OFAC Sanctions Russian Network That Helped North Korean IT Workers Cash Out Crypto
Key Takeaways
- •OFAC designated 10 individuals and one entity for supporting North Korean government-run IT worker schemes that Treasury says fund the country's weapons programs.
- •Russian nationals Ilya Boykov and Vitold Obertas were sanctioned, with Treasury citing roughly $3.5 million and nearly $2 million in crypto conversions respectively.
- •Chainalysis traced stablecoin payments converted into Ether, routed through consolidation addresses to Boykov, and cashed out via the US-sanctioned exchange Garantex.
- •North Korean IT operatives use false identities to obtain remote jobs at technology and blockchain firms to generate revenue for the regime.
- •Unlike earlier actions against the workers themselves, the new designations target the intermediaries who convert their earnings into cash.
Blockchain analytics firm Chainalysis has mapped a long-running network of Russian intermediaries that helped North Korean IT workers cash out millions of dollars in cryptocurrency, in a report published alongside new US sanctions.
On Wednesday, the US Treasury Department's Office of Foreign Assets Control (OFAC), the agency that administers and enforces American economic sanctions, designated 10 individuals and one entity for supporting North Korean government-run IT worker schemes that, according to Treasury, funded the country's weapons programs. The action was announced in a press release. Designations generally block any property the listed parties hold under US jurisdiction and prohibit US persons from transacting with them.
Among those sanctioned were Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas. Treasury said Boykov had converted roughly $3.5 million in cryptocurrency for Alis, a sanctioned company, since 2024, while Obertas had handled nearly $2 million in crypto conversions for North Korean officials since January 2025.
Chainalysis' Wednesday report outlined one example of the cash-out flow: a wallet linked to a North Korean IT worker received regular stablecoin payments, converted them into Ether (ETH), and moved the funds through consolidation addresses to Boykov. Boykov then forwarded the cryptocurrency to Garantex, a Russian cryptocurrency exchange, to cash out. Garantex has been under US sanctions since 2022. Because blockchain transfers are recorded on public ledgers, analysts can follow funds across wallets and exchanges, the tracing method that underpins this kind of mapping.
North Korean IT workers who use false identities to obtain jobs at crypto companies have posed a persistent security threat. US authorities have repeatedly warned that such operatives seek remote employment at technology and blockchain firms to generate revenue for the North Korean regime, often concealing their identities and locations.
In June 2025, the US Department of Justice announced charges against four North Korean nationals in connection with a scheme involving fraudulent IT employment and the theft of more than $900,000 from crypto companies in the United States and Serbia. Where earlier actions targeted the workers themselves, Wednesday's designations center on the intermediaries who help convert their earnings into cash.
Source: Cointelegraph
