The U.S. Treasury has sanctioned 10 individuals and one entity accused of supporting North Korea’s overseas IT worker network, including financial intermediaries who allegedly converted millions of dollars through cryptocurrency. According to the Treasury Department’s October 28 announcement, the network used fraudulent identities, fabricated personas and overseas employment to generate revenue for the DPRK government while moving part of those proceeds through crypto infrastructure.
The action targets facilitators operating primarily from Russia alongside North Korean IT workers deployed there. Treasury says these workers secure legitimate technology jobs, including at U.S. companies, while the DPRK appropriates much of their earnings to support its weapons programs. The same access can create a cybersecurity risk because Treasury says some DPRK workers have also deployed malware and extracted sensitive corporate information after gaining employment.
Crypto Conversions Moved Millions for DPRK Networks
Russian national Ilya Aleksandrovich Boykov was designated for allegedly supporting Limited Liability Company Alis, an organization previously sanctioned by OFAC. Treasury says Boykov exchanged or converted approximately $3.5 million in cryptocurrency transactions for Alis since 2024 while also monitoring transfers and providing logistical assistance. OFAC’s designation connects crypto conversion services directly to the financial infrastructure supporting an already sanctioned DPRK IT worker operation.
Vitold Viktorovich Obertas was separately accused of acting as an intermediary for North Korean officials. Since January 2025, Treasury says he handled nearly $2 million in cryptocurrency conversions and at least another $1.25 million in other currency transactions. OFAC’s SDN update associates Boykov, Obertas and Kim Ki Hyok with eight unique Ethereum and Tron addresses, bringing identifiable blockchain infrastructure directly into the sanctions action.
The use of blockchain rails fits a broader pattern in North Korean operations. Earlier Google-linked threat research documented how DPRK-associated actors combined AI-assisted social engineering with crypto-focused malware campaigns, including recruitment-style lures aimed at developers. The Treasury action shows that fraudulent employment can serve both as a revenue-generation mechanism and as an access path into corporate systems.
Russia-Based FFTDC Workers Generated Over $750,000
OFAC also designated the First Financial and Technical Development Center, or FFTDC, a DPRK-controlled entity operating from Russia. Treasury says six North Korean workers linked to the center, Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il, collectively generated more than $750,000 for FFTDC since 2025. The designation targets both the organization receiving the revenue and the individual workers involved in generating it.
The blockchain addresses included in the sanctions list also illustrate how digital-asset enforcement can extend beyond naming individuals and companies. Stablecoin issuers and centralized platforms can separately restrict assets associated with sanctioned addresses when their own infrastructure permits it, as demonstrated when Tether froze more than $344 million in USDT linked to U.S. enforcement actions. An OFAC designation itself, however, is a legal blocking action and should not be confused with a confirmed issuer-level freeze of every token connected to a listed wallet.
The October action also reflects a broader expansion of sanctions screening into crypto infrastructure. European measures have similarly extended restrictions to Russian crypto service providers and digital payment assets, increasing the compliance perimeter around wallets, intermediaries and settlement routes. For the DPRK network, Treasury is targeting the financial facilitators that convert employment income into transferable assets rather than treating cryptocurrency as the underlying source of the revenue.
OFAC designated the facilitators under Executive Orders 13687 and 13722. Property and interests in property of sanctioned persons that fall within U.S. jurisdiction must be blocked, while U.S. persons are generally prohibited from conducting transactions with them unless authorized. The action therefore combines conventional sanctions against individuals and entities with address-level blockchain identifiers that exchanges and other service providers can incorporate into screening systems.