Treasury sanctions 11 over North Korean IT worker scheme, lists Russian crypto wallets
In brief
- OFAC sanctioned 10 individuals and one entity tied to North Korean IT worker schemes.
- Vitold Obertas made nearly $2 million in crypto conversions since January 2025, Treasury said.
- Ilya Boykov converted the equivalent of $3.5 million in crypto since 2024, Treasury said.
- Ethereum and Tron addresses appear in OFAC listings; both men share one Ethereum address.
- A Vladivostok-based center and two North Korean delegation leaders were also designated.
The two Russian intermediaries
Treasury's Office of Foreign Assets Control (OFAC) carried out the designations, according to a Treasury post on X dated October 28. Treasury said Vitold Obertas, a Russian intermediary for North Korean financial transactions, carried out nearly $2 million in crypto conversions for North Korean officials since January 2025 (plus at least $1.25 million in other currency transactions).
The second man is Ilya Boykov. Treasury said he exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company that was itself sanctioned in 2024.
That's where the on-chain detail comes in. The listings include two Ethereum and two Tron addresses for Boykov, and one Ethereum and three Tron addresses for Obertas, Decrypt reported.
One Ethereum address appears on both men's entries.
A Vladivostok center and two delegation leads
Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity in Vladivostok, Russia. It said the center deploys IT workers who use AI tools and "complex cryptocurrency transfers" to generate revenue, and that six Russia-based North Korean IT workers brought in more than $750,000 for it since 2025. Two North Korean nationals who lead Russia-based IT worker delegations were named too. Treasury said one of them, Kim Ki Hyok, transferred nearly $500,000 in crypto for his delegation since 2024.
The broader playbook, per Treasury, relies on fake documents, stolen identities and invented personas to get workers hired at legitimate companies, with the regime taking most of their wages. Treasury said the schemes generated hundreds of millions of dollars for North Korea's weapons of mass destruction and ballistic missile programs.
"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," said Treasury Secretary Scott Bessent.
Why crypto teams keep running into this
Treasury said the action builds on sanctions against a separate network in March, and Australia and the European Union made their own designations this month.
It isn't new territory for crypto. In April 2025, Google's Threat Intelligence Group reported that North Korean IT workers had embedded themselves in crypto projects in the UK, Germany, Portugal and Serbia, including Solana smart contract development, some using up to 12 fake identities at once. This April, Solana-based exchange Drift Protocol said the attack that drained about $285 million from its platform was a six-month operation by a North Korean state-affiliated group. Decrypt reported the group's intermediaries met Drift contributors in person and posed as a quantitative trading firm.
Frequently asked questions
Who did the Treasury sanction over North Korean IT worker schemes?
Treasury's Office of Foreign Assets Control sanctioned 10 individuals and one entity. They include two Russian nationals, Vitold Obertas and Ilya Boykov, the First Financial and Technical Development Center in Vladivostok, and two North Korean nationals who lead Russia-based IT worker delegations.
Which crypto addresses are in the OFAC listings?
The listings include two Ethereum and two Tron addresses for Ilya Boykov, and one Ethereum and three Tron addresses for Vitold Obertas. One Ethereum address appears on both men's entries.
