The US Treasury sanctioned ten individuals and one organisation on Wednesday for moving money for North Korea’s overseas IT workers, CoinDesk reports. The targets are intermediaries and workers based in Russia and North Korea, and the notice lists eight crypto addresses on Ethereum and Tron.
Treasury says Ilya Boykov exchanged and converted about $3.5 million in crypto for Alis, a company sanctioned in March 2024 over links to the workers. It says Vitold Obertas handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.
Also designated is the First Financial and Technical Development Center, a North Korean-controlled organisation in Russia. Six workers sanctioned alongside it generated more than $750,000 for it since 2025, Treasury says.
The scheme relies on stolen identities and fabricated personas to win jobs at legitimate companies, with North Korea taking most of the wages. Treasury says some workers used their network access to install malware and steal data. Chainalysis adds that operatives use generative AI for CVs and interview preparation, and sometimes deepfake video.
The same firm traced crypto earned by one worker to Boykov, who sent it to Garantex, the sanctioned Russian exchange, to cash out. That detail is Chainalysis’s, not Treasury’s.
In March, Treasury sanctioned six people and two companies it said laundered about $800 million for North Korea, which makes these sums look small.
The report does not say whether $3.5 million and $2 million are totals or samples, and the figures remain allegations.
