Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto

Introduction

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has announced a new round of sanctions targeting a network of North Korean IT workers who exploit U.S. companies, launder cryptocurrency, and funnel the proceeds to the regime’s weapons programs. The action names ten individuals and one entity, among them two Russian nationals who alone moved more than $5 million in crypto for North Korean operators.

How the IT‑worker scheme works

North Korea recruits technically skilled workers abroad, often under fabricated identities, and places them in legitimate firms. Once embedded, the workers siphon a large share of their wages and use sophisticated tools—artificial‑intelligence‑driven data harvesting, money‑laundering techniques, and complex crypto transfers—to move the funds to the regime. The Treasury says these operations have generated hundreds of millions of dollars for North Korea’s ballistic‑missile and weapons‑of‑mass‑destruction programs.

Key sanctions targets

• Ilya Boykov – a Russian intermediary who, since 2024, has exchanged roughly $3.5 million in crypto for a North Korean IT‑worker company. OFAC listed two Ethereum and two Tron addresses linked to him.
• Vitold Obertas – another Russian facilitator who has converted nearly $2 million in crypto and $1.25 million in other currencies for North Korean officials since early 2025. His listings include one Ethereum and three Tron addresses, one of which overlaps with Boykov’s.
• First Financial and Technical Development Center – a Vladivostok‑based entity that coordinates the deployment of highly trained IT workers who employ AI tools and “complex cryptocurrency transfers.” Six Russia‑based workers have already generated more than $750,000 for the center.
• Kim Ki‑Hyok – a North Korean national leading a delegation of IT workers in Russia, responsible for moving close to $500,000 in crypto since 2024.

The sanctions also freeze the listed cryptocurrency wallets, prohibiting any U.S. person from dealing with them and cutting off a critical revenue stream for the DPRK.

Broader context and implications

This crackdown builds on earlier sanctions announced in March against a separate North Korean IT‑worker network and follows coordinated designations by Australia and the European Union. The Treasury’s statement underscores a growing concern: North Korean actors are increasingly targeting the cryptocurrency ecosystem, from smart‑contract development on platforms like Solana to large‑scale thefts from exchanges. By exposing the crypto addresses tied to the scheme, OFAC aims to deter further laundering and make it harder for the regime to monetize illicit earnings.

Practical takeaways for the crypto community

1. Enhanced due‑diligence – Firms should scrutinize wallet addresses associated with sanctioned entities and monitor transaction patterns that resemble the “sophisticated cryptocurrency transfers” described by the Treasury.
2. Compliance monitoring – Updating sanctions screening tools to include the newly listed Ethereum and Tron addresses can help prevent inadvertent dealings with prohibited parties.
3. Risk awareness – Companies employing remote IT talent should verify the provenance of workers and implement robust identity‑verification processes to avoid being unwitting conduits for state‑sponsored fraud.

Conclusion

The latest Treasury sanctions shine a spotlight on the intersection of state‑sponsored cyber‑crime and cryptocurrency laundering. By targeting the individuals, wallets, and entities that enable North Korea’s IT‑worker scheme, the U.S. aims to choke a vital funding source for the regime’s weapons programs and send a clear warning to the broader crypto ecosystem about the risks of facilitating illicit activity.