From Decrypt · By Decrypt Agent
In brief
OFAC sanctioned 10 individuals and one entity over North Korean IT worker schemes that defraud U.S. businesses and fund the country's weapons programs.
Treasury says Russian nationals Ilya Boykov and Vitold Obertas converted millions of dollars in crypto for North Korean networks since 2024.
The sanctions listings include Ethereum and Tron addresses, one of which is linked to both Russian men.
The U.S. Treasury Department has sanctioned 10 individuals and one entity for their roles in North Korean IT worker schemes that defraud U.S. businesses and generate revenue for the country's weapons programs, the department said on Wednesday.
North Korea uses fake documents, stolen identities and invented personas to place IT workers at legitimate companies, then takes most of their wages, generating hundreds of millions of dollars for its weapons of mass destruction and ballistic missile programs, according to Treasury. The networks have used "sophisticated cryptocurrency transactions," money laundering and artificial intelligence tools to move millions of dollars to the regime, it said.
Today, Treasury’s Office of Foreign Assets Control sanctioned 10 individuals and one entity for their roles in Democratic People’s Republic of Korea (DPRK) government-run IT worker schemes that defraud U.S. businesses and generate revenue for the DPRK’s unlawful weapons of mass…
— Treasury Department (@USTreasury) October 28, 2026
"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," said Treasury Secretary Scott Bessent.
Two Russian nationals are among those sanctioned. Vitold Obertas, a Russian intermediary for North Korean financial transactions, has carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials, Treasury said. Ilya Boykov has exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company sanctioned in 2024.
The sanctions listings include two Ethereum and two Tron addresses for Boykov, and one Ethereum and three Tron addresses for Obertas. One Ethereum address appears on both men's entries.
Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia, that it said deploys highly trained IT workers who use AI tools and "complex cryptocurrency transfers" to generate revenue. Six Russia-based North Korean IT workers have generated more than $750,000 for the center since 2025, according to Treasury.