Treasury Sanctions 10 Over North Korean IT Workers

The US Treasury has sanctioned 10 people and one Russia-based organisation that it says help North Korea place IT workers in foreign companies and move their earnings home, much of it through cryptocurrency. The Office of Foreign Assets Control (OFAC) announced the action on 28 October, targeting what it calls “key facilitators and financial networks” behind the schemes.

For companies, the warning is twofold. Treasury says the workers hide behind fake documents, stolen identities and invented personas to get hired, and that once inside some have deployed malware, stolen data and extorted their employers.

In brief

OFAC designated four facilitators and six North Korean IT workers, plus the First Financial and Technical Development Center (FFTDC), a North Korean-controlled organisation in Russia. Treasury says the networks operate from Russia and North Korea.
Treasury says one Russian national handled the equivalent of $3.5 million in cryptocurrency for a sanctioned North Korean company.
The sanctions list entries include Ethereum and Tron wallet addresses for screening.
Australia and the EU have also made designations against North Korean revenue networks this month, Treasury says.

Who was sanctioned and what Treasury alleges

Treasury says North Korea takes most of the wages these workers earn, “generating hundreds of millions of dollars” for its weapons of mass destruction and ballistic missile programmes. The networks, it says, have used “sophisticated cryptocurrency transactions, money laundering techniques, and emerging technologies, including artificial intelligence tools”.

The largest crypto figure belongs to Ilya Aleksandrovich Boykov, a Russian national. Treasury says that since 2024 he has exchanged and converted “an equivalent of $3.5 million in cryptocurrency transactions” for Alis, a North Korean IT company that OFAC sanctioned in March 2024.

Vitold Viktorovich Obertas, also Russian, is described as an intermediary for North Korean financial transactions, including for Amnokgang Technology Development Company, which was designated in March this year. Since January 2025, Treasury says, he has carried out “nearly $2 million worth of cryptocurrency conversions” and at least $1.25 million in other currency transactions for North Korean officials.

Two North Korean nationals lead teams of workers in Russia, according to Treasury. Kim Ki Hyok heads the Alis delegation, making sure workers meet their financial targets, and has transferred cryptocurrency worth nearly $500,000 since 2024. Kim Hyo Dong leads a separate team tied to the Chinyong Information Technology Cooperation Company and has moved more than $100,000 in assets since at least December 2023.

The FFTDC, which OFAC lists in Vladivostok, is a North Korean-controlled organisation that Treasury says has generated “several millions of dollars” since at least 2024. Its workers “employ Super Intelligence (SI) tools”, the release says. Six of them, Kim Kyong Ju, Ri Thae Chol, So Hyon Jin (listed by OFAC as SO, Hyong Jin), Han Yu Song, Kim Sung Gwan and Hyon Se Il, are said to have generated more than $750,000 since 2025.

What the sanctions mean in practice

Any property of the designated people in the US, or held by US persons, is now blocked and must be reported to OFAC, as is any entity they own 50% or more of. US persons are generally barred from dealing with them.

Treasury also warns that “financial institutions and other persons may risk exposure to sanctions” for certain dealings with those designated. The SDN list update marks every new entry with secondary sanctions risk under the North Korea Sanctions Regulations, which matters for non-US banks and exchanges as well as American ones.

“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” said Treasury Secretary Scott Bessent.

Why wallet addresses put exchanges in the front line

For crypto platforms, the most practical part of this action is in the list entries rather than the press release. The entries for Boykov, Kim Ki Hyok and Obertas include Ethereum and Tron addresses, and at least one Ethereum address appears on both Boykov’s and Obertas’s entries. Exchanges, wallet providers and payment firms that screen against the list should load those addresses now and look back for past transfers, because OFAC can impose civil penalties on a strict liability basis, meaning a firm can be fined even if it did not know. Networking company Extreme Networks agreed this week to pay OFAC $1.53 million over Russia-related sales, a reminder that enforcement reaches beyond banks.

The bigger exposure may sit with employers. The money starts as salaries paid to remote contractors who appear legitimate, so a company can end up funding a sanctioned network through its payroll. Treasury points firms to earlier advisories from the State, Treasury and Justice departments and the FBI on spotting these workers. Basic checks still matter: verify identity documents, confirm where staff actually work and watch for unusual remote-access tools on company laptops.

Sanctions on their own are unlikely to end the schemes. Treasury describes this as building on a March 2026 action against a different network, and the people named are in Russia and North Korea, beyond the easy reach of US authorities. The designations are allegations made through an administrative process, not criminal convictions.

Part of a wider crackdown

The action follows the Justice Department’s charges this month against 14 people over an alleged North Korean IT worker scheme and raids on Texas “laptop farms”. Hacking attributed to North Korea also continues: Kaspersky said last week that a campaign it attributes to the Lazarus group used post-quantum cryptography in its malware against at least three South Korean organisations. Traffic has flowed the other way as well, with Kentik saying DDoS attacks caused outages in North Korea that lasted about 32 hours.

Treasury says it will keep acting with allies and the Multilateral Sanctions Monitoring Team’s member states. Compliance teams should expect more names to be added to the list.