Treasury sanctioned 10 individuals and one entity over North Korean IT worker schemes that used crypto and intermediaries to fund weapons programs.

The U.S. Treasury Department’s Office of Foreign Assets Control sanctioned 10 individuals and one entity on Oct. 28, 2026, targeting a North Korean IT worker network that Treasury said generated revenue for the regime’s weapons programs by posing as legitimate remote workers and moving proceeds through cryptocurrency channels, according to Treasury and Chainalysis.

Chainalysis said the latest action targets Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas, along with DPRK nationals Kim Ki Hyok and Kim Hyo Dong, for roles in a broader scheme that placed North Korean IT workers at U.S. companies under false pretenses and converted earnings into cash. Treasury said the network is part of a long-running effort by North Korea to use overseas IT employment, intermediaries and digital assets to generate funds for the regime and its weapons programs.

According to Chainalysis, Obertas converted $2 million worth of cryptocurrency for DPRK officials since early 2025, while its on-chain analysis says the relationship extends back to early 2023. Chainalysis also said Boykov moved crypto linked to front companies used to cover DPRK IT workers, including Alis and Amnokang, to the sanctioned Russian exchange Garantex for cash-out. The report said Kim Ki Hyok and Kim Hyo Dong managed groups of IT workers based in Russia and collected the cryptocurrency income they generated.

Treasury’s action also designated the Russian-based First Financial and Technical Development Center, or FFTDC, which Chainalysis described as a DPRK-controlled entity that deploys overseas IT workers.

Source link