US sanctions North Korean IT worker network in Russia after Texas raids

The US Treasury’s Office of Foreign Assets Control (OFAC) named 10 people and one company on a blacklist targeting a scheme to place fake North Korean IT workers inside American companies. 

The October 28 action targeted the Russia-based intermediaries responsible for funneling the North Korean IT workers’ crypto wages into cash for Pyongyang.

The move freezes any assets the named people and company hold in the United States. It also makes it illegal for Americans to deal with them.

OFAC targets Russians helping North Korea 

Two Russian nationals, Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas, were at the nerve center of the operation that OFAC targeted for swapping cryptocurrency into spendable funds for North Korean front companies. 

Reports attribute close to $2 million in crypto conversions to Obertas alone. The same person was responsible for another $1.25 million in other currency transactions for DPRK officials since January 2025. 

Boykov was implicated for laundering about $3.5 million since 2024. He was also linked to Alis and Amnokgang, both sanctioned North Korean firms.

The OFAC report also named two North Korean managers, Kim Ki Hyok and Kim Hyo Dong, who both report to Chinyong Information Technology Cooperation Company. The company got a Treasury designation in 2023.

Ki Hyok runs a delegation of IT workers inside Russia and has moved at least $500,000 back to North Korea since 2024. Hyo Dong, who heads another group, has helped evade sanctions on more than $100,000 in transfers.

How the North Korean network moved crypto 

Per the Chainalysis blockchain analytics firm, in one of the cases it traced on-chain, a North Korean developer who built code for blockchain and DeFi protocols collected stablecoin paychecks every two weeks. 

The stablecoins in the wallets would then be converted into Ether (ETH) before they are routed through consolidation addresses before they finally land with Boykov. The Russian handler would then move the funds to the US-sanctioned Russian exchange, Garantex. That’s the final stage before the cashout.

While OFAC’s report states that Obertas began handling crypto for DPRK officials in 2025, Chainalysis’ blog estimates that the handler has been active since at least 2023. 

OFAC also sanctioned the First Financial and Technical Development Center, a North Korean-controlled outfit based in Russia. The firm made millions using AI to help trained IT workers land jobs across the US and elsewhere. It also ran crypto transfers in the background. 

Six of its operatives were named alongside it: Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il. Treasury said they have earned at least $750,000 for the company since 2025.

Treasury Secretary Scott Bessent said North Korea’s government “continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.”

Pyongyang’s global network of IT workers is drawing attention

The sanctions follow a Justice Department operation earlier this month that shut down dozens of laptop farms in Texas and led to two arrests. Laptop farms host company-issued computers so workers abroad appear to be logging in from inside the US.

The UN panel of experts estimates the IT worker program brings North Korea $250 million to $600 million a year, according to Chainalysis, with the money flowing into its weapons and missile programs. 

The North Korean operation is also facing pressure from Australia and the European Union, who both moved on the network this month.

President Donald Trump has been pressing to restart nuclear talks with Pyongyang, which has shown little interest in them.