US Sanctions Two Russians Accused of Converting Crypto for North Korean IT Workers
The US Treasury has sanctioned 10 individuals and one entity accused of helping North Korean information technology workers generate revenue through fraudulent employment arrangements and convert cryptocurrency earnings into cash. The network allegedly supports financial operations that bring hundreds of millions of dollars annually to Pyongyang.
The measures target financial intermediaries, including Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas, who were accused of processing cryptocurrency for front companies that placed North Korean IT workers at legitimate businesses under false identities.
According to blockchain analytics firm Chainalysis, the workers' earnings ultimately supported the North Korean regime and its weapons programs. The case highlights how cryptocurrency conversion services can connect fraudulent overseas employment schemes with financial networks linked to sanctioned entities.
Chainalysis Traces Cryptocurrency Payments to Russian Intermediaries
Chainalysis identified a transaction trail involving a developer who contributed code to blockchain and decentralized finance projects. From late 2022 to early 2023, the developer's wallet received stablecoin payments every two weeks, a pattern consistent with regular salary payments.
The funds were subsequently converted into ETH and transferred through consolidation wallets associated with sanctioned entities. The cryptocurrency was then passed to Boykov, who forwarded it to Garantex, a Russian cryptocurrency exchange that was later sanctioned by US authorities.
Obertas was separately accused of serving as a financial intermediary for North Korean officials. His wallet received funds from Amnokgang Technology Development Company, a sanctioned organization involved in managing overseas IT worker delegations.
According to the US Treasury's Office of Foreign Assets Control (OFAC), Obertas converted nearly $2 million worth of cryptocurrency into fiat currency for North Korean officials.
Sanctions Also Target North Korean IT Network
The designations extend beyond the two Russian nationals. They also cover Kim Ki Hyok and Kim Hyo Dong, two North Korean nationals who managed IT workers based in Russia.
The First Financial and Technical Development Center (FFTDC), also based in Russia, was designated alongside six North Korean workers associated with the organization. Chainalysis reported that those six workers had generated more than $750,000 for FFTDC since 2025.
The alleged arrangements relied on workers obtaining jobs at legitimate companies using fabricated identities. Their earnings could then be routed through intermediaries and converted into funds available to North Korean entities, making the financial trail more difficult for employers and authorities to identify.
Fake Developer Identities Pose Risks for Employers
North Korean IT workers have been linked to schemes involving stolen credentials and fabricated professional identities used to secure employment at legitimate businesses. The United Nations Panel of Experts estimates that these operations generate between $250 million and $600 million annually.
In April, blockchain investigator ZachXBT uncovered records linked to a North Korean fake-developer operation that generated more than $3.5 million in cryptocurrency. Separately, security researcher Taylor Monahan reported that North Korean-linked developers had contributed to prominent decentralized finance protocols, including SushiSwap and THORChain.
Chainalysis has also warned that generative artificial intelligence is making recruitment fraud harder to detect. According to the firm, operatives can use AI-generated resumes and profile photographs, as well as deepfake video during hiring calls, to make false identities appear credible.
The sanctions underscore the financial infrastructure allegedly supporting North Korean overseas IT operations, from securing employment under false identities to converting cryptocurrency proceeds into fiat currency. The case also illustrates the challenges companies face when verifying remote applicants and tracing payments through multiple cryptocurrency wallets and intermediaries.
source: cryptopotato
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.