USD
US Sanctions North Korean IT Worker Crypto Network
Russian handlers converted remote-work crypto wages into funds linked to Pyongyang
TL;DR
- Treasury sanctioned a Russia-linked network tied to North Korean IT workers who allegedly infiltrated legitimate companies.
- Chainalysis traced stablecoin salary payments through Ethereum wallets, consolidation addresses and Russian intermediaries.
- The broader IT worker program is estimated to generate hundreds of millions of dollars annually for North Korea.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
The U.S. Treasury Department sanctioned 10 individuals and one entity on October 28, 2026, over North Korean government-run IT worker schemes that allegedly defrauded U.S. businesses and generated revenue for the country’s weapons programs.
The action included two Russian nationals accused of facilitating approximately $5.5 million in cryptocurrency transactions for North Korean operations and targeted a network that converted earnings from fraudulent remote employment into funds North Korean officials could access.
Treasury said North Korea uses fake documents, stolen identities and invented personas to place IT workers at legitimate companies, then takes most of their wages. The workers have also used artificial intelligence tools and “sophisticated cryptocurrency transactions” to support the operation.
Treasury Secretary Scott Bessent said:
“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.”
Treasury targets Russian intermediaries and North Korean managers
Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas were among the sanctioned individuals. Treasury also targeted North Korean managers Kim Ki Hyok and Kim Hyo Dong, along with the First Financial and Technical Development Center and six workers associated with the North Korean-controlled organization. The sanctions freeze assets the designated people and entity hold in the United States and prohibit Americans from dealing with them.
Treasury tied the targets to the following financial activity and blockchain identifiers. The sanctions listings also showed one Ethereum address appearing on both Boykov’s and Obertas’ entries.
Kim Ki Hyok and Kim Hyo Dong report to Chinyong Information Technology Cooperation Company, which received a Treasury designation in 2023. The six workers sanctioned alongside the First Financial and Technical Development Center were Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il. The center is based in Vladivostok, Russia, and Treasury said it deploys highly trained IT workers who use AI tools and “complex cryptocurrency transfers” to generate revenue.
Limited Liability Company Alis, which Boykov supported, had itself been sanctioned in 2024. Chainalysis also linked Obertas-connected wallets to Amnokgang Technology Development Company, a previously sanctioned organization that manages North Korean IT worker delegations. Those wallets deposited cryptocurrency into both mainstream and sanctioned exchanges, according to Chainalysis.
Chainalysis traces crypto salaries through Ethereum and Garantex
Chainalysis traced one suspected North Korean developer who contributed code to blockchain projects and decentralized finance protocols while receiving stablecoin transfers approximately every two weeks between late 2022 and early 2023. The recurring transfers resembled salary payments. The developer’s wallet converted the stablecoins into Ethereum before sending the funds through consolidation addresses that Chainalysis linked to sanctioned entities.
Chainalysis then traced the funds to Boykov, who forwarded cryptocurrency to Garantex, a sanctioned Russian exchange, for potential cash conversion. The blockchain analytics firm said the relationships stretched back several years. Chainalysis also estimated that Obertas had been active since at least 2023, while OFAC’s account placed the start of his handling of cryptocurrency for North Korean officials in 2025.
North Korean operatives have used stolen identities, fraudulent documents and fabricated employment histories to obtain remote jobs, including positions at cryptocurrency companies. Chainalysis said some workers have used generative AI to produce resumes, realistic profile photos and deepfake videos for recruitment interviews. Treasury has also warned that the workers can use corporate access to deploy malware, steal proprietary information and extract sensitive data.
The employment scheme extends beyond crypto companies. A United Nations Panel of Experts estimate cited by Chainalysis put annual revenue from North Korean IT worker operations at between $250 million and $600 million, with proceeds flowing into the country’s weapons and missile programs.
Sanctions follow wider action against North Korean IT workers
The Treasury action followed a Justice Department operation earlier in October that shut down dozens of laptop farms in Texas and led to two arrests. Laptop farms host company-issued computers inside the United States so workers operating abroad can appear to employers as though they are logging in domestically.
Treasury said the latest action builds on sanctions against another North Korean IT worker network imposed in March. Australia and the European Union also made designations targeting the network during October.
Google’s Threat Intelligence Group had reported in April 2025 that North Korean IT workers had embedded themselves in cryptocurrency projects in the UK, Germany, Portugal and Serbia, including Solana smart-contract development. Some workers were operating under as many as 12 fake identities at the same time, according to Google.
This article has been refined and enhanced by ChatGPT.
