US Sanctions Russians Over North Korean Crypto Schemes

US Sanctions Network Facilitating North Korean IT Workers’ Crypto Earnings

The U.S. Treasury Department has imposed sanctions on 10 individuals and one entity accused of facilitating North Korean IT workers’ illicit earnings through fraudulent employment and cryptocurrency conversions. The targeted network is alleged to generate hundreds of millions of dollars annually for Pyongyang.

Financial Intermediaries and Crypto Conversions

According to a report by blockchain analytics firm Chainalysis, Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas played key roles as financial intermediaries. They are accused of converting millions of dollars in cryptocurrency for front companies that employed North Korean IT workers under false identities. The earnings from these workers ultimately contributed to funding the North Korean regime and its weapons programs.

Chainalysis traced one payment pathway to a developer who contributed code to blockchain and decentralized finance (DeFi) projects. Between late 2022 and early 2023, this worker’s digital wallet reportedly received bi-weekly stablecoin payments, mimicking a regular salary. These funds were then converted to Ether (ETH) and routed through consolidation wallets linked to sanctioned entities before reaching Boykov. He, in turn, allegedly forwarded the cryptocurrency to Garantex, a Russian exchange subsequently sanctioned by U.S. authorities.

Obertas is also implicated as a financial intermediary for North Korean officials. His digital wallet is said to have received funds from Amnokgang Technology Development Company, another sanctioned organization involved in managing overseas IT worker delegations. The Office of Foreign Assets Control (OFAC) stated that Obertas facilitated the conversion of nearly $2 million worth of cryptocurrency into fiat currency for North Korean officials.

Broader Sanctions and North Korean IT Operations

The sanctions also extend to Kim Ki Hyok and Kim Hyo Dong, two North Korean nationals who managed IT workers based in Russia. Additionally, the First Financial and Technical Development Center (FFTDC), also located in Russia, and six North Korean workers associated with it were designated. Chainalysis reported that these six workers generated over $750,000 for FFTDC since 2025.

Past reporting has detailed how North Korean IT workers utilize fabricated identities and stolen credentials to secure employment with legitimate companies, subsequently transferring a significant portion of their income to the regime. The United Nations Panel of Experts estimates these operations generate between $250 million and $600 million annually.

In April, blockchain investigator ZachXBT uncovered evidence linking a North Korean fake-developer operation to over $3.5 million in cryptocurrency earnings. Separately, security researcher Taylor Monahan reported that North Korean-linked developers had contributed to the development of prominent DeFi protocols, including SushiSwap and THORChain.

Chainalysis has also cautioned that generative artificial intelligence is exacerbating the difficulty in detecting recruitment fraud. Operatives are reportedly leveraging AI-generated resumes and profile photos, along with deepfake videos during hiring calls, to present a facade of legitimacy.