US Treasury sanctions Russian crypto intermediaries for North Korean IT worker money‑laundering

On October 28, 2026, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) added ten individuals and one entity to its sanctions list for facilitating the illicit financing of North Korea’s weapons programs through so‑called IT worker schemes. The designations focus on the financial middlemen who convert wages earned by fake overseas employees into cryptocurrency, then move the proceeds to the regime.

Who was sanctioned

According to Decrypt, the two primary Russian nationals are Ilya Boykov and Vitold Obertas. Boykov is accused of converting roughly $3.5 million in crypto for the North Korean‑controlled Limited Liability Company Alis since 2024, while Obertas handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials from January 2025 onward. Both men have been linked to multiple Ethereum and Tron addresses, with one Ethereum address appearing on both of their listings.

How the scheme operated

The Treasury’s statement, echoed by Bitcoin Magazine, describes a layered fraud: North Korean operatives create fabricated identities, sometimes using AI‑generated resumes or deep‑fake interview videos, to secure remote IT positions at legitimate firms. Most of the wages are siphoned back to the regime, where they are laundered through “sophisticated cryptocurrency transactions” and artificial‑intelligence tools. Chainalysis, cited by Cointelegraph, traced a typical flow: stablecoin payments to a worker’s wallet, conversion to Ether (ETH), consolidation through multiple addresses, and finally cash‑out on the Russian exchange Garantex via intermediaries such as Boykov.

Broader network and international response

In addition to the two Russians, OFAC sanctioned the First Financial and Technical Development Center – a North Korean‑controlled entity operating out of Vladivostok – and six Russia‑based North Korean IT workers who have generated more than $750,000 for the center since 2025. Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were also listed for leading delegations that moved roughly $500,000 in crypto. The action builds on a March 2026 designation of a separate IT worker network and follows coordinated designations by Australia and the European Union earlier this month, as reported by Decrypt.

What to watch next

Regulators are likely to increase scrutiny of the wallet addresses published by OFAC, prompting exchanges to enforce blocking and reporting requirements. Analysts will watch for any shift in cash‑out routes, such as movement to other Russian or Asian exchanges, and for potential retaliation by North Korean cyber groups targeting crypto platforms. Companies employing remote contractors are being urged by the State Department, Treasury, Justice Department and the FBI to tighten identity verification and monitor payment flows, a guidance highlighted by Bitcoin Magazine.

Sources

• Bitcoinist: US Sanctions Russian Crypto Brokers Over North Korean IT Fraud
• Bitcoin Magazine: U.S. Treasury Sanctions Crypto Launderers Behind North Korea’s Fake Workers
• BeInCrypto: US Sanctions Two Russians Accused of Converting $5.5M in Crypto for North Korea
• Cointelegraph: Chainalysis traces North Korean crypto cash-outs through Garantex
• Decrypt: Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto
• The Defiant: US Sanctions Crypto Facilitators Linked to North Korean IT Worker Schemes

This article was prepared by the CoinMag newsroom from the reports listed above.