Treasury Sanctions Russians, North Koreans supporting DPRK IT Worker Fraud
Chainalysis examines the OFAC sanctions targeting Russian and North Korean actors who launder crypto from fraudulent IT‑worker schemes. The report finds that these facilitators moved at least $2 million in crypto, feeding a $250‑$600 million revenue stream for Pyongyang’s weapons programs.
Points clés
- OFAC sanctioned 10 individuals and one entity on Oct 28 2026 for funneling crypto from DPRK IT‑worker fraud.
- Russian facilitators converted roughly $2 million in crypto for North Korean front companies.
- The IT‑worker network generates an estimated $250‑$600 million annually for the DPRK regime.
- Six DPRK workers linked to FFTDC produced over $750 k in crypto revenue since 2025.
- Chainalysis now flags the designated wallets, enabling KYT alerts for exposed businesses.
- Annual DPRK IT‑worker revenue
- $250‑$600M
- Crypto converted by Obertas
- ≈$2M
Scope of the investigation
Chainalysis set out to map the financial layer of a state‑sponsored North Korean operation that places fraudulent IT workers in U.S. firms. The focus was the recent Office of Foreign Assets Control (OFAC) action on October 28, 2026, which named ten individuals and one entity for converting cryptocurrency proceeds that fund Pyongyang’s weapons programs.
Data and methodology
The analysis combined public OFAC sanction lists, on‑chain tracing of wallet activity, and Chainalysis’s Reactor graph tool. By following transaction flows from worker‑pay wallets through conversion addresses to cash‑out points, the researchers identified the roles of Russian nationals Vitold Viktorovich Obertas and Ilya Aleksandrovich Boykov, as well as DPRK managers Kim Ki Hyok and Kim Hyo Dong. The team also cross‑checked United Nations expert estimates of the scheme’s overall revenue.
Main findings
Chainalysis estimates that the sanctioned Russian intermediaries moved nearly $2 million in cryptocurrency into fiat for DPRK officials, with Obertas alone handling about $2 million since early 2025. The broader IT‑worker operation is believed to generate $250‑$600 million each year for the regime, according to a UN panel. Within that ecosystem, the Russia‑based First Financial and Technical Development Center (FFTDC) and six DPRK workers have produced more than $750 k in crypto revenue since 2025. Individual managers transferred roughly $500 k (Kim Ki Hyok) and $100 k (Kim Hyo Dong) on behalf of their delegations.
Caveats and limitations
Revenue estimates rely on open‑source intelligence and UN panels, which may under‑report illicit flows hidden in private mixers or off‑chain channels. The $250‑$600 million range reflects uncertainty about the total number of active workers and the proportion of earnings that reach the North Korean treasury. Moreover, on‑chain attribution can be obscured by false identities and layered transfers.
Implications for readers
Businesses should update their sanctions screening to include the newly designated wallets and entities. Chainalysis’s KYT alerts now trigger when transactions intersect these addresses, helping firms detect exposure before funds are converted. The report underscores the growing sophistication of DPRK‑linked crypto laundering, especially as AI tools enable low‑skill operatives to bypass traditional hiring vetting.
Overall, the OFAC action targets the financial conduit of a multi‑million‑dollar fraud pipeline, and Chainalysis’s tracing confirms that crypto remains a critical lifeline for North Korea’s weapons financing.