Key Highlights
The US Treasury sanctioned 10 individuals and one entity on October 28 over alleged North Korean IT worker fraud and financial networks.
Russian intermediaries allegedly handled nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials.
A separate facilitator allegedly exchanged or converted $3.5 million in cryptocurrency while supporting a North Korean-linked IT company.
The US Department of the Treasury has sanctioned 10 individuals and one entity over their alleged roles in North Korean IT worker schemes that generated revenue for the government and moved funds through international financial networks.
In an October 28 announcement, the Treasury’s Office of Foreign Assets Control (OFAC) said the networks used cryptocurrency transactions, money laundering techniques and fraudulent identities to conceal the workers’ links to North Korea.
The Treasury said the schemes generated revenue for North Korea’s weapons of mass destruction and ballistic missile programs. The designations target financial intermediaries, managers of overseas IT worker groups and workers operating from Russia.
Regulations & Policies
US Treasury Sanctions 10 Over North Korean IT Worker Crypto Networks
OFAC targeted 10 individuals and one entity over alleged North Korean IT worker schemes involving cryptocurrency transfers, money laundering and revenue for weapons programs.
U.S. Department of the Treasury seal, physical cryptocurrency coins, and a document stamped "SANCTIONS" overlaid with a North Korean flag and shadowed hacker.
Key Highlights
The US Treasury sanctioned 10 individuals and one entity on October 28 over alleged North Korean IT worker fraud and financial networks.
Russian intermediaries allegedly handled nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials.
A separate facilitator allegedly exchanged or converted $3.5 million in cryptocurrency while supporting a North Korean-linked IT company.
The US Department of the Treasury has sanctioned 10 individuals and one entity over their alleged roles in North Korean IT worker schemes that generated revenue for the government and moved funds through international financial networks.
In an October 28 announcement, the Treasury’s Office of Foreign Assets Control (OFAC) said the networks used cryptocurrency transactions, money laundering techniques and fraudulent identities to conceal the workers’ links to North Korea.
The Treasury said the schemes generated revenue for North Korea’s weapons of mass destruction and ballistic missile programs. The designations target financial intermediaries, managers of overseas IT worker groups and workers operating from Russia.
Russian intermediaries handled millions in crypto transactions
The Treasury identified Russian national Vitold Viktorovich Obertas as an intermediary for North Korean financial transactions, including those involving Amnokgang Technology Development Company, which OFAC sanctioned in March 2026.
Since January 2025, Obertas allegedly conducted nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials.
OFAC also sanctioned Russian national Ilya Aleksandrovich Boykov over his alleged support for Alis, a North Korean-linked IT company. The Treasury said Boykov had exchanged or converted the equivalent of $3.5 million in cryptocurrency since 2024, monitored transactions and provided logistical support.
The figures describe separate activities and are not a combined transaction total.
North Korean IT worker managers transferred crypto
The sanctions also target two North Korean nationals who allegedly managed separate IT worker delegations based in Russia.
Kim Ki Hyok leads a delegation associated with Alis, where his responsibilities reportedly include monitoring workers and ensuring they meet financial targets. According to the Treasury, he transferred nearly $500,000 in cryptocurrency for the group in 2024.
Kim Hyo Dong leads a separate delegation linked to Chinyong Information Technology Cooperation Company. OFAC said he provided logistical assistance, participated in sanctions-evasion efforts and facilitated transfers exceeding $100,000 since at least December 2023.
OFAC designated both individuals over their alleged financial or other support for companies previously sanctioned for links to North Korean IT operations.
Six workers allegedly generated more than $750,000
OFAC also sanctioned the First Financial and Technical Development Center (FFTDC), a North Korean-controlled entity based in Russia, along with six North Korean IT workers associated with it.
The agency identified the workers as Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il. It said they collectively generated more than $750,000 for FFTDC from 2025.
According to the Treasury, the group used software tools and complex cryptocurrency transfers to support its revenue-generation activities. OFAC designated FFTDC over its alleged role in deploying workers abroad to generate revenue for North Korea. The six workers were sanctioned for their alleged involvement in the operation.
Treasury Secretary Bessent comments on the sanctions
In an October 28 post on X, Treasury Secretary Scott Bessent shared the announcement and said North Korean IT operatives had used fraudulent activities to target US companies.
The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments. Under President Trump’s leadership, Treasury will…
— Treasury Secretary Scott Bessent (@SecScottBessent) October 28, 2026
He added that the Treasury would continue using available tools to protect US businesses and hold those responsible accountable.
Treasury says workers used false identities to obtain jobs
The Treasury said North Korean IT workers use false documents, stolen identities and fabricated online personas to secure employment with legitimate businesses in the United States and other countries.
According to the agency, the North Korean government appropriates most of the wages earned by these workers, generating revenue for its weapons programs.
The Treasury also warned that some workers exploit access to corporate networks to deploy malware, extract sensitive information and steal proprietary data, potentially exposing employers to financial and cybersecurity risks.
In an October 28 post on X, Alex Raufoglu, a senior Washington correspondent for Radio Free Europe/Radio Liberty (RFE/RL), highlighted the Treasury’s sanctions against 10 individuals and one entity over alleged North Korean IT worker operations.
NEW!! U.S. sanctions 10 individuals and an entity accused of helping North Korea run fraudulent IT worker schemes targeting American businesses and funneling millions into Pyongyang’s weapons programs
The networks used crypto transactions and money laundering to move illicit…
— Alex Raufoglu (@ralexdc) October 28, 2026
Earlier Treasury sanctions targeted Iran-linked crypto networks
The North Korea designations follow earlier US actions targeting cryptocurrency networks that the Treasury said were connected to Iran’s financial system and the Islamic Revolutionary Guard Corps (IRGC).
On August 7, 2026, OFAC sanctioned Shelbit Exchange, Iran-based Aban Tether and Iranian expatriate Siavash Kayvanpour over alleged financial activity linked to the IRGC.
According to the report, OFAC said Shelbit had received more than $1 million in digital assets from IRGC-linked wallets and sent more than $2 million back to addresses associated with the group. Aban Tether was accused of processing transactions tied to previously sanctioned Iranian platforms.
The August action focused on exchanges and intermediaries allegedly moving funds linked to Iranian networks, while the October designations target financial facilitators, IT worker managers and workers accused of generating revenue for North Korea.
What the sanctions mean for financial institutions
Under OFAC rules, property and interests in property belonging to designated persons that are in the United States or held or controlled by US persons must generally be blocked and reported to the agency.
Transactions by US persons, or transactions within or transiting the United States, that involve blocked property are generally prohibited unless an exemption applies or OFAC issues a licence. Businesses owned directly or indirectly at least 50% by one or more blocked persons are also generally subject to blocking requirements.
The Treasury warned that sanctions violations may result in civil or criminal penalties. Non-US persons may also face exposure for certain conduct that causes US persons to violate sanctions or that evades US restrictions.
The Treasury did not disclose a combined value for all financial activity associated with the networks targeted in the October 28 action.
Also Read: US Banking Group Opposes OCC’s Approval of Ripple Trust Bank