Treasury Sanctions 11 Over North Korean Crypto IT Worker Scheme

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity on Wednesday for their roles in Democratic People's Republic of Korea (DPRK) government-run IT worker schemes, according to Decrypt. Treasury said the networks defraud U.S. businesses and generate revenue for North Korea's weapons of mass destruction and ballistic missile programs, using what it described as "sophisticated cryptocurrency transactions," money laundering and artificial intelligence tools to move millions of dollars to the regime.

The Scheme: Fake Identities Embedded at Real Companies

According to Treasury, as reported by Decrypt, North Korea places IT workers at legitimate companies using fake documents, stolen identities and invented personas, then takes most of their wages. This has generated hundreds of millions of dollars for the country's weapons programs, Treasury said. Treasury Secretary Scott Bessent said in a statement that "the North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments."

Russian Nationals at the Center of Crypto Conversions

Two Russian nationals feature prominently among those sanctioned. Vitold Obertas, described by Treasury as a Russian intermediary for North Korean financial transactions, has carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions, for North Korean officials, Treasury said per Decrypt's reporting. Ilya Boykov has exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT worker company that Treasury had already sanctioned in 2024.

The sanctions listings include two Ethereum and two Tron addresses tied to Boykov, and one Ethereum and three Tron addresses tied to Obertas. Notably, one Ethereum address appears on both men's sanctions entries, according to Decrypt's account of the Treasury action.

A Vladivostok-Based Front and North Korean Delegation Leaders

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, Russia. Treasury said the center deploys highly trained IT workers who use AI tools and "complex cryptocurrency transfers" to generate revenue. Six Russia-based North Korean IT workers have generated more than $750,000 for the center since 2025, Treasury said.

Two North Korean nationals who lead Russia-based IT worker delegations were also named in the action. One of them, Kim Ki Hyok, has transferred nearly $500,000 in crypto for his delegation since 2024, according to Treasury's findings as relayed by Decrypt.

Part of a Broader, Coordinated Crackdown

Treasury said the action builds on sanctions against a separate North Korean IT worker network imposed in March, and noted that Australia and the European Union have made their own designations against similar networks this month. Decrypt noted that in April 2025, Google's Threat Intelligence Group reported that North Korean IT workers had embedded themselves in crypto projects across the UK, Germany, Portugal and Serbia, including Solana smart contract development, with some operatives running as many as 12 fake identities simultaneously.

North Korean hackers have also been linked to direct exploitation of crypto platforms beyond the IT worker infiltration model. Decrypt reported that Solana-based exchange Drift Protocol said the attack that drained about $285 million from its platform was a six-month operation carried out by a North Korean state-affiliated group, whose intermediaries met Drift contributors in person while posing as a quantitative trading firm.

CoinHours Analysis: Market Backdrop on the Two Chains Named in the Sanctions

CoinHours analysis: The sanctions listings specifically named Ethereum and Tron wallet addresses as conduits for the alleged laundering, making the current state of those two networks' markets a relevant, if non-causal, backdrop. According to CoinHours' saved Binance ticker data timestamped 2026-10-29T11:05:07.103+00:00, Ethereum traded at $2,325.59, down 1.73% over 24 hours, down 3.29% over seven days and down 14.43% over 30 days, with 24-hour volume of roughly $484.9 million recorded on that feed. Tron, meanwhile, traded at $0.3315, down a modest 0.271% over 24 hours but up 0.27% over seven days and down only 1.26% over 30 days, per the same Binance-sourced snapshot — a comparatively steadier profile than Ethereum's sharper monthly decline.

CoinHours' own CoinMarketCap-sourced top-coins dataset, timestamped 2026-10-29T11:05:17.114+00:00, corroborates this divergence: Ethereum's market capitalization stood at approximately $283.77 billion against Tron's roughly $31.46 billion, with Ethereum's 30-day change of -14.43% far steeper than Tron's -1.26%. This does not indicate any market reaction to the Treasury action — the sanctions involve addresses on these networks rather than network-level events — but it shows Tron has been more resilient on a 30-day basis than Ethereum even as both assets registered negative 24-hour moves.

CoinHours' saved Ethereum short-interval chart data, timestamped 2026-10-29T10:05:13.797+00:00, recorded a first observation of $2,406.46 and a last observation of $2,321.06 across 169 data points, reflecting the asset's recent downward drift independent of this sanctions news. The broader market mood, per CoinHours' saved Fear & Greed Index reading timestamped 2026-10-29T11:05:17.975+00:00, sat at a value of 51, classified as "Neutral" by Alternative.me — suggesting the market overall was neither in a risk-on nor risk-off posture at the time this enforcement action was reported. CoinHours' saved global market data, timestamped 2026-10-29T11:05:05.34+00:00, showed total crypto market capitalization at approximately $2.68 trillion with Bitcoin dominance at 60.04% and Ethereum dominance at 10.58%, alongside a 24-hour global market cap change of -1.41%.

CoinHours analysis: None of this market data implies that the sanctioned addresses materially influenced either asset's price action; the amounts described by Treasury, while significant for enforcement purposes, are small relative to the daily volumes recorded across both networks in CoinHours' datasets.

What the Action Signals Going Forward

The Wednesday sanctions add to a growing list of enforcement actions targeting North Korea's use of crypto and fraudulent IT employment to fund its weapons programs. With Australia and the EU making their own designations this month, according to Treasury's statement as cited by Decrypt, the coordinated international pressure suggests regulators are increasingly treating crypto-enabled IT worker fraud as a distinct and escalating threat vector, separate from more direct exchange hacks like the Drift Protocol incident. For crypto businesses and hiring managers, the inclusion of specific wallet addresses in the sanctions listings gives compliance teams concrete on-chain identifiers to screen against, a practical tool that extends beyond the symbolic value of the designations themselves.