The U.S. Department of the Treasury’s Office of Foreign Assets Control on October 28 designated 10 individuals and one entity for facilitating North Korean government-run information technology worker schemes. These operations place operatives at legitimate companies under false identities, divert most of their earnings to the regime, and rely on sophisticated cryptocurrency transactions to move the funds.

According to Treasury, the schemes generate hundreds of millions of dollars that support North Korea’s weapons of mass destruction and ballistic missile programs. Workers use fraudulent documents, stolen personal data, and fabricated personas to obtain remote IT positions, including at U.S. firms. In some cases they have used artificial intelligence tools to create resumes, alter photographs, and generate deepfake video for interviews. Once inside corporate networks, certain workers have installed malware and stolen sensitive data.

Russian Intermediaries and Crypto Conversions

Two Russian nationals stand at the center of the financial facilitation. Vitold Viktorovich Obertas served as an intermediary for illicit North Korean transactions, including those linked to the previously sanctioned Amnokgang Technology Development Company. Since January 2025 he conducted nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials.

Ilya Aleksandrovich Boykov supported Limited Liability Company Alis, a North Korean IT worker company sanctioned in 2024, by exchanging and converting the equivalent of $3.5 million in cryptocurrency beginning in 2024. He also monitored transactions and provided logistical support. Treasury published multiple Ethereum and Tron wallet addresses associated with both men; one Ethereum address appears on both listings.

North Korean Delegation Leaders and the Russia-Based Center

Two North Korean nationals who oversee worker groups in Russia were also designated. Kim Ki Hyok leads a Russia-based Alis delegation, monitors workers, and ensures they meet revenue targets. Since 2024 he transferred nearly $500,000 in cryptocurrency for the group. Kim Hyo Dong leads a separate Russia-based delegation subordinate to the earlier-sanctioned Chinyong Information Technology Cooperation Company. Since at least December 2023 he has provided logistical assistance, engaged in sanctions-evasion activity, and facilitated transfers exceeding $100,000.

The sole entity named is the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia. It deploys highly trained IT workers who employ advanced tools and complex cryptocurrency transfers. Six Russia-based North Korean workers affiliated with the center—Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il—collectively generated more than $750,000 for the organization since 2025.

Broader Context and Enforcement Measures

The designations expand on a March 12, 2026 action against a separate North Korean IT worker network. Australia and the European Union issued related sanctions this month. Treasury coordinated the effort with the Multilateral Sanctions Monitoring Team and other international partners.

All property and interests in property of the designated parties that are in the United States or under the control of U.S. persons are blocked and must be reported to OFAC. Entities owned 50 percent or more by blocked persons are also blocked. U.S. persons are generally prohibited from dealing with the sanctioned parties absent authorization. Violations can trigger civil or criminal penalties, and OFAC may impose civil penalties on a strict-liability basis.

Treasury, together with the Departments of State and Justice and the FBI, has issued advisories urging companies that hire remote IT contractors to verify identities thoroughly, scrutinize payment destinations, and monitor unusual network-access requests.