OFAC Sanctions 10 Individuals, One Entity Over North Korean IT Worker Schemes

The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity on Oct. 28, 2026, for roles in North Korean government-run IT worker schemes, according to CoinPaprika and CryptoNews. Treasury said the networks defraud U.S. businesses and generate revenue for North Korea's weapons of mass destruction and ballistic missile programs. Two Russian nationals are accused of converting millions of dollars in cryptocurrency for these networks. According to Treasury, North Korea uses fake documents, stolen identities and invented personas to place IT workers at legitimate companies, then takes most of their wages. Treasury also said workers have used access to corporate networks to install malware and steal sensitive data. Chainalysis said operatives have used generative AI to write resumes and prepare for interviews. Treasury said the financial networks relied on cryptocurrency transactions, money laundering and AI tools to move proceeds. Chainalysis traced crypto earned by a North Korean IT worker to Ilya Boykov, who sent it to Garantex, a now-sanctioned Russian exchange, to cash out. Treasury alleges Boykov exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Alis, a North Korean IT worker company sanctioned in March 2024. It alleges Vitold Obertas conducted nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. The First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, was also sanctioned. Treasury said six Russia-based North Korean IT workers generated more than $750,000 for it since 2025, and that Kim Ki Hyok transferred nearly $500,000 in crypto for his delegation since 2024. The listings include Ethereum and Tron addresses: two of each for Boykov, and one Ethereum and three Tron for Obertas. The address strings were not available in the material reviewed, so none are reproduced here. As a result of the action, all property and interests in property of the designated parties within U.S. jurisdiction are blocked. Treasury Secretary Scott Bessent framed the action as continued pressure on the networks. Treasury said the action builds on March sanctions against a separate North Korean IT worker network, and that Australia and the European Union made their own North Korea-related designations in October. Employers hiring remote technical staff should verify identities through live video interviews and independent document checks, and be wary of candidates who avoid on-camera contact or request payment through crypto. Companies should restrict new hires' access to sensitive systems and monitor for unusual data access. Crypto businesses and individuals can screen counterparties and wallet addresses against OFAC's sanctions list, since dealing with designated parties can create legal exposure. Sanctions designations are allegations by authorities and not court findings of guilt.