North Korea’s Crypto Cash-Out Network Takes a $5.5M Hit—and a Few Bad Review Coins

The U.S. Treasury Department’s Office of Foreign Assets Control sanctioned 10 individuals and one entity on October 28, 2026, for their roles in Democratic People’s Republic of Korea government-run IT worker schemes that defraud U.S. businesses and generate revenue for the country’s weapons programs. Two sanctioned Russian nationals, Vitold Viktorovich Obertas and Ilya Aleksandrovich Boykov, were identified as intermediaries who converted millions of dollars in cryptocurrency for North Korean officials and entities.

Treasury said Obertas has carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials. Boykov has exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company sanctioned in 2024. The listings include two Ethereum addresses and two Tron addresses for Boykov, and one Ethereum address and three Tron addresses for Obertas, with one Ethereum address appearing in both entries.

“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” Treasury Secretary Scott Bessent said. North Korea uses fake documents, stolen identities and invented personas to place IT workers at legitimate companies and take most of their wages, according to Treasury, which said the schemes have generated hundreds of millions of dollars for weapons of mass destruction and ballistic missile programs.

Blockchain analytics company Chainalysis traced part of the network, reporting that a wallet linked to a North Korean IT worker received regular stablecoin payments, converted them into Ether (ETH) and transferred the funds through consolidation addresses to Boykov. Boykov then sent the cryptocurrency to Garantex, a Russian exchange sanctioned by the United States since April 2022 whose web domains were seized in March 2025. Chainalysis also found that Obertas’ wallet received funds from Amnokgang, an IT worker firm sanctioned by OFAC on March 12, and made deposits at both mainstream and sanctioned exchanges.

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia, which deploys highly trained IT workers who use AI tools and “complex cryptocurrency transfers” to generate revenue. Six Russia-based North Korean IT workers have generated more than $750,000 for the center since 2025, while Kim Ki Hyok, who leads a Russia-based IT worker delegation, has transferred nearly $500,000 in crypto for his delegation since 2024. North Korean IT workers have increasingly targeted crypto projects; in April 2025, Google’s Threat Intelligence Group reported that such workers had embedded themselves in crypto projects in the UK, Germany, and Portugal.

In June 2025, the U.S. Department of Justice announced charges against four North Korean nationals over fraudulent IT employment and the theft of more than $900,000 from U.S. and Serbian crypto companies. Treasury’s action follows sanctions against a separate North Korean IT worker network in March, alongside designations by Australia and the European Union this month. OFAC warned that sanctions violations can bring civil or criminal penalties for U.S. and foreign persons, that it may impose civil penalties on a strict liability basis, and that U.S. persons holding designated persons’ property must block it and report it to OFAC. Chainalysis said transfers involving the designated addresses now trigger sanctions alerts for its screening clients, depending on their alert settings.