North Korea's IT Workers: US Sanctions 10, Including Two Russians Who Converted Their Crypto Pay

On Wednesday 28 October 2026, the US Treasury added eleven names to its blacklist. Two belong to Russian men it says handled North Korea's money. According to the Treasury, Ilya Boykov has exchanged and converted about $3.5 million in cryptocurrency since 2024 for a North Korean company that hires out software programmers. Vitold Obertas, born in the Pacific port city of Vladivostok, has carried out nearly $2 million in crypto conversions since January 2025, plus at least $1.25 million in other currency deals, for North Korean officials.

The other nine names are North Korean. Six are programmers working in Russia who, the Treasury says, have earned more than $750,000 since 2025 for a North Korean-controlled outfit in Vladivostok called the First Financial and Technical Development Center. Two are North Korean managers who run teams of such workers in Russia. The eleventh name is the Vladivostok centre itself.

None of the eleven has been charged with a crime. A sanctions listing is not a conviction. It is a decision by the Office of Foreign Assets Control (OFAC), the Treasury's sanctions office, made without a trial, that Americans may not do business with someone. What the Treasury says these people did is help run one of North Korea's quieter money machines: programmers who win remote jobs at foreign companies under false names and send most of their pay home. In March 2026 the Treasury said such schemes brought in nearly $800 million in 2024 for the regime's nuclear weapons and missile programmes.

"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives," said Treasury Secretary Scott Bessent, adding that those operatives "weaponize sensitive data and extort businesses for substantial payments."

Who was named, and what the Treasury says they did

Obertas is described as "a Russian intermediary for illicit DPRK financial transactions" (DPRK is North Korea's official name). Part of his work, the Treasury says, was for Amnokgang Technology Development Company, a North Korean firm that manages IT workers abroad and was itself sanctioned on 12 March 2026.

Boykov, also Russian, is accused of supporting Limited Liability Company Alis, a Vladivostok company run by North Koreans that the US sanctioned in March 2024. Besides converting about $3.5 million in crypto, he monitored crypto transactions for Alis and gave it logistical help, the Treasury says. Alis answers to the Chinyong Information Technology Cooperation Company, a North Korean IT firm sanctioned in May 2023. A United Nations panel of experts once estimated that Chinyong handled tens of millions of dollars between 2017 and 2022, according to the blockchain analytics firm TRM Labs.

Kim Ki Hyok leads Alis's delegation of workers in Russia. His job, in the Treasury's words, is "monitoring Alis IT workers and ensuring they meet their financial targets": a sales manager whose staff are not allowed to keep their pay. Since 2024 he has moved crypto worth nearly $500,000 for the group. Kim Hyo Dong leads a separate Chinyong team in Russia and, since at least December 2023, has handled logistics, worked to dodge sanctions and helped move more than $100,000. OFAC's list places him in Russia and Laos.

The six programmers are Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il. OFAC's list says all six were born in Pyongyang and now live in Russia. Their employer, the First Financial and Technical Development Center, was set up in January 2024, according to OFAC's entry. The Treasury says it has made "several millions of dollars" for the North Korean government by sending "highly trained" workers to Russia who use what it calls "Super Intelligence (SI) tools" and "complex cryptocurrency transfers".

How a fake remote worker gets paid

The scheme the Treasury describes works in three steps. First, the job. North Korean programmers apply for remote work at companies in the United States and allied countries using fake documents, stolen identities and invented personas. Chainalysis, another blockchain analytics firm, says they now use AI to write CVs and prepare for interviews, and sometimes use AI-made photos or deepfake video on hiring calls. Some, the Treasury says, have also used their access to plant malware, copy sensitive data and steal company secrets.

Second, the pay. Some are paid in stablecoins, digital tokens designed to hold the value of one US dollar each, which move between online wallets without a bank. Chainalysis traced one example. A North Korean worker who wrote code for blockchain projects and DeFi (decentralised finance, banking-style services run by code) received regular stablecoin payments roughly every two weeks, like a salary, from late 2022 to early 2023. The wallet swapped the stablecoins for ether, the coin of the Ethereum network, and sent it to collection wallets linked to already sanctioned North Korean groups.

Third, the exit. Crypto is useless to a sanctioned government until someone turns it into money that pays for things. In the Chainalysis trace, the funds reached Boykov, who sent them to Garantex, a Moscow crypto exchange, to be cashed out. The US had blacklisted Garantex in April 2022 for laundering, and the US Secret Service shut it down in March 2025. In stock-market terms, the brokers are the back office: they take a client's winnings, swap them into a usable currency and send them on, without asking where the money came from.

What a US sanctions listing does

Anything the eleven own that is in the United States, or held by an American person or company anywhere, is frozen and must be reported to OFAC. Americans, and any deals that pass through the US, are generally barred from dealing with them. Any company that one or more of them owns at least 50% of is frozen too. Foreign banks and other firms that deal with them risk US sanctions themselves. The Treasury notes that people can petition to be removed, saying "the ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior."

This time OFAC also listed crypto wallet addresses. According to OFAC's list entries and TRM Labs, there are eight unique addresses on Ethereum and Tron, another blockchain popular for moving dollar stablecoins: four for Obertas, four for Boykov and one for Kim Ki Hyok, with one Ethereum address shared by Obertas and Boykov. TRM says it found direct transfers of USDT, the digital dollar issued by Tether, from wallets tied to Amnokgang to Obertas's addresses. Crypto exchanges that follow US rules check deposits against these lists, so coins arriving from the named wallets can be refused.

Russia, Australia and the bigger picture

OFAC's entries give a Russian location for all ten people on the new list. United Nations Security Council resolutions passed in 2017 require countries to send North Korean workers home. No public response from Moscow had been reported by 31 October.

The Treasury says the United States "is joined this month by Australia and the European Union". Australia acted first: on 22 October it sanctioned two North Koreans, Yu Pu Ung and Sim Hyon Sop, and two companies, Korea Mangyongdae Computer Technology Company and Chinyong. Foreign Minister Penny Wong said they help North Korea use fraudulent IT workers to raise money for its weapons. Both governments cite the Multilateral Sanctions Monitoring Team, a group of 11 countries formed in 2024 after Russia vetoed the renewal of the UN panel that used to track North Korea's sanctions breaking.

No Justice Department or State Department action was announced on the same day. In September and October 2026, FBI agents searched more than 40 suspected laptop farms in Texas, homes where Americans keep company laptops switched on so that a worker abroad appears to log in from the US.

The listing arrived one day before the largest crypto theft on record, about $6.3 billion taken from the exchange Binance on 29 October. No government has said who did that, and nothing connects it to these sanctions. TRM Labs, Elliptic and Chainalysis have pointed to North Korean state hackers. If that holds, TRM counts $7.4 billion stolen by North Korea-backed hackers in 2026 alone. The remote workers are the slower side of the same business: a few hundred thousand dollars at a time, paid on payday, by employers who believe they hired someone else.