The U.S. Treasury sanctioned ten individuals and one entity on Tuesday for laundering money from North Korean fake IT worker schemes that fund the regime's weapons programs.
The sanctions targeted two Russian nationals at the center of the operation. Vitold Obertas allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025. Ilya Boykov converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT worker company that the U.S. sanctioned in 2024.
Two North Korean nationals were also named. Kim Ki Hyok and Kim Hyo Dong led Russia-based worker delegations. Kim Ki Hyok moved close to $500,000 in crypto for his team since 2024.
Treasury sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who generated more than $750,000 for it since 2025.
The workers typically operate under fake identities at legitimate firms, sometimes using AI-generated resumes, doctored photos, or deepfake videos during interviews. Most of their pay goes to the regime. Some workers have gained access to corporate networks, where they planted malware and took proprietary data.
Treasury published wallet addresses on Ethereum and Tron tied to the sanctioned individuals. One Ethereum address links to both Obertas and Boykov. Under the sanctions, any property these individuals hold in the U.S. or controlled by U.S. persons is blocked. Transactions with them are generally prohibited unless licensed. Treasury warned that civil penalties can apply even for unintentional violations.
The action follows a March designation of a separate North Korean IT worker network that Treasury said had laundered roughly $800 million in crypto for the regime. Australia and the European Union announced related designations this month.