US Treasury sanctions Russian crypto intermediaries for North Korean IT worker money‑laundering
The Office of Foreign Assets Control sanctioned ten individuals and one entity tied to North Korean IT worker schemes, naming two Russian nationals who moved over $5 million in crypto for the regime.
COINMAG NewsroomNewsroom · via COINMAG
Key takeaways
- Two Russian nationals were sanctioned for converting more than $5 million in cryptocurrency for North Korean IT worker networks.
- The Treasury listed specific Ethereum and Tron wallet addresses, signaling exchanges to block and monitor those accounts.
- The sanctions target the money‑laundering layer rather than the front‑line fake workers, aiming to cut off funding for North Korea’s weapons programs.
On October 28, 2026, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) added ten individuals and one entity to its sanctions list for facilitating the illicit financing of North Korea’s weapons programs through so‑called IT worker schemes. The designations focus on the financial middlemen who convert wages earned by fake overseas employees into cryptocurrency, then move the proceeds to the regime.
ETH / USD
Who was sanctioned
According to Decrypt, the two primary Russian nationals are Ilya Boykov and Vitold Obertas. Boykov is accused of converting roughly $3.5 million in crypto for the North Korean‑controlled Limited Liability Company Alis since 2024, while Obertas handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials from January 2025 onward. Both men have been linked to multiple Ethereum and Tron addresses, with one Ethereum address appearing on both of their listings.
How the scheme operated
The Treasury’s statement, echoed by Bitcoin Magazine, describes a layered fraud: North Korean operatives create fabricated identities, sometimes using AI‑generated resumes or deep‑fake interview videos, to secure remote IT positions at legitimate firms. Most of the wages are siphoned back to the regime, where they are laundered through “sophisticated cryptocurrency transactions” and artificial‑intelligence tools. Chainalysis, cited by Cointelegraph, traced a typical flow: stablecoin payments to a worker’s wallet, conversion to Ether (ETH), consolidation through multiple addresses, and finally cash‑out on the Russian exchange Garantex via intermediaries such as Boykov.
Broader network and international response
In addition to the two Russians, OFAC sanctioned the First Financial and Technical Development Center – a North Korean‑controlled entity operating out of Vladivostok – and six Russia‑based North Korean IT workers who have generated more than $750,000 for the center since 2025. Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were also listed for leading delegations that moved roughly $500,000 in crypto. The action builds on a March 2026 designation of a separate IT worker network and follows coordinated designations by Australia
COINMAG NewsroomStories researched and written by the COINMAG news desk from multiple independent reports.
Discussion 0