TLDR

• The US Treasury has sanctioned 10 individuals and one entity linked to North Korean IT worker fraud.
• Two Russian nationals, Ilya Boykov and Vitold Obertas, allegedly converted millions in crypto for North Korea.
• The Treasury also designated a North Korean-run center in Russia, along with eight crypto addresses on Ethereum and Tron.
• The schemes use fake identities to land jobs at legitimate firms and send wages to Pyongyang’s weapons programs.

Treasury Targets Crypto Conversion Networks

The Treasury Department’s Office of Foreign Assets Control (OFAC) announced the sanctions on October 28. The action goes after financial intermediaries and workers based in Russia and North Korea who support IT worker operations.

Treasury says Boykov exchanged and converted about $3.5 million in crypto for Alis, a company sanctioned in March 2024 over links to North Korean IT workers. Obertas allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.

How the IT Worker Schemes Operate

North Korean operatives use stolen identities, forged documents and invented personas to secure remote jobs at legitimate companies. The regime then keeps most of the wages, turning routine software work into state revenue.

The danger goes beyond paying a disguised employee. Treasury says these workers have used corporate network access to plant malware and steal sensitive and proprietary data.

Chainalysis reports that operatives have also used generative AI to write resumes and cover letters and to prepare for technical interviews. In some cases, AI-generated profile photos and deepfake video helped hide their identities during hiring calls.

Garantex Link and Russian Front Center

Chainalysis traced crypto earned by a North Korean IT worker to Boykov, who sent the funds to Garantex, a now-sanctioned Russian exchange, to cash out.

OFAC also designated the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia. Six workers sanctioned alongside it generated over $750,000 for the group since 2025, according to Treasury. The designation notice lists eight crypto addresses on Ethereum and Tron tied to those sanctioned.

The latest action follows a March sanctions round in which Treasury targeted six people and two companies accused of laundering $800 million in crypto for North Korea.

Together, the moves show US authorities increasingly focusing on the middlemen who turn North Korean earnings into usable cash, rather than only on the workers themselves.

Bitcoin Magazine

U.S. Treasury Sanctions Crypto Launderers Behind North Korea’s Fake Workers

The U.S. Treasury Department on Tuesday sanctioned ten individuals and one company, accusing them of helping North Korea collect wages from foreign employers, many of them American, through fake identities and forged paperwork.

The workers are typically placed at legitimate firms under invented personas, sometimes with AI-generated resumes, doctored photos, or deepfake video during interviews. 

Most of their pay goes back to the regime, which Treasury says uses the money to fund its weapons of mass destruction and ballistic missile programs. Some of these workers have also gained access to corporate networks, where they have planted malware and taken proprietary data.

The money and crypto behind North Korean fraud

The sanctions focused less on the workers themselves than on the people who move the money. Two Russian nationals are at the center of the action. 

Vitold Obertas, described by Treasury as a go-between for North Korean financial transactions, allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025. 

Ilya Boykov allegedly converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT worker company that the U.S. sanctioned in 2024.

Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were also named for leading Russia-based worker delegations. Kim Ki Hyok has reportedly moved close to $500,000 in crypto for his team since 2024. 

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who have generated more than $750,000 for it since 2025.

Treasury published wallet addresses on Ethereum and Tron tied to the sanctioned individuals, a signal to exchanges and other financial firms to watch for those accounts. One Ethereum address is linked to both Obertas and Boykov.

The action follows a March designation of a separate North Korean IT worker network, which Treasury said had laundered roughly $800 million in crypto for the regime. Australia and the European Union have also announced related designations this month, and Treasury coordinated the move with the Multilateral Sanctions Monitoring Team.

Under the sanctions, any property these individuals or entities hold in the United States, or that is controlled by U.S. persons, is blocked and must be reported to the Office of Foreign Assets Control. Transactions with them are generally prohibited unless licensed, and companies owned 50 percent or more by blocked parties are subject to the same restrictions. Treasury warned that civil penalties can apply even when a violation was unintentional.

For companies that hire remote contractors, the advisories from the State, Treasury and Justice departments and the FBI offer guidance on spotting these schemes, including verifying identities, checking where payments are going, and watching for unusual access requests.

This post U.S. Treasury Sanctions Crypto Launderers Behind North Korea’s Fake Workers first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

Bank of Israel rejects Netanyahu's proposal to use cryptocurrency against potential sanctions, warning that digital assets cannot replace banking ties.

The US government continues its crackdown on Tren de Aragua over its ATM jackpotting scheme.

The post Treasury Blacklists Most-Wanted ATM Malware Developer and His Network appeared first on SecurityWeek.