The US Treasury Department has imposed sanctions on 10 individuals and one entity it says were involved in a North Korean scheme that used fake IT workers to infiltrate US companies and move income through cryptocurrency exchanges and cross-border financial transactions.
In an Oct. 28 announcement, the Office of Foreign Assets Control (OFAC) said the network helped the North Korean government generate revenue by placing workers under false identities in remote technology jobs. Treasury said two Russia-based intermediaries were tied to crypto transactions worth about $2 million and $3.5 million, highlighting what it described as North Korea’s use of remote work, fabricated identities and digital assets to build an ongoing illicit revenue stream.
Fake IT workers allegedly entered companies under false identities
According to the Treasury Department, North Korea has for years arranged for IT workers to obtain remote jobs at companies in the United States and other countries by using forged documents, stolen identities and fabricated personal histories.
Those workers appeared to be engaged in software development and information technology roles, but Treasury said much of their salary income was collected by the North Korean government and then moved through financial intermediaries and cryptocurrency transactions.
US authorities allege that the proceeds ultimately supported North Korea’s weapons of mass destruction and ballistic missile programs, both of which are subject to international sanctions.
Treasury also said some of the IT workers were suspected of using company-granted system access to install malware, steal sensitive data and even extort employers, exposing companies to both financial losses and cybersecurity risks.
Russia-based intermediaries named in the sanctions action
One of the central elements of the latest sanctions package is a financial intermediary network in Russia that allegedly helped move income on North Korea’s behalf.
Treasury identified Russian national Vitold Viktorovich Obertas and said that, starting in January 2025, he handled nearly $2 million in cryptocurrency conversions for North Korean officials, along with at least $1.25 million in other currency transactions.
Another Russian national, Ilya Aleksandrovich Boykov, was accused of helping the North Korea-linked organization Alis conduct about $3.5 million in cryptocurrency conversions, transaction monitoring and fund dispatching starting in 2024.
Treasury also named North Korean national Kim Ki Hyok, who was accused of moving nearly $500,000 in crypto assets for a team of IT workers based in Russia. Kim Hyo Dong was accused of helping transfer more than $100,000 in financial assets.
The report noted that the $5.5 million figure reflects the combined historical volume of cryptocurrency transactions linked to the two Russian intermediaries. It does not mean authorities have confirmed a single laundering gain of the same amount, and some of the funds may have circulated repeatedly through different stages of the transaction chain.
FFTDC and six workers in Russia were also included
The sanctions also cover First Financial and Technical Development Center (FFTDC), a Russia-based organization that Treasury described as controlled by North Korea. The department said the group used IT workers and advanced artificial intelligence tools to support its operations, while moving funds through complex cryptocurrency transfers and laundering methods.
Treasury said six North Korean IT workers based in Russia and tied to FFTDC generated more than $750,000 in income starting in 2025.
TRM Labs’ sanctions data analysis found that the latest designations were linked to eight addresses on the Ethereum and Tron blockchains, a sign that OFAC’s enforcement focus is extending from traditional financial intermediaries to on-chain fund networks.
What the sanctions mean
Under OFAC rules, property and interests in property of the sanctioned parties that are in the United States, or that are held or controlled by US persons, must generally be frozen. US persons are also barred from engaging in prohibited transactions with them unless authorized.
The action follows another round of US sanctions in March this year targeting a separate North Korean IT worker network. It also shows that US authorities are paying closer attention to a model in which North Korea is accused of generating revenue through seemingly legitimate commercial activity and then moving that money across borders through cryptocurrency.
Treasury’s description sets this method apart from direct exchange hacks used to steal digital assets. In this case, the actors may first obtain salary payments through ordinary employment contracts, then use cryptocurrency and financial intermediaries to obscure the true beneficiary. For crypto firms and multinational companies, the risk tied to North Korean funds may sit not only in hacker-controlled wallets, but also in hiring, payroll and cross-border settlement processes that appear legitimate on the surface.
