US Treasury Sanctions 10 Individuals and One Entity for Supporting North Korean IT Worker Schemes
Key Facts
On October 28, the U.S. Treasury Department announced sanctions on 10 individuals and one entity for their roles in IT worker schemes run by the North Korean government. The department said the workers defraud U.S. companies to obtain jobs, and that the resulting revenue funds weapons of mass destruction and ballistic missile programs. Those targeted included North Korean workers residing in Russia and Russian intermediaries, as well as an entity controlled by Pyongyang. The action reaches financial networks that used cryptocurrency transactions and money laundering to transfer proceeds to North Korean officials. Treasury thus links the hiring of workers under hidden identities to the movement of money, rather than limiting the case to cryptocurrency laundering alone.
Treasury said the workers use forged documents, stolen identities and fabricated personas to conceal their ties to North Korea and work for legitimate companies. The regime takes most of their wages, with Treasury estimating that this revenue generates hundreds of millions of dollars to fund weapons and missile programs. The department also said the workers exploited their access to corporate networks to deploy malware, extract sensitive data and steal proprietary information. It added that the networks used cryptocurrency transactions, money laundering methods and emerging technologies, including artificial intelligence tools, to generate and transfer millions of dollars. Treasury described these methods as part of cross-border activity combining fraudulent employment with the use of digital financial infrastructure.
On the transfers, Treasury said Russian national Vitold Obertes has made nearly $2 million in cryptocurrency transfers to North Korean officials since January 2025. It added that he carried out transactions in other currencies totaling at least $1.25 million over the same period. The department said Obertes had financial dealings with Amnokgang Technology Development Company, which it added to its sanctions list on March 12, 2026. The figures show multiple financial channels, including cryptocurrency and other currencies, according to Treasury. The department did not attribute all the funds cited to direct financing of any specific weapons program.
Treasury said Kim Ki Hyuk leads a delegation of North Korean IT workers in Russia and has transferred cryptocurrency worth an estimated $500,000 to the delegation since 2024. Kim Hyo Dong, meanwhile, led a separate delegation, provided it with logistical support and took part in efforts to evade sanctions, the department said. It added that he facilitated the transfer of financial assets with an equivalent value exceeding $100,000 since at least December 2023. These details, in Treasury’s account, show operational and financial roles alongside the transfers attributed to intermediaries. The list of targets also includes individuals and companies linked to operating the workers in Russia.
Among the Russian intermediaries sanctioned was Ilya Boikov, who Treasury said has supported Alice since 2024. That support included exchanging and transferring cryptocurrency transactions equivalent to $3.5 million, as well as monitoring transactions and providing logistical assistance. The department also targeted the First Financial and Technical Development Center, an entity controlled by North Korea and based in Russia. It said the center’s IT workers used complex cryptocurrency transfers as part of money laundering methods. Treasury said six North Korean workers residing in Russia have collectively generated more than $750,000 for the center since 2025.
Estimates from the Multilateral Sanctions Monitoring Team put the broader program in context beyond the individuals covered by the action. The team said North Korean workers abroad earned between $450 million and $800 million in 2025, despite the UN deadline for their repatriation by 2019. It estimated that between 35,600 and 101,280 workers were deployed abroad, most of them in China and Russia. In Russia alone, the estimated number at the end of 2025 ranged from 15,000 to 30,000 workers, with average annual wages estimated at about $7,500 per worker. The team said North Korean authorities confiscate 80% to 90% of the wages of workers abroad.
The designations carry legal restrictions, including the blocking of the targets’ property and interests in property in the United States or in the possession or control of U.S. persons, with a requirement to report them to the Office of Foreign Assets Control. Transactions involving the property of designated persons and entities are also generally prohibited. The prohibition extends, according to the Treasury statement, to entities owned 50% or more, directly or indirectly, individually or in the aggregate, by one or more blocked persons. The department said the new action builds on the designation of a separate North Korean IT worker network on March 12, 2026. It added that Australia and the European Union took similar designation actions during October, while the United States, Australia and other countries had previously warned on July 31, 2026, about workers using artificial intelligence to conceal their identities and expand their activity globally.