The United States Treasury Department has blacklisted 10 people and one entity accused of helping North Korea turn the earnings of its overseas information-technology workers into money that could be sent back to Pyongyang. The designations, made by the Treasury’s Office of Foreign Assets Control, known as OFAC, were dated 28 October 2026 and were reported on 1 November. They target what Treasury describes as a network that placed North Korean workers in remote technology jobs under false identities, paid them in ways designed to hide who they really were, and then converted and moved the proceeds through cryptocurrency channels. The action freezes any assets the designated people and entity hold under United States jurisdiction, bars Americans from dealing with them, and sends a warning to banks, exchanges and employers that may have touched the network without realising it.
At the centre of the announcement are two Russian nationals accused of acting as crypto cash-out facilitators for front companies linked to North Korean IT workers. Ilya Aleksandrovich Boykov is accused of converting about 3.5 million dollars in cryptocurrency since 2024 on behalf of such front companies, while Vitold Viktorovich Obertas is accused of converting about 2 million dollars since January 2025, plus at least 1.25 million dollars in other related deals. Those figures are Treasury’s accusations, as reported in coverage of the designations, and they have not been tested in a criminal court. No criminal charges against the designated people were reported alongside the sanctions, and a sanctions listing, however detailed, is not a criminal conviction. That distinction is essential to understanding what this action does and does not prove.
Alongside the two Russians, Treasury designated two North Koreans said to have managed IT workers operating in Russia, Kim Ki Hyok and Kim Hyo Dong, and six further North Korean workers linked to a Russia-based organisation called the First Financial and Technical Development Center, or FFTDC. The FFTDC itself was also designated as an entity, bringing the total to 10 individuals and one organisation. The structure described by Treasury is therefore not a single company or a single wallet, but a chain: workers placed in jobs, managers overseeing them abroad, front companies presenting them to employers, and facilitators converting the resulting payments into usable funds. Sanctions that hit only one link in such a chain can be circumvented by rebuilding the missing link, which is why Treasury has increasingly tried to designate the whole chain at once.
How the alleged IT worker scheme operated
According to the allegations, North Korean IT workers obtained remote jobs with companies in the United States and elsewhere by using false identities, stolen or borrowed personal details, and front companies that made them look like ordinary freelance contractors or employees of legitimate firms. Once hired, they carried out software development, design and other technology work, and were paid for that work, often in cryptocurrency. The use of crypto is central to the alleged scheme, because it can move across borders quickly and, if routed through the right wallets and exchanges, can obscure the original earner and the ultimate destination. Treasury alleges that the earnings were funnelled through wallets and exchanges, including Garantex, a platform that has itself been the subject of previous United States action, on their way towards programmes in North Korea, including its weapons programmes.
The scale attributed to the wider North Korean IT worker scheme is large, but it is also uncertain, and it should be reported as an estimate rather than a precise accounting. A United Nations Panel of Experts has estimated that the scheme generates between 250 million and 600 million dollars a year for North Korea. That range is wide because the activity is deliberately hidden, because employers often do not know they have hired a North Korean worker, and because payments pass through intermediaries that do not keep transparent records. The range is best read as an indication of scale: even at the low end, the scheme is a major revenue stream for a country under heavy sanctions, and at the high end it rivals some of North Korea’s other illicit income sources. It is not a figure that Treasury’s 28 October designations, on their own, prove or recalculate.
For employers, the scheme poses a practical and uncomfortable problem. A hiring manager conducting a video interview, checking a portfolio and verifying a résumé may have no reason to suspect that the applicant is using a borrowed identity or working on behalf of a North Korean operation. The workers are often skilled, their work may be competent, and the front company that invoices the employer may look entirely conventional. That is why United States authorities have, in recent years, paired sanctions with public advisories to employers, urging them to check identities more carefully, to watch for signs such as a worker who cannot appear on camera, who uses a virtual private network in a suspicious way, or whose payment details change unexpectedly. The new designations extend that effort from advice to enforcement, by naming specific people and an entity that employers and financial firms must now avoid.
US sanctions North Korean IT workers crypto facilitators in Russia
The Russian dimension of this case deserves particular attention, because it shows how the IT worker scheme has adapted to sanctions pressure. Earlier reporting on North Korean workers focused heavily on China and Southeast Asia, where workers were placed in physical offices or worked remotely under local cover. The 28 October action points to Russia as a base for management and for crypto conversion, with Boykov and Obertas accused of handling millions of dollars in digital assets for front companies. Russia’s role is alleged, not adjudicated, and neither man has been reported as charged with a crime in connection with these designations. But the geography matters for enforcement: a network operating across Russia, using crypto exchanges and wallets that may sit outside United States jurisdiction, is harder to disrupt than a network with assets sitting in American banks.
Cryptocurrency is often described as anonymous, but in practice it is pseudonymous: transactions are recorded on public blockchains, while the identities behind wallet addresses can be hidden. That combination creates both an opportunity and a challenge for investigators. Blockchain analysis can trace funds from a known wallet through a series of hops to an exchange, and exchanges that comply with United States sanctions can freeze funds when they arrive. But if funds pass through exchanges or over-the-counter traders that do not comply, or are swapped between different cryptocurrencies, the trail becomes harder to follow. Treasury’s accusation that Boykov and Obertas converted crypto earnings for front companies suggests that investigators believe they can connect specific conversions to the IT worker network, but the public reporting of the designations does not set out the full blockchain evidence, and readers should not treat the headline dollar figures as court-proven totals.
The designation of Garantex in the narrative around the scheme is also significant. Garantex has been named in previous United States actions concerning illicit finance, and its alleged use as a route for these funds fits a pattern in which sanctioned actors gravitate towards platforms that are willing, or insufficiently careful, to handle their transactions. For legitimate crypto exchanges and financial institutions, the message is to screen not only direct customers but also counterparties and transaction patterns that may indicate a front company or a worker operating under a false identity. For the wider public, the lesson is less technical: a payment that looks like an ordinary freelance invoice may, in a small number of cases, be part of a much larger and deliberately concealed revenue operation.
What sanctions do, and what they do not do
OFAC sanctions are a powerful tool, but they have defined limits that are often lost in headline coverage. A designation blocks property and interests in property of the designated person that are in the United States or in the possession or control of United States persons, and it generally prohibits United States persons from engaging in transactions with the designated person. It does not, by itself, seize funds held abroad, extradite anyone, or result in a prison sentence. It can, however, make it much harder for the designated person to use the dollar-based financial system, to open accounts, to receive payments through compliant exchanges, or to travel and do business with firms that fear secondary sanctions. In that sense, sanctions are as much a signal to the rest of the financial system as a punishment of the individual named.
That signal effect is particularly important in a case like this, where the alleged activity depends on the cooperation, witting or unwitting, of employers, payment processors and exchanges. A company that discovers it employed a worker linked to a newly designated network faces immediate questions: should it terminate the contract, should it report the matter to authorities, and what happens to work already performed? A bank or exchange that finds a designated person among its customers must freeze the account and report it. Those downstream effects often do more practical damage to a network than the freezing of any single wallet, because they force the network to rebuild its cover, find new facilitators and persuade new employers to trust it, all while its known names are on a public list.
At the same time, sanctions alone rarely end a scheme of this kind. North Korea has shown, over many years, an ability to adapt to designations by using new front companies, new identities and new facilitators. The IT worker scheme itself is an adaptation: as traditional sanctions cut off other revenue sources, Pyongyang turned to a workforce that could earn hard currency by selling skilled labour into the global remote-work market, a market that expanded rapidly after the pandemic and that, by its nature, makes identity verification harder. Each round of designations therefore tends to be followed by a period of adaptation, and then by a further round of designations. The 28 October action should be read as one move in that longer contest, not as a final blow.
Why this case matters beyond the names listed
The wider significance of the designations lies in what they reveal about the intersection of remote work, cryptocurrency and sanctions evasion. Remote hiring has made it possible for a skilled worker anywhere in the world to earn income from a company on another continent, which is, for most workers, a genuine opportunity. The alleged North Korean scheme exploits that openness by inserting workers whose earnings are not theirs to keep, but are channelled to a state under sanctions for its weapons programmes. That exploitation threatens not only sanctions policy but also the trust on which remote work depends. If employers become fearful that any remote contractor might be a front, they may impose verification burdens that fall hardest on legitimate freelancers in developing countries, who already face barriers to payment and banking.
There is also a human dimension that should not be lost in the financial detail. North Korean workers sent abroad, whether as IT contractors or in other roles, are widely reported to work under strict control, with much of their earnings taken by the state and with limited freedom to leave or to speak openly. The public material on the 28 October designations does not set out the personal circumstances of the six workers linked to the FFTDC, and it would be wrong to assume details that have not been reported. But the scheme, as alleged, is not a simple case of individual freelancers finding work online. It is described as an organised operation in which workers are managed, placed and paid through intermediaries, and in which the ultimate beneficiary is said to be the North Korean state rather than the worker at the keyboard. That structure is what makes the case a sanctions matter rather than an ordinary employment dispute.
What happens next will depend on enforcement and on adaptation in roughly equal measure. Investigators will watch whether the designated facilitators are replaced, whether new front companies appear with similar patterns, and whether employers report suspicious hiring cases more readily now that specific names and amounts are public. Exchanges and banks will update their screening lists and may file new suspicious activity reports that lead to further designations. North Korea, for its part, may shift its workers to new jurisdictions, new payment methods or new types of work. For readers following this story, the most useful questions are therefore not only who was named on 28 October, but whether the network’s ability to place workers and convert their earnings is measurably reduced in the months that follow, and whether employers and financial firms act on the warning this designation was meant to send.
USN has previously reported on related enforcement and security cases, including a Virginia contractor case involving remote-work fraud and a Treasury-sanctioned North Korea-linked network, and on North Korean weapons claims, including North Korea’s claimed cluster-bomb warhead test, which show how sanctions, fraud and weapons reporting intersect.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from HokaNews, Seoul Economic Daily and CoinArticle.