The U.S. Treasury Department on Wednesday sanctioned 10 individuals and one entity for their roles in North Korean IT worker schemes that defraud U.S. businesses and generate revenue for the country's unlawful weapons programs.

Treasury said Russian nationals Ilya Boykov and Vitold Obertas converted millions of dollars in cryptocurrency for North Korean networks, with activity dating back to 2024. The designations include cryptocurrency wallet addresses on the Ethereum and Tron blockchains.

According to Treasury, North Korea uses fake documents, stolen identities and invented personas to place its IT workers at legitimate companies, then takes most of their wages, generating hundreds of millions of dollars for its weapons of mass destruction and ballistic missile programs. The networks have used "sophisticated cryptocurrency transactions," money laundering and artificial intelligence tools to move millions of dollars to the regime, the department said.

In a press release, Treasury's Office of Foreign Assets Control (OFAC) said the designations target participants in Democratic People's Republic of Korea (DPRK) government-run IT worker schemes. Such designations block any property the listed parties hold within U.S. jurisdiction and bar U.S. persons from transacting with them, including the crypto wallet addresses named in the action. The action was also listed among OFAC's recent actions for October 28, and the department announced it on X:

Today, Treasury's Office of Foreign Assets Control sanctioned 10 individuals and one entity for their roles in Democratic People's Republic of Korea (DPRK) government-run IT worker schemes that defraud U.S. businesses and generate revenue for the DPRK's unlawful weapons of mass… — Treasury Department (@USTreasury) October 28, 2026

"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," said Treasury Secretary Scott Bessent.

Two Russian nationals are among those sanctioned. Vitold Obertas, a Russian intermediary for North Korean financial transactions, has carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials, Treasury said. Ilya Boykov has exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company sanctioned in 2024.

The sanctions listings include two Ethereum and two Tron addresses for Boykov, and one Ethereum and three Tron addresses for Obertas. One Ethereum address appears on both men's entries. Publishing the addresses alongside the names gives exchanges and compliance teams on-chain identifiers to screen against.

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia, that it said deploys highly trained IT workers who use AI tools and "complex cryptocurrency transfers" to generate revenue. Six Russia-based North Korean IT workers have generated more than $750,000 for the center since 2025, according to Treasury.

Two North Korean nationals who lead Russia-based IT worker delegations were also sanctioned. One of them, Kim Ki Hyok, has transferred nearly $500,000 in crypto for his delegation since 2024, Treasury said.

The action builds on sanctions against a separate North Korean IT worker network in March, and Australia and the European Union have made their own designations this month, according to Treasury.

North Korea's crypto operations

North Korean IT workers have increasingly targeted crypto projects. In April 2025, Google's Threat Intelligence Group reported that such workers had embedded themselves in crypto projects in the UK, Germany, Portugal and Serbia, including Solana smart contract development, with some operating under as many as 12 fake identities at once, as Decrypt reported.

North Korean hackers have also used long-running deception campaigns against crypto firms. In April, Solana-based exchange Drift Protocol said the attack that drained about $285 million from its platform was a six-month operation by a North Korean state-affiliated group, whose intermediaries met Drift contributors in person and posed as a quantitative trading firm, per Decrypt.