U.S. Sanctions 11 Over North Korean IT Worker Crypto Laundering Network
The U.S. Treasury sanctioned 10 individuals and one entity tied to North Korean IT worker schemes that route wages to the country's weapons programs. Treasury published Ethereum and Tron wallet addresses linked to the designees, prompting financial firms to watch those accounts.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Designations
The U.S. Treasury Department's Office of Foreign Assets Control sanctioned 10 individuals and one entity on Tuesday, according to Treasury. The action targets networks that place North Korean IT workers at U.S. and other foreign companies under fake identities, then take most of their pay for the regime's weapons of mass destruction and ballistic missile programs.
Reports differ on the announcement day. Decrypt says the designations were made on Wednesday, while Bitcoin Magazine says Tuesday. The sources agree on the substance, but readers should treat the exact date as reported rather than confirmed from the Treasury release itself.
Russian Intermediaries and the Money Trail
The focus of the action is on the people who move the money rather than the workers themselves. Two Russian nationals sit at the center. Vitold Obertas, described by Treasury as an intermediary for North Korean financial transactions, carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency transactions for North Korean officials. Ilya Boykov exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Alis, a North Korean IT worker company sanctioned in 2024.
Two North Korean nationals who lead Russia-based worker delegations were also named. Treasury said Kim Ki Hyok transferred nearly $500,000 in crypto for his delegation since 2024. Bitcoin Magazine names a second leader, Kim Hyo Dong, whom Decrypt does not mention. Treasury also designated the First Financial and Technical Development Center, a North Korean-controlled entity in Vladivostok, which Treasury said generated more than $750,000 through six Russia-based workers since 2025.
Wallet Addresses and Exchange Monitoring
Treasury published the sanctioned wallet addresses. Decrypt reports two Ethereum and two Tron addresses for Boykov and one Ethereum and three Tron addresses for Obertas, with one Ethereum address appearing on both men's entries. Bitcoin Magazine describes the publication as a signal to exchanges and other financial firms to monitor those accounts. Publishing addresses gives compliance teams a concrete screening list, though neither source reports the total number of addresses in the same way, so the Decrypt count should be checked against the Treasury notice itself.
Scale and Context
The two sources differ on the size of the broader program. Bitcoin Magazine reports that the March designation of a separate North Korean IT worker network said it laundered roughly $800 million in crypto for the regime. Decrypt cites the March action and notes Australia and the European Union made their own designations this month, but does not repeat the $800 million figure. The dollar amounts attributed to individual designees are each sourced to Treasury's own statements.
Separately, Decrypt notes that North Korean hackers have run long deception campaigns against crypto firms. Drift Protocol said in April that a roughly $285 million drain was a six-month operation by a North Korean state-affiliated group whose intermediaries posed as a quantitative trading firm. Google's Threat Intelligence Group reported in April 2025 that IT workers had embedded in crypto projects in several European countries, some using as many as 12 fake identities at once.
Compliance Obligations
Under the designations, any property the listed parties hold in the United States, or that U.S. persons control, is blocked and must be reported to OFAC. Transactions with them are generally prohibited absent a license, and entities owned 50% or more by blocked parties face the same restrictions. Bitcoin Magazine reports that Treasury warned civil penalties can apply even when a violation was unintentional. Advisories from the State, Treasury and Justice departments and the FBI offer guidance for firms that hire remote contractors, including identity verification, payment-destination checks and scrutiny of unusual access requests.
Why It Matters
For Traders
Exchanges are expected to screen the published Ethereum and Tron addresses, so flows touching them may face freezes or delays in the coming days.
For Investors
Sustained enforcement against laundering networks signals tighter compliance expectations for crypto venues that handle cross-border flows.
For Builders
Teams should screen inbound and outbound addresses against the published OFAC list and review contractor identity checks in their hiring pipelines.
This article is for information only and is not financial advice. Read the full disclaimer.
