US Sanctions Crypto Facilitators in North Korean IT Worker Cash-Out Network
The US Treasury sanctioned 10 individuals and one entity tied to North Korean IT worker schemes, including two Russian nationals accused of converting crypto into cash. The designations target a network that the UN Panel of Experts estimates generates $250 million to $600 million annually for Pyongyang.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What the Treasury Action Covers
The US Treasury sanctioned 10 individuals and one entity for allegedly helping North Korean IT workers earn money through fraudulent employment at legitimate businesses and convert that income into cryptocurrency and fiat. The new Specially Designated Nationals entries identify eight distinct Ethereum and Tron addresses, one of which is listed under both Russian intermediaries.
The two Russian nationals named in the action are Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas. Per the Office of Foreign Assets Control, Obertas changed nearly $2 million worth of crypto into fiat for North Korean officials. The designations also cover North Korean nationals Kim Ki Hyok and Kim Hyo Dong, who managed IT workers based in Russia, and First Financial and Technical Development Center, a Russia-based entity.
How the Money Moved
Blockchain analytics firm Chainalysis traced one payment trail to a developer who contributed code to blockchain and DeFi projects. According to Chainalysis, that wallet received stablecoin payments every two weeks from late 2022 to early 2023, a pattern resembling a regular salary. The funds were converted into ETH, moved through consolidation wallets associated with sanctioned entities, and then forwarded to Boykov, who sent the cryptocurrency to Garantex, a Russian exchange later sanctioned by US authorities.
Obertas is accused of acting as a financial intermediary for North Korean officials, with his wallet receiving funds from Amnokgang Technology Development Company, a sanctioned organization involved in managing overseas IT worker delegations. Chainalysis said six North Korean workers associated with First Financial and Technical Development Center had generated more than $750,000 for that entity since 2025.
Scale of the Problem and Disputed Figures
The sources differ on the scale of the revenue at stake. CryptoPotato, citing the Treasury action, describes a network that generates hundreds of millions of dollars annually. The UN Panel of Experts estimates these operations generate $250 million to $600 million a year, a range that is wide and reflects estimation uncertainty rather than a measured total. Neither figure has been independently audited, and the Chainalysis trail covers only the wallets it could attribute.
Separate investigations have pointed to the same pattern. In April, blockchain investigator ZachXBT uncovered records linked to a North Korean fake-developer operation that generated more than $3.5 million in cryptocurrency. Security researcher Taylor Monahan has also claimed that North Korean-linked developers helped build prominent DeFi protocols, including SushiSwap and THORChain. Those claims are not addressed in the Treasury designations.
Detection Challenges
Chainalysis warned that generative AI is making recruitment fraud harder to detect. Operatives reportedly use AI-generated resumes, profile photos, and deepfake video during hiring calls to appear legitimate. The firm's warning reflects its own assessment, and the extent of AI use across these operations has not been quantified in the reporting.
Why It Matters
For Traders
Sanctioned addresses and exchange designations can trigger delisting or freezes, so monitor Garantex-linked flows and any exchange screening changes.
For Investors
Expanding sanctions enforcement on crypto cash-out channels signals tighter US scrutiny of offshore exchanges that serve sanctioned states.
For Builders
Protocol teams should screen contributors and wallets against OFAC lists, since developer-level infiltration is now a documented attack surface.
This article is for information only and is not financial advice. Read the full disclaimer.
