The U.S. Treasury Department on Tuesday sanctioned ten individuals and one company accused of helping North Korea collect wages from foreign employers — many of them American — through fake identities and forged paperwork.

According to Treasury's announcement, the workers are typically placed at legitimate firms under invented personas, at times using AI-generated resumes, doctored photos, or deepfake video during job interviews. Most of their pay is funneled back to the regime, which Treasury says uses the funds to support its weapons of mass destruction and ballistic missile programs. Some of these workers have also gained access to corporate networks, where they have planted malware and taken proprietary data.

The money and crypto behind the scheme

Tuesday's action focused less on the workers themselves than on the people who move their money, with two Russian nationals at the center of the designations.

Vitold Obertas, described by Treasury as a go-between for North Korean financial transactions, allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025. Ilya Boykov allegedly converted the equivalent of $3.5 million in cryptocurrency for Alis, a North Korean IT worker company that the U.S. sanctioned in 2024.

Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were also named for leading Russia-based worker delegations. Kim Ki Hyok has reportedly moved close to $500,000 in crypto on behalf of his team since 2024.

Treasury additionally sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who have generated more than $750,000 for the organization since 2025.

As part of the announcement, Treasury published cryptocurrency wallet addresses on Ethereum and Tron tied to the sanctioned individuals — a signal to exchanges and other financial firms to watch for those accounts. One Ethereum address is linked to both Obertas and Boykov.

Taken together, the dollar figures and wallet listings map the pipeline the designations target: wages earned under false identities, converted into cryptocurrency, and passed to regime-linked intermediaries.

Coordinated international action

The designations follow a March action against a separate North Korean IT worker network that Treasury said had laundered roughly $800 million in cryptocurrency for the regime. Australia and the European Union have also announced related designations this month, and Treasury coordinated the move with the Multilateral Sanctions Monitoring Team. For companies operating across borders, the parallel designations mean the same individuals and entities can face restrictions in multiple jurisdictions at once.

Under the sanctions, any property these individuals or entities hold in the United States, or that is controlled by U.S. persons, is blocked and must be reported to the Office of Foreign Assets Control. Transactions with them are generally prohibited unless licensed, and companies owned 50 percent or more by blocked parties are subject to the same restrictions. Treasury warned that civil penalties can apply even when a violation was unintentional.

For companies that hire remote contractors, joint advisories from the State, Treasury and Justice departments and the FBI offer guidance on spotting these schemes, including verifying identities, checking where payments are going, and watching for unusual access requests. Because Treasury has warned that penalties can apply even to unintentional violations, the advisories effectively function as a practical baseline for screening new hires and payment flows.

This article first appeared on Bitcoin Magazine and is written by Micah Zimmerman.