The U.S. Treasury Department has sanctioned 10 individuals and one entity over an alleged North Korean government-run IT-worker scheme that targeted American and allied businesses while moving proceeds through cryptocurrency. The October 28 action names facilitators and workers based in Russia and North Korea, including two Russian nationals accused of converting millions of dollars in digital assets. Treasury says the network used stolen identities, fabricated personas and fraudulent documents to obtain legitimate technology jobs, then redirected much of the income to the North Korean government. The designations are administrative sanctions, not criminal convictions.

Remote employment became a revenue channel

According to Treasury's Office of Foreign Assets Control, North Korean IT workers concealed their location and identity to secure work at companies in the United States and other countries. The government says the workers' earnings supported North Korea's weapons programs, while some participants also used corporate access to deploy malware, remove sensitive information or steal proprietary data. Cryptocurrency was one part of the payment and laundering infrastructure rather than the only method. Treasury also cited other currency transactions, logistical support and sanctions-evasion activity across the network.

Related reporting: US Sanctions Network Over Alleged Crypto Funding for Hamas

Two Russian intermediaries handled the largest cited crypto amounts

Treasury alleges that Ilya Aleksandrovich Boykov exchanged or converted the equivalent of $3.5 million in cryptocurrency for Limited Liability Company Alis, a previously sanctioned business linked to North Korean IT workers. Vitold Viktorovich Obertas allegedly conducted nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. OFAC also designated two North Korean managers of Russia-based worker groups and six workers associated with the First Financial and Technical Development Center, a North Korean-controlled entity located in Russia.

The action reaches specific blockchain addresses

OFAC's designation notice identifies eight distinct cryptocurrency addresses across Ethereum and Tron in connection with Boykov and Obertas. CoinDesk reported that one Ethereum address appears in both entries. The address listings give exchanges, custodians and transaction-monitoring providers concrete identifiers to screen, although an address appearing on the sanctions list does not establish that every counterparty in its transaction history knowingly supported the scheme. Chainalysis said it added the designated addresses to its screening systems and traced earlier worker payments through consolidation addresses linked to sanctioned entities.

What the sanctions change for U.S. businesses

Property and interests in property belonging to the designated people and entity are blocked when they are in the United States or under the possession or control of U.S. persons, and they must be reported to OFAC. The restrictions also extend under OFAC's 50% rule to entities owned at least half by one or more blocked persons. Unless licensed or exempt, U.S. persons are generally prohibited from transactions involving the blocked property. Employers face a separate operational risk: a fraudulent hire can create sanctions exposure alongside cybersecurity, payroll and intellectual-property concerns.

The designations do not close the wider network

Treasury says the action builds on a March designation of another North Korean IT-worker network and follows related measures by Australia and the European Union. The new sanctions disrupt named facilitators and make listed wallets easier to identify, but they do not establish the full size of the overseas workforce or prevent operators from creating new identities and addresses. Businesses still need layered hiring checks, payment controls and network monitoring. The amounts in Treasury's release are attributed to the U.S. government's investigation and should not be read as a complete accounting of North Korea's technology-worker revenue.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.