Treasury Sanctions Russians, North Koreans supporting DPRK IT Worker Fraud

Summary

• OFAC sanctioned Russian and DPRK nationals that targeted U.S. businesses with fraudulent IT workers, generating cryptocurrency proceeds to fund the North Korean regime and its weapons programs.
• Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas converted millions of dollars in cryptocurrency on behalf of IT agencies that facilitated the placement of DPRK IT workers at target companies under false pretenses, enabling them to earn income.
• DPRK nationals Kim Ki Hyok and Kim Hyo Dong managed groups of IT workers based in Russia, monitoring their work at victim companies and collecting the cryptocurrency income they generated.

On October 28, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity for their roles in North Korean government-run IT worker schemes that generate hundreds of millions in revenue for DPRK’s weapons programs.

The action is the latest strike against a sprawling network of state sponsored North Korean agents who secretly seek employment in legitimate businesses, earn income, and pass that income along to fund the North Korean regime. This network has been growing in scope for years, posing a greater risk to corporations duped into hiring the agents, as well as providing Pyongyang with a steady flow of cash. In this instance, the DPRK workers and their facilitators leveraged Russian nationals to convert the crypto into cash.

North Korean IT worker operations now span dozens of countries and generate an estimated $250 to $600 million in annual revenue for the DPRK regime, according to the United Nations panel of Experts. The threat has drawn a coordinated response from U.S. authorities: In May 2022, the FBI, State Department, and Treasury issued a joint advisory detailing how DPRK IT workers use VPNs, stolen identities, and proxy infrastructure to pass themselves off as non-North Korean freelancers or applicants.

Since then, the U.S. Department of Justice has brought indictments against U.S.-based facilitators who operated laptop farms, forwarding equipment that helped DPRK IT workers fake a domestic presence during their employment at American companies. Today’s OFAC action targets the financial side of that same pipeline, the individuals and entities that convert the workers’ crypto earnings into usable funds for Pyongyang.

The latest action targets a handful of individuals who helped that network convert their crypto into cash. Russians Vitold Viktorovich Obertas and Ilya Aleksandrovich Boykov converted millions of dollars for front companies that provided a cover for DPRK IT workers, including Alis and Amnokang, both of which have been previously sanctioned. Our research into the Russians finds their relationships to these illicit networks stretches back years.

The action also targets two DPRK nationals, Kim Ki Hyok and Kim Hyo Dong, who directly managed DPRK IT workers based in Russia. Both report to an umbrella company called Chinyong Information Technology Cooperation Company that OFAC designated in 2023 for its role in DPRK IT worker schemes. Our past research examines how groups like Chinyong launder crypto for the regime.

Sanctioned actors facilitated crypto transactions for Chinyong, a North Korean state-run IT worker front company

Since early 2025, Obertas has converted $2 million worth of cryptocurrency for DPRK officials, according to OFAC. But our research into his on-chain activity finds the relationship stretches back to early 2023.

The below Reactor graph showcases the flow of funds that directly link crypto generated by DPRK IT workers to Obertas. On the left side is a DPRK worker who built code for blockchains and DeFi protocols, according to our research. The wallet’s inbound transaction history resembles that of a salaried worker: it received bi-weekly transfers of stablecoins for a period of months from late 2022 to early 2023.

The IT worker wallet converted its stablecoins to ETH and passed it along to consolidation addresses that we track as sanctioned entities. From there the funds flow to Boykov, who sent the crypto along to Garantex, a now-sanctioned Russian exchange, for cashout. This on-chain relationship illustrates one instance of a financial fraud chain that adds up to millions of dollars.

Russian national Vitold Viktorovich Obertas (Obertas) was also sanctioned for serving as an intermediary for illicit DPRK financial transactions, including those involving Amnokgang Technology Development Company (Amnokgang), which was itself designated in March for managing DPRK IT worker delegations.

As the below Reactor chart shows, Obertas’ wallet received funds from Amnokgang. It also made deposits into accounts at both mainstream and sanctioned exchanges. Obertas has allegedly converted nearly $2 million in cryptocurrency into fiat for DPRK officials, according to OFAC.

OFAC also designated FFTDC, a DPRK-controlled entity operating in Russia that deploys overseas IT workers

Another DPRK-controlled entity linked to today’s designations is the Russian-based First Financial and Technical Development Center (FFTDC), which has deployed IT workers who generate millions of dollars for North Korea. FFTDC was sanctioned today.

These workers use AI tools and sophisticated money laundering techniques, including complex cryptocurrency transfers, to facilitate revenue generation. Since 2025, six Russia-based DPRK IT workers — Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il — have collectively generated more than $750,000 for FFTDC. All six workers have been sanctioned.

The use of AI marks a meaningful evolution in the IT worker threat. DPRK operatives have been observed using generative AI to fabricate resumes tailored to specific job postings, draft convincing cover letters, and prepare and conduct technical interviews. In some cases, workers have used AI-generated profile photos and deepfake video during hiring calls to conceal their identities. These tools lower the bar for less-skilled operatives to pass corporate screening processes, expanding the pool of workers the regime can deploy and making detection more difficult for employers who rely on interviews and document review as their primary safeguards.

Pattern of DPRK cryptocurrency exploitation

Today’s action is part of the Treasury’s sustained effort to counter North Korea’s abuse of cryptocurrency and digital assets for sanctions evasion. The DPRK has increasingly turned to cryptocurrency-related schemes to generate revenue, including IT worker fraud, state-sponsored cyber heists, and ransomware attacks demanding cryptocurrency payments. Chainalysis research has documented the DPRK’s growing sophistication in cryptocurrency theft and laundering, with North Korean hackers responsible for some of the largest cryptocurrency heists on record.

We have labeled the designated cryptocurrency addresses in our product suite and have updated our screening solutions to include all designated individuals and entities from today’s action. Sending and receiving exposure to these addresses will trigger sanctions alerts for KYT customers, per their configured alert rules.

If you’d like to learn more about how Chainalysis products can help protect your organization from sanctions risk and detect DPRK-related activity, request a demo.

FAQ

What did OFAC announce on October 28, 2026?

OFAC sanctioned 10 individuals and one entity for supporting North Korean government-run IT worker schemes that defraud U.S. businesses and generate revenue for the DPRK’s unlawful weapons programs.

How do North Korean IT worker schemes operate?

DPRK IT workers use fraudulent documents, stolen identities, and fabricated personas to obtain jobs at legitimate companies. The regime appropriates most of their earnings, while workers may also exploit corporate network access to steal sensitive data, deploy malware, and compromise business systems.

How are cryptocurrency and financial intermediaries involved?

DPRK-linked networks use cryptocurrency transactions, conversions, and money laundering techniques to move illicit proceeds. OFAC designated financial facilitators, including Russian national Vitold Viktorovich Obertas, who conducted nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for DPRK officials since January 2025.

What role did Boykov, Kim Ki Hyok, and Kim Hyo Dong play?

Russian national Ilya Aleksandrovich Boykov supported Alis through cryptocurrency transactions, monitoring, and logistical assistance. DPRK national Kim Ki Hyok led an Alis IT worker delegation and transferred nearly $500,000 in cryptocurrency for the group. Kim Hyo Dong led a separate Chinyong-subordinate delegation, provided logistical assistance, engaged in sanctions evasion, and facilitated more than $100,000 in financial assets.

What is FFTDC, and why was it sanctioned?

The First Financial and Technical Development Center (FFTDC) is a DPRK-controlled entity located in Russia that deploys North Korean IT workers to generate revenue for the regime. OFAC sanctioned FFTDC and six DPRK IT workers who collectively generated more than $750,000 on its behalf since 2025.

How can businesses detect DPRK-related sanctions exposure?

Businesses can screen designated individuals, entities, and cryptocurrency addresses; monitor transaction exposure; and investigate suspicious activity involving overseas IT workers, cryptocurrency transfers, and potential sanctions evasion. Chainalysis customers can use updated screening and KYT alerts to identify exposure to addresses designated in this action.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.