The U.S. Treasury Department on Tuesday sanctioned 10 individuals and one company, accusing them of helping North Korea collect wages from foreign employers through fake identities and forged paperwork. Treasury said many of the employers were American.
According to Treasury, the workers were often placed at legitimate firms under invented personas. In some cases, they used AI-generated resumes, doctored photos, or deepfake video during interviews. Treasury said most of their pay was sent back to the regime and used to fund its weapons of mass destruction and ballistic missile programs.
Treasury also said some of these workers gained access to corporate networks, where they planted malware and took proprietary data.
Sanctions target the money movers
The action focused less on the workers themselves and more on the people who moved the funds.
Two Russian nationals were central to the sanctions. Treasury described Vitold Obertas as an intermediary for North Korean financial transactions and said that since January 2025 he allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials.
Treasury said Ilya Boykov converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT worker company that the U.S. sanctioned in 2024.
Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were also named for leading worker delegations based in Russia. Treasury said Kim Ki Hyok has moved close to $500,000 in crypto for his team since 2024.
A Russia-based entity and six workers were also designated
Treasury also sanctioned the First Financial and Technical Development Center, which it described as a North Korean-controlled entity operating in Russia.
Six workers tied to that entity were designated as well. Treasury said they have generated more than $750,000 for it since 2025.
Ethereum and Tron wallet addresses were published
Treasury published wallet addresses on Ethereum and Tron tied to the sanctioned individuals, signaling to exchanges and other financial firms to monitor those accounts.
One Ethereum address was linked to both Obertas and Boykov.
The move follows an earlier March designation
This action came after a separate March designation of another North Korean IT worker network. Treasury said that network had laundered roughly $800 million in crypto for the regime.
Australia and the European Union also announced related designations this month. Treasury said it coordinated this move with the Multilateral Sanctions Monitoring Team.
What the sanctions mean
Under the sanctions, any property held by these individuals or entities in the United States, or controlled by U.S. persons, is blocked and must be reported to the Office of Foreign Assets Control.
Transactions with them are generally prohibited unless licensed. Companies owned 50% or more by blocked parties are subject to the same restrictions.
Treasury warned that civil penalties may apply even when a violation was unintentional.
Guidance for companies hiring remote contractors
For companies that hire remote contractors, advisories from the State Department, Treasury Department, Justice Department, and the FBI offer guidance on how to spot these schemes. Treasury said the guidance includes verifying identities, checking where payments are going, and watching for unusual access requests.
This report first appeared in Bitcoin Magazine and was written by Micah Zimmerman.
