Treasury Sanctions Russians, North Koreans supporting DPRK IT Worker Fraud

What it is

On 28 October 2026 OFAC designated 10 individuals and one entity (First Financial and Technical Development Center, FFTDC) for supporting DPRK government-run IT worker schemes. Chainalysis adds on-chain tracing and says it has labeled the designated addresses and updated its screening. The page gives per-person roles and dollar figures that the catalog summary leaves out.

Who did what

• Vitold Obertas (Russia) converted nearly $2 million of crypto into fiat for DPRK officials since January 2025, plus at least $1.25 million in other currency transactions, per OFAC. Chainalysis says the on-chain relationship goes back to early 2023. Obertas's wallet received funds from Amnokgang and deposited to both mainstream and sanctioned exchanges.
• Ilya Boykov (Russia) supported Alis through crypto transactions, monitoring and logistics.
• Kim Ki Hyok led an Alis IT worker delegation and moved nearly $500,000 in crypto for the group.
• Kim Hyo Dong led a separate delegation under Chinyong, gave logistical help, and facilitated more than $100,000 in assets. Chinyong was designated by OFAC in 2023.
• FFTDC is a DPRK-controlled entity in Russia. Six of its Russia-based workers (Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, Hyon Se Il) generated more than $750,000 for it since 2025. All six are designated.

How the traced flow works

The example wallet belonged to a DPRK developer who worked on blockchain and DeFi code. It received bi-weekly stablecoin transfers from late 2022 to early 2023, a pattern resembling a salary. It swapped to ETH and sent funds to consolidation addresses Chainalysis tracks as sanctioned. Those went to Boykov, then to Garantex for cash-out.

What to do

• Screen counterparties and wallets against the new designations, including the six FFTDC workers and the two Russian converters.
• Treat sending or receiving exposure to the designated addresses as a sanctions event. Chainalysis KYT customers get alerts on that exposure according to their configured rules. The page does not list the addresses.
• Investigate suspicious activity involving overseas IT workers, crypto transfers and possible sanctions evasion.
• For hiring, the page says DPRK operatives use generative AI for tailored resumes, cover letters and interview preparation, and sometimes AI-generated photos and deepfake video on calls. It says interviews and document review alone are weakening defenses. It offers no specific hiring controls.

Caveats

• The page is a vendor post that ends with a product pitch, and the screening advice applies to Chainalysis customers.
• Figures for Obertas and the delegations are OFAC's claims. Only the wallet trace is Chainalysis's own work, and it covers a single instance.
• The page spells the entity both "Amnokang" and "Amnokgang". It says Amnokgang was designated in March, without giving the year.
• The $250 to $600 million annual revenue estimate is attributed to the UN Panel of Experts.