The US Treasury Department's Office of Foreign Assets Control (OFAC) has blacklisted 10 individuals and one company in connection with a scheme to place fake North Korean IT workers inside American companies. For US employers, the case illustrates how an ordinary-looking remote hire can carry sanctions exposure when the applicant's identity is fabricated.

The October 28 action targeted Russia-based intermediaries responsible for funneling the North Korean IT workers' cryptocurrency wages into cash for Pyongyang. The designations freeze any assets the named individuals and company hold in the United States and make it illegal for Americans to deal with them, a prohibition that carries civil or criminal penalties for US persons who breach it.

Russian facilitators at the center of the operation

Two Russian nationals, Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas, stood at the nerve center of the operation, which OFAC targeted for swapping cryptocurrency into spendable funds for North Korean front companies. Reports attribute close to $2 million in crypto conversions to Obertas alone, plus another $1.25 million in other currency transactions carried out for DPRK officials since January 2025.

Boykov, for his part, was implicated in laundering about $3.5 million since 2024 and was also linked to Alis and Amnokgang, both of them sanctioned North Korean firms.

The OFAC action further named two North Korean managers, Kim Ki Hyok and Kim Hyo Dong, who both report to the Chinyong Information Technology Cooperation Company, a firm that received its own Treasury designation in 2023. The repeat designations show Treasury applying pressure to the same network over successive years rather than treating it as a one-off action. Ki Hyok runs a delegation of IT workers inside Russia and has moved at least $500,000 back to North Korea since 2024, while Hyo Dong, who heads another group, has helped evade sanctions on more than $100,000 in transfers.

How the crypto moved

Per blockchain analytics firm Chainalysis, one case it traced on-chain involved a North Korean developer who built code for blockchain and DeFi protocols and collected stablecoin paychecks every two weeks. The stablecoins sitting in the wallets would then be converted into Ether (ETH) and routed through consolidation addresses before finally landing with Boykov. The Russian handler would then move the funds to Garantex, a US-sanctioned Russian exchange, in the final stage before the cashout. That trail — payroll stablecoins swapped into ETH, consolidated into a handler's wallets, and exited through a sanctioned exchange — is the kind of on-chain pattern analysts use to tie individual workers to a single laundering apparatus.

While OFAC's report states that Obertas began handling crypto for DPRK officials in 2025, Chainalysis' blog estimates the handler has been active since at least 2023.

OFAC also sanctioned the First Financial and Technical Development Center, a North Korean-controlled outfit based in Russia. The firm made millions using AI to help trained IT workers land jobs across the US and elsewhere, while also running crypto transfers in the background. Six of its operatives were named alongside it: Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il. Treasury said they have earned at least $750,000 for the company since 2025.

Treasury Secretary Scott Bessent said North Korea's government "continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments."

A widening crackdown

The sanctions follow a Justice Department operation earlier this month that shut down dozens of laptop farms in Texas and led to two arrests. Laptop farms host company-issued computers so that workers abroad appear to be logging in from inside the US.

According to Chainalysis, the UN panel of experts estimates that the IT worker program brings North Korea $250 million to $600 million a year, with the money flowing into its weapons and missile programs. Revenue at that scale is one reason the response has grown into a multi-jurisdiction effort rather than a single-country action.

The North Korean operation is also facing pressure from Australia and the European Union, both of which moved against the network this month.

Meanwhile, President Donald Trump has been pressing to restart nuclear talks with Pyongyang, which has shown little interest in them — leaving sanctions enforcement and diplomatic outreach running on parallel tracks.

Source: Cryptopolitan