The US Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions on October 28 targeting 10 individuals and one entity involved in converting cryptocurrency for North Korean IT worker operations. The action focuses on financial intermediaries and workers based in Russia and North Korea who facilitate wage payments to the regime.
Two Russian nationals, Ilya Boykov and Vitold Obertas, were designated for their roles in crypto conversions. Treasury says Boykov exchanged and converted approximately $3.5 million in cryptocurrency for Alis, a company sanctioned in March 2024 over North Korean IT worker connections. Obertas allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.
How the Schemes Operate
North Korean operatives use stolen identities, forged documents, and fabricated personas to secure remote employment at legitimate companies. The regime retains most of the wages earned through this work, converting routine software development into state revenue.
Beyond direct wage theft, Treasury notes these workers have used corporate network access to deploy malware and steal sensitive proprietary data. According to Chainalysis, operatives have also employed generative AI to create resumes, cover letters, and prepare for technical interviews. In some cases, AI-generated profile photos and deepfake videos were used to conceal identities during hiring procedures.
Targeting the Conversion Pipeline
OFAC designated the First Financial and Technical Development Center, a North Korean organization operating in Russia. Six workers sanctioned alongside the center generated over $750,000 for the group since 2025, according to Treasury. The designation included eight cryptocurrency addresses on Ethereum and Tron linked to the sanctioned individuals.
Chainalysis traced cryptocurrency earned by a North Korean IT worker to Boykov, who transferred funds to Garantex, a now-sanctioned Russian exchange, to convert them to cash.
This action follows a March sanctions round in which Treasury targeted six people and two companies accused of laundering $800 million in cryptocurrency for North Korea. Together, these moves reflect a US enforcement strategy increasingly focused on financial intermediaries who convert North Korean earnings into usable currency, rather than solely targeting the workers themselves.
