The U.S. Treasury Department on Tuesday sanctioned ten individuals and one company for helping North Korea collect wages from foreign employers through fraudulent worker placements using fake identities and forged documentation.
The scheme typically involves placing workers at legitimate firms under invented personas, sometimes using AI-generated resumes, altered photos, or deepfake video during interviews. The Treasury Department said most wages are returned to the North Korean regime, which uses the funds for weapons of mass destruction and ballistic missile programs. Some workers have also gained access to corporate networks, where they planted malware and obtained proprietary data.
Cryptocurrency Conversions at Center of Sanctions
The sanctions focused primarily on individuals moving money rather than the workers themselves. Two Russian nationals played central roles in the operation.
Vitold Obertas, described by Treasury as a go-between for North Korean financial transactions, allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025. Ilya Boykov allegedly converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT worker company previously sanctioned by the U.S. in 2024.
Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were named for leading Russia-based worker delegations. Kim Ki Hyok has reportedly moved close to $500,000 in crypto for his team since 2024.
Sanctions and Financial Monitoring
Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who generated more than $750,000 for the entity since 2025.
The Treasury Department published wallet addresses on Ethereum and Tron linked to the sanctioned individuals, signaling to exchanges and financial firms to monitor those accounts. One Ethereum address is connected to both Obertas and Boykov.
Under the sanctions, any property these individuals or entities hold in the United States or controlled by U.S. persons is blocked and must be reported to the Office of Foreign Assets Control. Transactions with them are generally prohibited unless licensed. Treasury warned that civil penalties can apply even for unintentional violations.
The action follows a March designation of a separate North Korean IT worker network that the Treasury Department said had laundered approximately $800 million in crypto. Australia and the European Union announced related designations this month, with Treasury coordinating the move through the Multilateral Sanctions Monitoring Team.
Guidance for Employers
The State Department, Treasury Department, Justice Department, and FBI have issued advisories for companies hiring remote contractors, recommending identity verification, monitoring payment destinations, and watching for unusual access requests to prevent involvement in similar schemes.
