US Treasury Sanctions 11 Over North Korean IT Worker Crypto Cashout

Eleven New OFAC Designations

The US Treasury Department sanctioned 10 individuals and one entity on Wednesday, October 28, for their roles in North Korean government-run IT worker schemes that place operatives inside American companies and divert their wages to Pyongyang's weapons programs. The action, announced in Treasury's press release, came from the Office of Foreign Assets Control (OFAC), which blocks any assets the named parties hold in the United States and makes it illegal for Americans to deal with them. Treasury states that North Korea deploys IT workers under forged documents, stolen identities and invented personas, then collects most of their wages, generating hundreds of millions of dollars for its weapons of mass destruction and ballistic missile programs. The networks relied on sophisticated cryptocurrency transactions, money laundering and artificial intelligence tools to move funds to the regime. Treasury Secretary Scott Bessent said the North Korean government continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments. The designations build on a March action against a separate North Korean IT worker network, and Treasury noted that Australia and the European Union have taken their own steps against the network this month.

From Biweekly Stablecoin Paychecks to Garantex

Two Russian nationals sat at the center of the crypto cashout operation. Ilya Boykov has exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company OFAC sanctioned in 2024, according to the sanctions listings. Vitold Obertas, described as an intermediary for North Korean financial transactions, carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials. The listings attach wallet addresses to both men: two Ethereum and two Tron addresses for Boykov, and one Ethereum and three Tron addresses for Obertas, with a single Ethereum address appearing on both entries. OFAC also designated the First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia, which it says deploys highly trained IT workers who use AI tools and complex cryptocurrency transfers to generate revenue. Six Russia-based workers under that center have produced more than $750,000 since 2025. Two delegation leaders were sanctioned as well: Kim Ki Hyok transferred nearly $500,000 in crypto for his delegation since 2024, while Kim Hyo Dong helped evade sanctions on more than $100,000 in transfers. Both report to Chinyong Information Technology Cooperation Company, a Treasury designee since 2023.

On-chain tracing published by Chainalysis shows how one scheme worked. A North Korean developer who built code for blockchain and DeFi protocols collected stablecoin deposits every two weeks, a cadence the analytics firm described as resembling salary payments. The stablecoins were converted into Ether, routed through consolidation addresses, passed to Boykov and then sent to Garantex, the Russia-based exchange that is itself under US sanctions, ahead of the final cashout. Chainalysis estimates Obertas has been active since at least 2023, earlier than the January 2025 start date in OFAC's account. The deception extends past payment flows: job seekers generated AI-crafted resumes and face photos and used fake video during interviews to conceal their identities. Enforcement pressure is mounting on several fronts. Earlier this month the Justice Department shut down dozens of laptop farms in Texas, locations hosting company-issued computers so workers abroad appear to log in from inside the US, and made two arrests. A UN panel of experts estimates the IT worker program brings North Korea between $250 million and $600 million a year, funds that flow into weapons and missile programs. North Korean actors also strike crypto firms directly: the Solana-based exchange Drift Protocol attributed an April attack that drained about $285 million to a six-month operation by a state-affiliated group.

Why the Wallet Listings Matter

Read against the designations document itself, the action is a screening measure rather than a seizure: OFAC adds the named Ethereum and Tron addresses to its watchlist and bars US persons from transacting with them, but crypto at those addresses only moves when someone controlling the private key signs a transfer, whether funds sit in a hot wallet or a cold wallet. For exchanges and payment firms, wallet-exposure screening against the OFAC list becomes the operative compliance step. The scheme also differs from a rug pull or a one-off theft: operatives embed inside legitimate teams for months, so counterparty vetting now has to cover identity, not just code. The same DYOR discipline investors apply to new tokens increasingly applies to remote hires.