The United States has sanctioned a cryptocurrency cash-out network accused of turning the earnings of undercover North Korean IT workers into funding for weapons programs, naming 10 individuals and one entity in a Treasury action announced on 28 October.
Among those designated are Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas. According to the Treasury, Boykov processed the equivalent of $3.5 million in cryptocurrency transactions since 2024 while supporting Limited Liability Company Alis, an organisation associated with North Korean IT workers, and allegedly monitored transfers and provided logistical assistance. Obertas allegedly converted nearly $2 million in cryptocurrency and handled at least $1.25 million in other currency transactions for North Korean officials since January 2025.
North Korean operatives have increasingly used stolen identities, fraudulent documents and fabricated employment histories to secure remote jobs at legitimate businesses, including cryptocurrency companies. Chainalysis, which conducted a separate investigation, said some workers used generative AI to create convincing resumes, generate realistic profile photos and produce deepfake videos during recruitment interviews. The Treasury warned that IT workers have exploited corporate access to deploy malware, steal proprietary information and extract sensitive data.
Chainalysis identified a wallet belonging to a suspected North Korean developer who contributed code to blockchain and DeFi projects while receiving stablecoin transfers approximately every two weeks between late 2022 and early 2023. The wallet converted the stablecoins to Ethereum and moved funds to consolidation addresses linked to sanctioned entities; Chainalysis traced the funds from there to Russian national Boykov, who forwarded cryptocurrency to Garantex, a sanctioned Russian exchange, for potential cash conversion. The firm said the relationships dated back several years, indicating parts of the network operated well before the transactions highlighted in the latest Treasury action. Chainalysis also traced funds from Amnokgang Technology Development Company, a previously sanctioned organisation managing North Korean IT worker delegations, to Obertas-linked wallets, which deposited into mainstream and sanctioned exchanges.
The Treasury also identified the First Financial and Technical Development Center, a North Korean-controlled organisation operating in Russia, as part of the network. Six workers associated with the organisation allegedly generated more than $750,000 since 2025. The Office of Foreign Assets Control identified Ethereum and Tron addresses linked to Boykov and Obertas, along with an Ethereum address linked to North Korean national Kim Ki Hyok, giving exchanges additional identifiers for detecting exposure to the network. US persons are generally prohibited from dealing with the designated individuals or their blocked property without authorization.
Chainalysis cited a United Nations Panel of Experts estimate that North Korean IT worker schemes generated between $250 million and $600 million in annual revenue for the regime.
Analysis
Why This Matters
- The sanctions give cryptocurrency exchanges and other financial intermediaries new identifiers to detect and block funds flowing from the network.
- The case illustrates how earnings from legitimate remote jobs at blockchain companies can be laundered through Russian intermediaries into state weapons programs.
- Crypto firms that recruit developers remotely may be unknowingly admitting operatives with access to software repositories and sensitive infrastructure.
Background
North Korea has long been accused of sending IT workers abroad under false identities to earn foreign currency for the state. The Treasury action extends years of US sanctions against North Korean cyber operations and the financial channels that support them.
Key Perspectives
- US Treasury: says the network converts undercover IT workers' earnings into weapons funding and warns that workers have used corporate access to deploy malware and steal data.
- Chainalysis: traced regular crypto payments to a suspected North Korean developer, then through Russian intermediaries to sanctioned exchanges, and said parts of the network operated for years.
- United Nations Panel of Experts: estimates the IT worker schemes generate between $250 million and $600 million a year for North Korea.
What to Watch
- Whether exchanges and financial intermediaries act on the newly identified Ethereum and Tron addresses to block or freeze funds.
- Whether further designations follow against additional workers or organisations named in Chainalysis's tracing.
- Whether remote-hiring crypto companies tighten vetting in response to the AI-assisted identity fraud documented in the investigation.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe US sanctioned a network accused of turning undercover North Korean IT workers’ earnings into weapons funding.CryptoSlate: “US authorities sanctioned a crypto cash-out network accused of turning North Korean undercover IT workers' earnings into weapons funding.”
- SupportedThe Treasury action on 28 October designated 10 individuals and one entity.CryptoSlate: “The Oct. 28 Treasury action targets 10 individuals and one entity”
- SupportedTwo Russian nationals were accused of facilitating about $5.5 million in cryptocurrency transactions for North Korean operations over different periods.CryptoSlate: “including two Russian nationals accused of facilitating approximately $5.5 million in cryptocurrency transactions for North Korean operations over different periods.”
- SupportedBoykov processed the equivalent of $3.5 million in cryptocurrency transactions since 2024.CryptoSlate: “Boykov processed the equivalent of $3.5 million in cryptocurrency transactions since 2024 while supporting Limited Liability Company Alis”
- SupportedObertas allegedly converted nearly $2 million in cryptocurrency and handled at least $1.25 million in other-currency transactions for North Korean officials since January 2025.CryptoSlate: “Vitold Viktorovich Obertas, allegedly converted nearly $2 million in cryptocurrency and handled at least $1.25 million in other currency transactions for North Korean officials since January 2025.”
- SupportedChainalysis said some North Korean workers used generative AI to create resumes and profile photos and produce deepfake interview videos.CryptoSlate: “According to Chainalysis, some workers have also used generative AI to create convincing resumes , generate realistic profile photos, and produce deepfake videos during recruitment interviews.”
- SupportedThe Treasury warned that North Korean IT workers exploited corporate access to deploy malware, steal proprietary information and extract sensitive data.CryptoSlate: “Treasury warned that North Korean IT workers have exploited their corporate access to deploy malware, steal proprietary information, and extract sensitive data.”
- SupportedA wallet belonging to a suspected North Korean developer received stablecoin transfers about every two weeks between late 2022 and early 2023.CryptoSlate: “The firm identified a wallet belonging to the suspected North Korean developer that received stablecoin transfers approximately every two weeks between late 2022 and early 2023.”
- SupportedChainalysis traced funds from the developer’s wallet to Boykov, who forwarded cryptocurrency to Garantex for potential cash conversion.CryptoSlate: “From there, the firm's written analysis traced the funds to Russian national Ilya Aleksandrovich Boykov, who forwarded cryptocurrency to Garantex, a sanctioned Russian exchange, for potential cash conversion.”
- SupportedChainalysis traced funds from Amnokgang Technology Development Company to Obertas-linked wallets, which deposited cryptocurrency into mainstream and sanctioned exchanges.CryptoSlate: “Chainalysis separately traced funds from Amnokgang Technology Development Company, a previously sanctioned organization managing North Korean IT worker delegations, to Obertas-linked wallets. Those wallets also deposited cryptocurrency into mainstream and sanctioned exchanges”
- SupportedSix workers associated with the First Financial and Technical Development Center allegedly generated more than $750,000 since 2025.CryptoSlate: “Six workers associated with the organization allegedly generated more than $750,000 since 2025.”
- SupportedChainalysis cited a UN Panel of Experts estimate that North Korean IT worker schemes generated $250 million to $600 million in annual revenue for the regime.CryptoSlate: “Chainalysis cited a United Nations Panel of Experts estimate that North Korean IT worker schemes generated between $250 million and $600 million in annual revenue for the regime.”
