BTC $81,439 
ETH $2,358 
MGLOEURO $111,813 
USDT $0.9992 
BNB $750.83 
XRP $1.31 
USDC $0.9996 
SOL $102.13 
TRX $0.3311 
FIGR_HELOC $1.03 Regulation · Explained
Treasury sanctions 11 tied to North Korean IT worker crypto network
OFAC designated 10 people and one entity, including two Russian intermediaries, in a crackdown on Pyongyang's fake IT workforce.
Key takeaways
- Money movers targeted. The designations center on intermediaries who convert and transfer wages rather than only on the IT workers themselves.
- Crypto addresses published. Treasury listed several Ethereum and Tron wallets, one of which appears on the entries of both Russian nationals.
- Broader campaign. The move follows a March action against a separate network and parallel designations by Australia and the European Union.
What happened
The U.S. Treasury Department has sanctioned 10 individuals and one entity accused of supporting North Korea's practice of planting fraudulent IT workers at companies abroad, many of them American. The Office of Foreign Assets Control said the designations target people and organizations that help Pyongyang collect wages earned under false identities and move the proceeds back to the state, according to Decrypt and Bitcoin Magazine.
Two Russian nationals are at the center of the action. Treasury described Vitold Obertas as an intermediary for North Korean financial transactions, saying he has carried out nearly $2 million in crypto conversions since January 2025, along with at least $1.25 million in other currency transactions, on behalf of North Korean officials. Ilya Boykov is accused of converting the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company sanctioned in 2024.
The department also designated the First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia, which it says deploys trained IT workers who use artificial intelligence tools and complex crypto transfers to generate revenue. Six Russia-based North Korean IT workers have brought in more than $750,000 for the center since 2025, Treasury said. Two North Koreans who lead Russia-based worker delegations, Kim Ki Hyok and Kim Hyo Dong, were named as well; Treasury said Kim Ki Hyok has moved close to $500,000 in crypto for his delegation since 2024.
Treasury Secretary Scott Bessent framed the action as a response to operatives who exploit American employers, describing the workers as using access to sensitive data to extract payments from businesses.
Why it matters
Treasury says the IT worker programs raise hundreds of millions of dollars that help fund North Korea's weapons of mass destruction and ballistic missile programs, making the financial chain as important as the fake job placements themselves. The sanctions carry immediate compliance consequences: any property held by the designated people or entities in the United States, or controlled by U.S. persons, is blocked and must be reported to OFAC. Dealings with them are generally prohibited unless licensed, companies owned 50 percent or more by blocked parties face the same restrictions, and Treasury warned that civil penalties can apply even when a violation is unintentional.
What the data shows
Treasury published wallet addresses alongside the listings, which serve as a signal for exchanges and other financial firms to watch for the accounts. Boykov's entry includes two Ethereum and two Tron addresses, while Obertas's includes one Ethereum and three Tron addresses, according to Decrypt. A single Ethereum address appears on both men's entries. The reports did not indicate whether any funds tied to those addresses had been frozen.
Background
The action builds on a March designation of a separate North Korean IT worker network, which Treasury said had laundered roughly $800 million in crypto for the regime, Bitcoin Magazine reported. Australia and the European Union have issued their own related designations this month, and Treasury coordinated with the Multilateral Sanctions Monitoring Team. North Korean operatives have increasingly aimed at crypto projects: Google's Threat Intelligence Group reported in April 2025 that such workers had embedded themselves in projects in the UK, Germany, Portugal and Serbia, including Solana smart contract development, with some using as many as 12 fake identities at once. In April, Solana-based exchange Drift Protocol said an attack that drained about $285 million was a six-month operation by a North Korean state-affiliated group whose intermediaries met contributors in person while posing as a quantitative trading firm.
What to watch
How crypto exchanges and payment processors respond to the published addresses will be a near-term test of the designations. Treasury, the State and Justice departments and the FBI have issued advisories for companies hiring remote contractors, recommending identity verification, scrutiny of where payments are sent and attention to unusual requests for network access.
Questions readers ask
What does it mean to be sanctioned by OFAC?
Assets the designated people or entities hold in the U.S., or that are controlled by U.S. persons, are frozen and must be reported to Treasury. U.S. persons are generally barred from transacting with them unless a license is granted, and entities half-owned by blocked parties are covered too.
Why is crypto central to these cases?
Treasury says the networks use crypto transfers and money laundering to move wages out of the countries where the workers are placed and back to North Korea, which is why wallet addresses were included in the listings.
Who was sanctioned?
Ten individuals and one entity, including Russian intermediaries Vitold Obertas and Ilya Boykov, North Korean delegation leaders Kim Ki Hyok and Kim Hyo Dong, and the Vladivostok-based First Financial and Technical Development Center.
