Korean IT-worker network, which Treasury said had laundered roughly $800 million in crypto for the regime. Australia and the European Union announced related designations this month, and Treasury coordinated the new sanctions with the Multilateral Sanctions Monitoring Team.

Under the sanctions, any property the designated individuals and entities hold in the United States, or that is controlled by U.S. persons, is blocked and must be reported to OFAC. Transactions with them are generally prohibited unless licensed. Companies owned 50 percent or more by blocked parties fall under the same restrictions, and Treasury warned that civil penalties can apply even when a violation was unintentional.

What should hiring firms do now?

For companies that hire remote contractors, advisories from the State, Treasury and Justice departments and the FBI offer guidance on spotting these schemes: verify identities, check where payments are going, and watch for unusual access requests.

The published wallet addresses now give compliance teams concrete screening targets, and the coordinated designations from Australia and the EU widen the enforcement net — expect exchanges and payroll providers to tighten screening of Ethereum and Tron flows tied to Russia-based contractor arrangements in the months ahead.