EL7.AI
GeopoliticsMedium•29 October 2026•
4 min read

Washington Lists 10 Individuals and One Entity in North Korean IT Worker Scheme

Key Facts

1The U.S. Treasury Department imposed sanctions on 10 individuals and one entity on October 28, 2026.
2Treasury said Boykov transferred cryptocurrency transactions equivalent to $3.5 million in support of Alis since 2024.
3Treasury said Obertas has made cryptocurrency transfers of nearly $2 million and transactions in other currencies totaling at least $1.25 million since January 2025.
4The designation notice listed 8 cryptocurrency addresses on the Ethereum and Tron networks.
5The Justice Department set January 28, 2027, as the sentencing date for a defendant in the Virginia case, who faces up to 20 years in prison.

The U.S. Treasury Department’s Office of Foreign Assets Control imposed sanctions on 10 individuals and one entity on October 28, 2026, for their roles in North Korean government-run IT worker schemes targeting U.S. companies. The list included individuals and brokers in Russia and North Korea, broadening the action from earlier wording that focused on Russian nationals without specifying the scope of the designations. Treasury said the schemes place North Korean workers at legitimate companies, then divert part of their earnings to weapons programs. Washington links fraudulent employment and financial flows through brokers with the risk of workers gaining access to corporate networks. The action highlights two Russian brokers and specific amounts Treasury attributed to their activities since 2024 and January 2025.

Treasury said Russian national Ilya Aleksandrovich Boykov has supported Alis since 2024 by transferring and monitoring cryptocurrency transactions equivalent to $3.5 million, as well as providing logistical support. The amount specifies the value of the activity attributed to him in support of the company, which the department links to the North Korean IT worker scheme. Treasury said Russian national Vitold Viktorovich Obertas has made cryptocurrency transfers of nearly $2 million to North Korean officials since January 2025. It added that he carried out transactions in other currencies totaling at least $1.25 million during the same period. The department thus distinguishes cryptocurrency transfers from other transactions, rather than combining them into one figure or describing them broadly as the laundering of millions of dollars.

According to Treasury, the scheme uses fraudulent documents, stolen identities and fabricated personas to secure jobs at legitimate companies. The department said the North Korean government takes most of the workers’ wages and directs them to fund weapons programs. The impact of the employment scheme extends beyond wage transfers: Treasury said some workers exploited their access to corporate networks to deploy malware, extract sensitive data and steal proprietary information. In its statement, Treasury Secretary Scott Bessent said workers abroad “target and exploit U.S. companies” and may use sensitive data to extort large payments from them. This places risks to network security and information confidentiality alongside the financial flows targeted by the sanctions.

Treasury said the First Financial and Technical Development Center is a North Korean-controlled entity based in Russia that deployed North Korean IT workers there. It added that the workers use artificial intelligence tools and sophisticated money-laundering methods to generate revenue for the regime. More broadly, the U.S. Department of Justice said North Korean IT worker schemes bring the regime hundreds of millions of dollars a year. The department also announced a joint action in Texas on October 13, 2026, that included the seizure of about 187 computers authorities said had been used by North Korean workers. The actions show multiple avenues for pursuing the scheme, from tracking brokers and transfers to seizing devices linked to remote work.

CoinDesk reported that the official designation notice lists 8 cryptocurrency addresses linked to the targeted individuals on the Ethereum and Tron networks. It reported that Chainalysis tracked cryptocurrency earned by a North Korean worker to Boykov, who sent it to the sanctioned Russian Garantex platform to cash out. These details add a specific path for the movement of funds to the amounts Treasury cited for Boykov and Obertas. Treasury said the assets and financial interests of designated individuals and entities are blocked if they are in the United States or in the possession or control of U.S. persons. Transactions involving the property of blocked persons are also generally prohibited, restricting U.S. dealings with the funds and property covered by the action.

The October 28 action follows a separate designation of a North Korean IT worker network on March 12, 2026, Treasury said. The department said Australia and the European Union also sanctioned individuals and entities in October for supporting North Korea’s revenue generation and military activities. In a separate court case, the Justice Department said the defendant in the Virginia case is due to be sentenced on January 28, 2027, and faces up to 20 years in prison. The date sets a later milestone in the case linked to the remote-worker scheme. The announced actions combine designations of individuals and entities, tracking cryptocurrency addresses and transfers, and prosecution of roles linked to the scheme.