U.S. Sanctions Crypto Middlemen Accused of Moving Millions for North Korea

Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 people and one organization on Oct. 28 over alleged North Korean IT employment fraud. The targets include Russian intermediaries accused of converting millions of dollars in cryptocurrency.

The Treasury warned the schemes use stolen identities to secure jobs, then divert most workers’ wages to the regime. The sanctions target people helping collect, convert and move those earnings.

Russian Intermediaries Allegedly Converted Millions in Crypto

Russian national Ilya Aleksandrovich Boykov allegedly exchanged and converted approximately $3.5 million in cryptocurrency transactions for Limited Liability Company Alis, a Russia-based organization employing North Korean IT workers. Treasury says his support since 2024 also included monitoring transactions and providing logistical assistance.

Alis was already under U.S. sanctions, having been designated in March 2024 for its relationship with North Korea’s Chinyong Information Technology Cooperation Company. The latest action targets Boykov’s alleged assistance to that organization.

Another Russian intermediary, Vitold Viktorovich Obertas, allegedly conducted nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. Treasury linked his work to Amnokgang Technology Development Company, which was sanctioned in March.

OFAC listed Ethereum and Tron addresses associated with both Russian men. One Ethereum address appears in both entries, providing a specific overlap in the financial identifiers attached to their designations.

Worker Handlers Allegedly Enforced Targets and Moved Funds

Treasury also sanctioned Kim Ki Hyok, whom it identified as the head of an Alis worker delegation in Russia. His responsibilities allegedly included monitoring workers and ensuring they met financial targets. Treasury says he transferred nearly $500,000 in cryptocurrency for the delegation since 2024.

Kim Hyo Dong allegedly led a separate delegation connected to Chinyong. Treasury accused him of providing logistical support, helping evade sanctions and facilitating transfers exceeding $100,000 in financial assets since at least December 2023.

The designated organization, First Financial and Technical Development Center, is a North Korean-controlled operation in Russia. Treasury says it sent highly trained IT workers there and used complex crypto transfers to help generate revenue.

Six workers sanctioned alongside the center allegedly generated more than $750,000 for it since 2025. Treasury says the broader overseas employment schemes raise hundreds of millions of dollars for North Korea’s weapons programs.

Employers Face Data Theft and Extortion Alongside Payroll Fraud

For businesses, the damage can extend well beyond paying someone who used a false identity. Treasury says North Korean IT workers have used corporate access to install malware, extract sensitive data and steal proprietary information.

Treasury Secretary Scott Bessent said the overseas operatives 

“[…] weaponize sensitive data and extort businesses for substantial payments.”

In January 2025, the Federal Bureau of Investigation (FBI) warned that some workers had held stolen company data and code hostage after being discovered. It also described the use of AI and face-swapping technology during video interviews to conceal applicants’ identities.

The FBI recommends checking identities throughout recruitment and employment, monitoring unusual remote connections and reviewing changes to workers’ payment arrangements.

It also advises comparing applicants’ contact details and résumé content for reuse across supposedly different candidates. Employers using staffing agencies should verify and regularly review those firms’ hiring practices.

Sanctions Block Covered Assets and Restrict U.S. Dealings

OFAC requires property belonging to the designated people and organization to be blocked and reported when it is in the United States or held or controlled by U.S. individuals.

The restrictions also cover entities owned 50% or more, individually or collectively, by blocked people. U.S. people are generally prohibited from transactions involving covered property unless an OFAC authorization or exemption applies.

For crypto platforms and payment providers, the designations add named counterparties and blockchain addresses to sanctions checks. OFAC identified an Ethereum address for Kim Ki Hyok as well as the addresses associated with Boykov and Obertas.