The U.S. Treasury Department said Wednesday it had sanctioned 10 individuals and one entity for their roles in North Korean IT worker schemes that defraud U.S. businesses and generate revenue for the country’s weapons programs.
According to Treasury, North Korea uses fake documents, stolen identities, and invented personas to place IT workers at legitimate companies, then takes most of their wages. The department said the practice generates hundreds of millions of dollars for the country’s weapons of mass destruction and ballistic missile programs. It also said the networks used sophisticated cryptocurrency transactions, money laundering methods, and artificial intelligence tools to move millions of dollars to the regime.
Treasury Secretary Scott Bessent said, 「The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.」
Two Russian nationals were included
Treasury said two Russian nationals were among those sanctioned.
One of them, Vitold Obertas, was described as a Russian intermediary for North Korean financial transactions. Treasury said he had carried out nearly $2 million in crypto conversions since January 2025, along with at least $1.25 million in other currency transactions, for North Korean officials.
Ilya Boykov was also designated. Treasury said he had exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company that had already been sanctioned in 2024.
The sanctions listings include two Ethereum addresses and two Tron addresses for Boykov, as well as one Ethereum address and three Tron addresses for Obertas. One Ethereum address appears in both men’s entries.
Vladivostok-based entity also sanctioned
Treasury also sanctioned the First Financial and Technical Development Center, which it described as a North Korean-controlled entity based in Vladivostok, Russia. The department said the entity deploys highly trained IT workers who use AI tools and complex cryptocurrency transfers to generate revenue.
According to Treasury, six Russia-based North Korean IT workers have generated more than $750,000 for the center since 2025.
Two North Korean nationals who lead Russia-based IT worker delegations were also sanctioned. Treasury said one of them, Kim Ki Hyok, has transferred nearly $500,000 in crypto for his delegation since 2024.
Part of a broader sanctions push
Treasury said the move builds on sanctions imposed in March against a separate North Korean IT worker network. It also said Australia and the European Union made their own designations this month.
North Korean operations have increasingly touched crypto projects
The report also pointed to a wider pattern of North Korean IT workers targeting crypto projects.
In April 2025, Google’s Threat Intelligence Group reported that such workers had embedded themselves in crypto projects in the U.K., Germany, Portugal, and Serbia, including Solana smart contract development roles. Some were operating under as many as 12 fake identities at the same time.
The article also referenced longer-running deception campaigns against crypto firms. In April, Solana-based exchange Drift Protocol said the attack that drained about $285 million from its platform was a six-month operation by a North Korean state-affiliated group, according to earlier reporting by Decrypt. Intermediaries linked to the operation had met Drift contributors in person and posed as a quantitative trading firm.
