U.S. Sanctions 11 Over North Korean IT Worker Crypto Schemes

The U.S. Treasury Department announced sanctions on Wednesday, October 28, 2026, targeting ten individuals and one entity. These designations address North Korean IT worker schemes that defraud U.S. businesses and generate funds for weapons programs. The schemes utilize fake documents, stolen identities, and invented personas to place workers at legitimate companies. This activity generates hundreds of millions of dollars for North Korea's weapons of mass destruction and ballistic missile programs.

The sanctions include Russian nationals Vitold Obertas and Ilya Boykov. Obertas has carried out nearly $2 million in crypto conversions since January 2025 for North Korean officials. He also handled at least $1.25 million in other currency transactions. Boykov exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis. The listings include Ethereum and Tron addresses linked to these individuals. One Ethereum address appears on the sanction entries for both Obertas and Boykov. Blockchain analytics company Chainalysis mapped a network of Russian intermediaries helping North Korean IT workers cash out millions in cryptocurrency. Chainalysis reported that a wallet linked to a North Korean IT worker sent converted Ether through consolidation addresses to Boykov.

The First Financial and Technical Development Center, a North Korean-controlled entity in Vladivostok, Russia, was also sanctioned. Six Russia-based North Korean IT workers generated more than $750,000 for this center since 2025. North Korean national Kim Ki Hyok was sanctioned for leading a Russia-based IT worker delegation. Treasury also sanctioned Kim Hyo Dong for leading similar delegations. North Korean IT worker schemes have used sophisticated cryptocurrency transactions, money laundering, and artificial intelligence tools. Workers use AI-generated resumes, doctored photos, or deepfake videos during interviews to obtain jobs.

In April 2025, Google's Threat Intelligence Group reported North Korean workers embedded in crypto projects in the UK, Germany, Portugal, and Serbia. In the same month, Solana-based exchange Drift Protocol suffered an attack draining about $285 million attributed to a North Korean state-affiliated group. In June 2025, the U.S. Department of Justice announced charges against four North Korean nationals over a scheme involving fraudulent IT employment and theft.