The US Treasury has sanctioned 10 individuals and one entity for allegedly facilitating cryptocurrency conversions for North Korean IT workers employed at legitimate businesses under false identities. The action targeted financial intermediaries in a network that generates hundreds of millions of dollars annually for the North Korean regime.
The Cash Conversion Chain
Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas allegedly converted millions of dollars in cryptocurrency for front companies that placed North Korean IT workers at businesses. According to blockchain analytics firm Chainalysis, one developer contributed code to blockchain and DeFi projects while receiving regular stablecoin payments every two weeks from late 2022 to early 2023.
Those funds were converted into ETH and routed through consolidation wallets before reaching Boykov, who forwarded the cryptocurrency to Garantex, a Russian exchange later sanctioned by US authorities. Obertas was accused of changing nearly $2 million worth of cryptocurrency into fiat currency for North Korean officials, acting as a financial intermediary for regime officials through his wallet connections to sanctioned organizations.
Additional Targets and Scale
The designations also included Kim Ki Hyok and Kim Hyo Dong, two North Korean nationals who managed IT workers based in Russia, along with the First Financial and Technical Development Center (FFTDC) and six North Korean workers associated with it. Those six workers had generated more than $750,000 for FFTDC since 2025, per Chainalysis.
The UN Panel of Experts estimates that North Korean IT worker operations generate between $250 million and $600 million annually. In April, blockchain investigator ZachXBT uncovered records linked to a North Korean fake-developer operation that generated more than $3.5 million in cryptocurrency.
Ongoing Corporate Vulnerability
North Korean IT workers have used fabricated identities and stolen credentials to secure positions at legitimate companies, transferring much of their income to the regime. Security researchers have noted that North Korean-linked developers contributed to prominent DeFi protocols. The Office of Foreign Assets Control warned that generative AI is making recruitment fraud harder to detect, with operatives using AI-generated resumes, profile photos, and deepfake videos during hiring calls.
