The U.S. Treasury has sanctioned 10 individuals and one entity for allegedly helping North Korean IT workers make money through fraudulent employment at legitimate companies and convert cryptocurrencies into cash.
The action targeted financial intermediaries in a network that generates hundreds of millions of dollars each year for Pyongyang.
How the Takedown Chain Worked
According to a report from Chainalysis, Russian nationals Ilya Alexandrovich Boykov and Vitold Viktorovich Obertas converted millions of dollars in crypto for shell companies that placed North Korean IT workers in companies under false identities. Workers’ income ultimately helped finance the North Korean regime and its weapons programs.
The blockchain analytics firm traced a payment trail to a developer who contributed code to blockchain and DeFi projects. From late 2022 to early 2023, the worker’s wallet received stable payments every two weeks, resembling a regular salary.
These funds were converted to ETH and sent through consolidation wallets associated with sanctioned entities, before being passed to Boykov, who passed the cryptocurrency to Garantex, a Russian exchange that was later sanctioned by US authorities.
Obertas was also accused of acting as a financial intermediary for North Korean officials, with his portfolio receiving funds from another sanctioned organization, Amnokgang Technology Development Company, which was involved in managing delegations of computer scientists abroad.
According to the Office of Foreign Assets Control (OFAC), the Russian turned nearly $2 million worth of crypto into fiat currency for North Korean officials.
The designations also cover Kim Ki Hyok and Kim Hyo Dong, two North Korean nationals who headed IT workers based in Russia, as well as the First Financial and Technical Development Center (FFTDC), also based in the country, and six North Korean workers associated with it. According to Chainalysis, these six workers had generated over $750,000 for FFTDC since 2025.
Fake developer identities remain a business risk
As we have reported in the past, North Korean IT workers use fabricated identities and stolen credentials to obtain jobs at legitimate companies, after which they transfer a large portion of their income to the regime. The United Nations Group of Experts estimates that these operations generate between $250 million and $600 million per year.
In April, blockchain investigator ZachXBT uncovered records linked to a fake North Korean developer operation that generated more than $3.5 million in cryptocurrency, with another report from security researcher Taylor Monahan claiming that developers linked to North Korea helped create some of the most prominent DeFi protocols, including SushiSwap and THORChain.
Chainalysis also warned that generative AI makes recruitment fraud harder to detect, with agents using AI-generated CVs and profile photos, as well as deepfake videos during hiring calls, to appear legitimate.
The post US Sanctions Two Russians Over North Korean IT Workers’ Crypto Withdrawals appeared first on CryptoPotato.
About the Author
