US Treasury Sanctions Two Russian Nationals Over North Korean IT Workers' Crypto Cash-Outs

The US Treasury Department has sanctioned 10 individuals and one entity accused of helping North Korean IT workers earn money through fraudulent employment at legitimate businesses and converting their cryptocurrency earnings into cash. The action targeted financial intermediaries within a network that generates hundreds of millions of dollars annually for Pyongyang. Under designations of this kind, property the named parties hold under US jurisdiction is typically blocked, and US persons and businesses are generally barred from transacting with them.

How the Cash-Out Chain Worked

According to a report by blockchain analytics firm Chainalysis, Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas converted millions of dollars in cryptocurrency for front companies that placed North Korean IT workers at businesses under false identities. The workers' earnings ultimately helped fund the North Korean regime and its weapons programs.

The focus on intermediaries highlights a choke point in the scheme: however a worker is paid, the crypto still has to be converted into spendable cash, and the individuals designated here served as that bridge.

Chainalysis traced one payment trail to a developer who contributed code to blockchain and DeFi projects. From late 2022 to early 2023, the worker's wallet received stablecoin payments every two weeks, resembling a regular salary. Those funds were converted into ETH and sent through consolidation wallets associated with sanctioned entities, before being passed to Boykov, who forwarded the cryptocurrency to Garantex, a Russian exchange that was later sanctioned by US authorities.

Obertas was also accused of acting as a financial intermediary for North Korean officials. His wallet received funds from another sanctioned organization, the Amnokgang Technology Development Company, which was involved in managing overseas IT worker delegations. According to the Office of Foreign Assets Control (OFAC), the Russian national converted nearly $2 million worth of crypto into fiat currency on behalf of North Korean officials.

Additional Designations

The designations also cover Kim Ki Hyok and Kim Hyo Dong, two North Korean nationals who managed IT workers based in Russia, along with the First Financial and Technical Development Center (FFTDC), also based in the country, and six North Korean workers associated with it. Per Chainalysis, those six workers had generated more than $750,000 for FFTDC since 2025.

Fake Developer Identities Remain a Corporate Risk

North Korean IT workers have repeatedly used fabricated identities and stolen credentials to secure jobs at legitimate companies, after which they transfer much of their income back to the regime. The United Nations Panel of Experts estimates that these operations generate $250 million to $600 million annually.

In April, blockchain investigator ZachXBT uncovered records linked to a North Korean fake-developer operation that generated more than $3.5 million in cryptocurrency. In a separate report, security researcher Taylor Monahan claimed that North Korean-linked developers had helped build some of the most prominent DeFi protocols, including SushiSwap and THORChain.

Chainalysis also warned that generative AI is making recruitment fraud harder to detect, with operatives using AI-generated resumes and profile photos, as well as deepfake video during hiring calls, to appear legitimate.

The patterns documented in this case now offer concrete screening references for exchanges and companies: steady stablecoin payrolls, conversion into ETH, consolidation wallets, and transfers to a sanctioned exchange like Garantex are all tied to named individuals. At the hiring stage, the warning signs are increasingly synthetic rather than purely financial, spanning AI-generated documents and deepfaked interviews.