US Sanctions 11 Targets in North Korea IT Worker Crypto Networks

The U.S. Treasury sanctioned 10 people and one entity on Wednesday, Oct. 28, accusing them of moving crypto and other funds for North Korea's IT worker schemes.

Treasury's Office of Foreign Assets Control (OFAC) said the networks rely on fraudulent documents, stolen identities and made-up personas to land jobs at U.S. and allied companies, and that North Korea's government takes most of the workers' wages to fund its weapons programs. Those schemes bring in hundreds of millions of dollars, Treasury said.

The crypto trail

OFAC put figures on the crypto side. It said Russian national Ilya Aleksandrovich Boykov exchanged and converted about $3.5 million in crypto for Alis, a North Korean IT company. It said Russian intermediary Vitold Viktorovich Obertas made nearly $2 million in crypto conversions for North Korean officials since January 2025, and that Kim Ki Hyok moved nearly $500,000 in crypto for a Russia-based IT worker delegation.

The entity, the First Financial and Technical Development Center, is a North Korea-controlled group in Russia whose workers generated more than $750,000, Treasury said.

What the designation does

Property of those named that is in the U.S. or held by U.S. persons is now blocked, and U.S. persons are generally barred from dealing with them. OFAC can impose civil penalties on a strict liability basis, so a firm can be fined even if it did not know who it was dealing with.

The action builds on OFAC's March 12 designation of a separate network, and Treasury said Australia and the EU also designated North Korea-linked targets this month. Treasury's release did not include responses from those named. Reuters also reported the sanctions.

In our opinion: Naming the people who convert the coins goes after the cash-out step, and that is where these schemes leave the clearest trail.