• The US Treasury has sanctioned 10 individuals and one entity linked to North Korean IT worker fraud.
• Two Russian nationals, Ilya Boykov and Vitold Obertas, allegedly converted millions in crypto for North Korea.
• The Treasury also designated a North Korean-run center in Russia, along with eight crypto addresses on Ethereum and Tron.
• The schemes use fake identities to land jobs at legitimate firms and send wages to Pyongyang’s weapons programs.

The Treasury Department’s Office of Foreign Assets Control (OFAC) announced the sanctions on October 28. The action goes after financial intermediaries and workers based in Russia and North Korea who support IT worker operations.

Treasury says Boykov exchanged and converted about $3.5 million in crypto for Alis, a company sanctioned in March 2024 over links to North Korean IT workers. Obertas allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.

North Korean operatives use stolen identities, forged documents and invented personas to secure remote jobs at legitimate companies. The regime then keeps most of the wages, turning routine software work into state revenue.

The danger goes beyond paying a disguised employee. Treasury says these workers have used corporate network access to plant malware and steal sensitive and proprietary data.

Chainalysis reports that operatives have also used generative AI to write resumes and cover letters and to prepare for technical interviews. In some cases, AI-generated profile photos and deepfake video helped hide their identities during hiring calls.

Chainalysis traced crypto earned by a North Korean IT worker to Boykov, who sent the funds to Garantex, a now-sanctioned Russian exchange, to cash out.

OFAC also designated the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia. Six workers sanctioned alongside it generated over $750,000 for the group since 2025, according to Treasury. The designation notice lists eight crypto addresses on Ethereum and Tron tied to those sanctioned.

The latest action follows a March sanctions round in which Treasury targeted six people and two companies accused of laundering $800 million in crypto for North Korea.

Together, the moves show US authorities increasingly focusing on the middlemen who turn North Korean earnings into usable cash, rather than only on the workers themselves.

TL;DR: New York’s attorney general is seeking $1.3 billion in monetary relief in the NovaTech case and has announced nearly $6 million in promoter settlements. The larger sum is a request to the court, not money recovered for investors.

New York’s effort to recover losses from the NovaTech cryptocurrency scheme has reached a new stage, with Attorney General Letitia James asking a court to impose roughly $1.3 billion in damages and disgorgement.

The October 22 announcement also disclosed nearly $6 million in settlements with four promoters. Those are separate from the much larger claim involving founders Cynthia and Eddy Petion. The announcement does not establish that either amount has already reached victims.

The case concerns investment packages sold through NovaTech and an earlier business, AWS Mining. According to the attorney general, the schemes targeted Haitian and other immigrant communities through religious networks, social media and messaging groups.

The New Filing Follows An Earlier Judgment

An affirmation filed on October 22 supports the request for monetary relief. It records that New York sued in June 2024 and that the defaulting defendants did not respond or appear. The court entered a default order and judgment on August 4, 2025.

The latest motion asks the court to determine the financial consequences. It should not be confused with a new criminal conviction, a completed recovery or a guarantee that a judgment can be collected. Those distinctions are particularly important when the sums sought are much larger than the settlements announced alongside them.

The promoter figures listed by the attorney general are $2.9 million from Martin Zizi, $2.05 million from Frantz Ciceron, $750,000 from James Corbett and $275,861 from Ricardo Roy Sr. All four face permanent bans from the securities, commodities and cryptocurrency industries.

The timing also needs care: the Zizi consent papers were filed in November 2025. This week’s announcement brings the settlement figures together; it does not mean every agreement was signed this week.

Recruitment Promises Outran The Trading Business

The original mining operation offered high returns and recruiting bonuses, according to the court affirmation. NovaTech later marketed cryptocurrency trading packages. The cryptocurrency label described how investors supplied money, but the underlying issue was what operators actually did with it.

That is a useful distinction for readers assessing similar pitches. An account balance on a website does not establish that assets exist, that trades occurred or that withdrawals can be honored. Nor does a familiar community connection answer questions about custody and control of funds.

For affected investors, the next substantive development will be the court’s decision on monetary relief and any subsequent recovery process. The announced settlements and the requested award address different defendants and different steps in that process; combining them into a headline recovery figure would overstate what has happened.

Related reading: How crypto exchanges work.

Written by the News Desk and edited by Samuel Rae.