On October 28, 2026, the U.S. Treasury's Office of Foreign Assets Control sanctioned 10 individuals and one entity linked to North Korean IT worker schemes that generate up to $600 million annually for weapons programs. Russian intermediaries Ilya Boykov and Vitold Obertas allegedly converted millions in crypto salaries into spendable cash via exchanges like Garantex. The operation relies on AI tools and deepfakes to infiltrate remote corporate roles.
US Treasury actions and sanctions terms
- ▪The U.S. Treasury published several specific Ethereum and Tron wallet addresses associated with Ilya Boykov, Vitold Obertas, and Kim Ki Hyok to assist exchanges in detecting exposure
- ▪The U.S. Treasury's October 28, 2026 sanctions targeted designated entities and individuals by blocking their property under U.S. jurisdiction and prohibiting U.S. persons from dealing with them
- ▪The U.S. Treasury's Office of Foreign Assets Control sanctioned 10 individuals and one entity tied to North Korean undercover IT worker schemes
Crypto facilitators and entities sanctioned by US
- ▪The U.S. Treasury sanctioned the Vladivostok-based First Financial and Technical Development Center, where six North Korean IT workers generated over $750,000 since 2025
- ▪Russian national Vitold Viktorovich Obertas converted nearly $2 million in cryptocurrency and handled over $1.25 million in other currency transactions for North Korean officials since January 2025
- ▪North Korean manager Kim Ki Hyok transferred nearly $500,000 in cryptocurrency for his Russia-based IT worker delegation since 2024
- ▪Russian national Ilya Aleksandrovich Boykov processed approximately $3.5 million in cryptocurrency transactions since 2024 for the sanctioned North Korean company Limited Liability Company Alis
Blockchain analysis of illicit crypto flows
- ▪Vitold Obertas deposited cryptocurrency into both sanctioned exchanges and mainstream cryptocurrency exchanges, according to Chainalysis blockchain tracking
- ▪Chainalysis traced cryptocurrency earnings from a North Korean developer to Ilya Boykov, who forwarded the funds to the sanctioned Russian exchange Garantex for potential cash conversion
- ▪An undercover North Korean developer collected stablecoin salary payments biweekly between late 2022 and early 2023 before converting them to Ethereum and routing them to consolidation addresses
- ▪Chainalysis traced cryptocurrency transfers from Amnokgang Technology Development Company, a sanctioned North Korean IT delegation manager, directly to wallets linked to Vitold Obertas
Scale and purpose of North Korean IT schemes
- ▪North Korean IT worker schemes generate an estimated $250 million to $600 million annually, according to a United Nations Panel of Experts estimate cited by Chainalysis
- ▪Treasury Secretary Scott Bessent stated that North Korean operatives exploit U.S. companies, weaponize sensitive data, and extort businesses for substantial payments
- ▪Most earnings collected by undercover North Korean IT workers are appropriated by North Korean authorities to fund the country's weapons of mass destruction and ballistic missile programs
Tactics and infrastructure used by North Korean operatives
- ▪North Korean operatives use generative AI tools, stolen identities, fabricated employment histories, and deepfake interview videos to secure remote employment at legitimate companies
- ▪Disguised North Korean IT workers who gain corporate access at target companies deploy malware, steal proprietary information, and extract sensitive internal data
- ▪A Justice Department operation in October 2026 shut down dozens of Texas laptop farms that hosted computers enabling overseas workers to appear as if logging in inside the U.S.
North Korean infiltration of Solana ecosystem
- ▪Google's Threat Intelligence Group reported in April 2025 that North Korean IT workers embedded themselves in European crypto projects, including Solana smart contract development
- ▪In April 2026, Solana-based exchange Drift Protocol reported that a six-month North Korean state-affiliated infiltration operation led to an attack draining approximately $285 million
Story comments
Loading comments…