• The US Treasury has sanctioned 10 individuals and one entity linked to North Korean IT worker fraud.
• Two Russian nationals, Ilya Boykov and Vitold Obertas, allegedly converted millions in crypto for North Korea.
• The Treasury also designated a North Korean-run center in Russia, along with eight crypto addresses on Ethereum and Tron.
• The schemes use fake identities to land jobs at legitimate firms and send wages to Pyongyang’s weapons programs.

The Treasury Department’s Office of Foreign Assets Control (OFAC) announced the sanctions on October 28. The action goes after financial intermediaries and workers based in Russia and North Korea who support IT worker operations.

Treasury says Boykov exchanged and converted about $3.5 million in crypto for Alis, a company sanctioned in March 2024 over links to North Korean IT workers. Obertas allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.

North Korean operatives use stolen identities, forged documents and invented personas to secure remote jobs at legitimate companies. The regime then keeps most of the wages, turning routine software work into state revenue.

The danger goes beyond paying a disguised employee. Treasury says these workers have used corporate network access to plant malware and steal sensitive and proprietary data.

Chainalysis reports that operatives have also used generative AI to write resumes and cover letters and to prepare for technical interviews. In some cases, AI-generated profile photos and deepfake video helped hide their identities during hiring calls.

Chainalysis traced crypto earned by a North Korean IT worker to Boykov, who sent the funds to Garantex, a now-sanctioned Russian exchange, to cash out.

OFAC also designated the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia. Six workers sanctioned alongside it generated over $750,000 for the group since 2025, according to Treasury. The designation notice lists eight crypto addresses on Ethereum and Tron tied to those sanctioned.

The latest action follows a March sanctions round in which Treasury targeted six people and two companies accused of laundering $800 million in crypto for North Korea.

Together, the moves show US authorities increasingly focusing on the middlemen who turn North Korean earnings into usable cash, rather than only on the workers themselves.