Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto

What it is

On 28 October 2026 (a Wednesday), Treasury's Office of Foreign Assets Control sanctioned 10 individuals and one entity over North Korean IT worker schemes. Treasury says the schemes use fake documents, stolen identities and invented personas to place workers at legitimate companies, then take most of their wages. Treasury says this generates hundreds of millions of dollars for the regime's weapons programs.

How it works

Treasury says the networks use cryptocurrency transactions, money laundering and AI tools to move money to the regime. The page names these facilitators:

• Ilya Boykov, a Russian national, has exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company sanctioned in 2024.
• Vitold Obertas, a Russian national, has done nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials.
• The First Financial and Technical Development Center, a North Korean-controlled entity in Vladivostok, deploys IT workers who use AI tools and "complex cryptocurrency transfers". Six Russia-based workers have generated more than $750,000 for it since 2025.
• Two North Korean nationals who lead Russia-based IT worker delegations were also listed. One of them, Kim Ki Hyok, has transferred nearly $500,000 in crypto since 2024.

What to do

The listings carry on-chain identifiers that compliance teams can screen against. Boykov has two Ethereum and two Tron addresses. Obertas has one Ethereum and three Tron addresses. One Ethereum address appears on both entries, which links the two men. The article does not print the addresses, so take them from the OFAC listings directly.

Exchanges, custodians and payment firms can use the addresses for sanctions screening and for looking back at past flows. Employers and crypto projects face the hiring-side risk. Google's Threat Intelligence Group reported in April 2025 that North Korean IT workers had embedded themselves in crypto projects in the UK, Germany, Portugal and Serbia, including Solana smart contract development, with some using as many as 12 fake identities at once.

Caveats

The figures are Treasury's own claims, as reported by Decrypt. The article gives no hiring or detection guidance. It says the action follows separate North Korean IT worker sanctions in March, and that Australia and the European Union made their own designations in October 2026. It also notes that Drift Protocol attributed a roughly $285 million drain in April to a North Korean state-affiliated group, though that is a separate incident.