US Penalizes Russian Crypto Brokers Tied to North Korea IT Fraud

TLDR

• The US Treasury has sanctioned 10 individuals and one entity connected to North Korean IT worker schemes.
• Two Russian nationals, Ilya Boykov and Vitold Obertas, are accused of converting millions in cryptocurrency for North Korea.
• The Treasury additionally designated a North Korean-operated center in Russia, alongside eight Ethereum and Tron cryptocurrency addresses.
• These fraudulent operations employ stolen identities to secure employment at legitimate businesses and funnel salaries into Pyongyang’s weapons programs.

Treasury Targets Crypto Conversion Networks

The sanctions were unveiled on October 28 by the Treasury Department’s Office of Foreign Assets Control (OFAC). This measure targets financial facilitators and personnel operating within Russia and North Korea who facilitate these IT staffing operations.

According to the Treasury, Boykov exchanged and converted approximately $3.5 million in crypto on behalf of Alis, a firm sanctioned in March 2024 for its connections to North Korean IT workers. Obertas allegedly managed nearly $2 million in crypto conversions and at least $1.25 million in alternative currency transactions for North Korean officials beginning in January 2025.

How the IT Worker Schemes Operate

North Korean agents deploy stolen identities, fabricated documents, and manufactured personas to obtain remote positions at legitimate enterprises. The government subsequently retains the majority of these earnings, converting standard software development labor into state funding.

The security threat extends past employing a concealed worker. The Treasury notes that these individuals have leveraged access to corporate networks to install malware and extract sensitive, proprietary information.

Data from Chainalysis indicates that operatives have also leveraged generative artificial intelligence to draft resumes and cover letters, as well as to study for technical assessments. In certain instances, AI-generated profile images and deepfake videos were utilized to conceal their true identities during recruitment interviews.

Garantex Link and Russian Front Center

Blockchain intelligence firm Chainalysis tracked cryptocurrency generated by a North Korean IT employee to Boykov, who transferred the assets to Garantex—a subsequently sanctioned Russian exchange—to liquidate them.

Additionally, OFAC designated the First Financial and Technical Development Center, a North Korean-managed entity functioning inside Russia. Six workers penalized concurrently with the center have amassed more than $750,000 for the organization since 2025, based on Treasury data. The designation records feature eight crypto addresses spanning the Ethereum and Tron networks linked to the penalized parties.

This recent enforcement succeeds a March sanctions initiative wherein the Treasury penalized six individuals and two corporations charged with laundering $800 million in digital assets for North Korea.

Collectively, these measures highlight a growing emphasis by American regulators on the intermediaries responsible for liquidating North Korean revenues into accessible funds, rather than solely concentrating on the individual workers.