Treasury Sanctions 11 in North Korean Crypto Scheme

Treasury Sanctions Individuals and Entity Over North Korean IT Worker Schemes

The U.S. Treasury Department announced sanctions on Wednesday against 10 individuals and one entity for their involvement in North Korean schemes that employ IT workers to defraud American businesses and funnel revenue to the country’s weapons programs.

According to the Treasury Department, North Korea utilizes forged documents, stolen identities, and fabricated personas to place IT workers in legitimate companies. The regime then confiscates the majority of their wages, generating hundreds of millions of dollars for its programs focused on weapons of mass destruction and ballistic missiles. The department stated that these networks have employed “sophisticated cryptocurrency transactions,” money laundering, and artificial intelligence tools to transfer millions of dollars to the North Korean regime.

“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” said Treasury Secretary Scott Bessent.

Among those sanctioned are two Russian nationals. Vitold Obertas, identified as a Russian intermediary for North Korean financial transactions, has reportedly handled nearly $2 million in cryptocurrency conversions since January 2025, in addition to at least $1.25 million in other currency transactions for North Korean officials. Ilya Boykov is accused of exchanging and converting the equivalent of $3.5 million in cryptocurrency since 2024 for Limited Liability Company Alis, a North Korean IT worker company previously sanctioned in 2024.

The sanctions listings include specific cryptocurrency addresses linked to Boykov and Obertas, with one Ethereum address appearing on both individuals’ entries.

The Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia. The department alleges this entity deploys highly skilled IT workers who leverage AI tools and “complex cryptocurrency transfers” to generate revenue. Treasury reported that six Russia-based North Korean IT workers have generated over $750,000 for the center since 2025.

Additionally, two North Korean nationals leading Russia-based IT worker delegations were sanctioned. One of them, Kim Ki Hyok, has reportedly transferred nearly $500,000 in cryptocurrency for his delegation since 2024.

This action follows previous sanctions against a separate North Korean IT worker network in March. Australia and the European Union have also implemented their own designations this month, according to the Treasury Department.

North Korean IT workers have increasingly focused on cryptocurrency projects. In April 2025, Google’s Threat Intelligence Group reported that these workers had infiltrated crypto projects in the United Kingdom, Germany, Portugal, and Serbia, including Solana smart contract development. Some individuals were found to be operating under as many as 12 fake identities simultaneously.

North Korean hackers have also engaged in prolonged deception campaigns against cryptocurrency firms. In April, the Solana-based exchange Drift Protocol stated that an attack which drained approximately $285 million from its platform was a six-month operation by a North Korean state-affiliated group. Decrypt reported that intermediaries from this group met with Drift contributors in person, posing as a quantitative trading firm.