Treasury sanctions 10 over North Korean crypto fraud schemes

The US Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity on October 28 for their roles in North Korean IT worker fraud schemes. The action targets financial intermediaries and workers based in Russia and North Korea who support operations that use fake identities to secure remote jobs at legitimate firms.

Targets of the Sanctions

The designation includes two Russian nationals, Ilya Boykov and Vitold Obertas, who allegedly converted millions in cryptocurrency for North Korea. Treasury stated that Boykov exchanged and converted approximately $3.5 million in crypto for Alis, a company previously sanctioned in March 2024 due to its links to North Korean IT workers. Obertas is alleged to have handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.

OFAC also designated the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia. Six workers sanctioned alongside this center generated over $750,000 for the group since 2025, according to Treasury. The designation notice lists eight crypto addresses on Ethereum and Tron tied to the sanctioned parties.

Operational Methods and AI Use

North Korean operatives use stolen identities, forged documents, and invented personas to land remote jobs at legitimate companies. The regime retains most of the wages from these positions, converting routine software work into state revenue. Treasury stated that these workers have used corporate network access to plant malware and steal sensitive and proprietary data.

Chainalysis reported that operatives have utilized generative AI to write resumes and cover letters and to prepare for technical interviews. In some instances, AI-generated profile photos and deepfake video were used to conceal identities during hiring calls. The firm traced cryptocurrency earned by a North Korean IT worker to Boykov, who subsequently sent the funds to Garantex, a now-sanctioned Russian exchange, to cash out.

Context of Recent Actions

The October 28 sanctions follow a previous round in March, in which Treasury targeted six people and two companies accused of laundering $800 million in crypto for North Korea. The current action focuses on the middlemen who convert North Korean earnings into usable cash, rather than solely targeting the workers themselves.