Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto

The U.S. Treasury Department has sanctioned 10 individuals and one entity for their roles in North Korean IT worker schemes that defraud U.S. businesses and generate revenue for the country's weapons programs, the department said on Wednesday.

North Korea uses fake documents, stolen identities and invented personas to place IT workers at legitimate companies, then takes most of their wages, generating hundreds of millions of dollars for its weapons of mass destruction and ballistic missile programs, according to Treasury. The networks have used "sophisticated cryptocurrency transactions," money laundering and artificial intelligence tools to move millions of dollars to the regime, it said.

"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," said Treasury Secretary Scott Bessent.

Two Russian nationals are among those sanctioned. Vitold Obertas, a Russian intermediary for North Korean financial transactions, has carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials, Treasury said. Ilya Boykov has exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company sanctioned in 2024.

The sanctions listings include two Ethereum and two Tron addresses for Boykov, and one Ethereum and three Tron addresses for Obertas. One Ethereum address appears on both men's entries.

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia, that it said deploys highly trained IT workers who use AI tools and "complex cryptocurrency transfers" to generate revenue. Six Russia-based North Korean IT workers have generated more than $750,000 for the center since 2025, according to Treasury.

Two North Korean nationals who lead Russia-based IT worker delegations were also sanctioned. One of them, Kim Ki Hyok, has transferred nearly $500,000 in crypto for his delegation since 2024, Treasury said.

The action builds on sanctions against a separate North Korean IT worker network in March, and Australia and the European Union have made their own designations this month, according to Treasury.

North Korea's crypto operations

North Korean IT workers have increasingly targeted crypto projects. In April 2025, Google's Threat Intelligence Group reported that such workers had embedded themselves in crypto projects in the UK, Germany, Portugal and Serbia, including Solana smart contract development, with some operating under as many as 12 fake identities at once.

North Korean hackers have also used long-running deception campaigns against crypto firms. In April, Solana-based exchange Drift Protocol said the attack that drained about $285 million from its platform was a six-month operation by a North Korean state-affiliated group, whose intermediaries met Drift contributors in person and posed as a quantitative trading firm, Decrypt reported.