US sanctions North Korean IT worker network, lists 8 crypto addresses

The US Treasury Department's Office of Foreign Assets Control (OFAC) on Oct. 28 sanctioned 10 individuals and one entity for their roles in IT worker schemes run by the North Korean government, adding them to its Specially Designated Nationals (SDN) list. The listings also include eight crypto addresses used by the network: three on Ethereum and five on Tron. Treasury said the network deceives US businesses and channels the proceeds into North Korea's weapons of mass destruction (WMD) and ballistic missile programs.

Treasury Secretary Scott Bessent said in the release that the North Korean regime continues to target American companies through its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments. Treasury said the workers use fraudulent documents, stolen identities and fabricated personas to land jobs at legitimate companies in the United States and allied countries, and that the regime takes most of their wages.

Two Russian intermediaries handled crypto conversions

Two of the key figures named are Russian intermediaries. Ilya Aleksandrovich Boykov has exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Limited Liability Company Alis, a North Korean IT firm, while monitoring crypto transactions and providing logistical support, Treasury said. Vitold Viktorovich Obertas has conducted nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. His clients include Amnokgang Technology Development Company, which OFAC designated on March 12.

The listed addresses are split among the two men and North Korean national Kim Ki Hyok. Boykov's entry carries two Ethereum and two Tron addresses, and Obertas's entry has one Ethereum and three Tron addresses. Obertas's Ethereum address is the same as the second Ethereum address in Boykov's entry. Kim Ki Hyok's entry lists one separate Ethereum address.

IT worker delegations and a North Korea-controlled center in Russia

Kim Ki Hyok leads a Russia-based delegation of Alis IT workers, monitoring them and making sure they hit financial targets. According to Treasury, he has transferred nearly $500,000 in crypto for the delegation since 2024. OFAC designated Alis in March 2024, and its parent, Chinyong Information Technology Cooperation Company, in May 2023. Kim Hyo Dong, who leads a separate Russia-based delegation under Chinyong, was also designated; he has facilitated the transfer of more than $100,000 in financial assets since December 2023.

The entity named is the First Financial and Technical Development Center (FFTDC), based in Vladivostok, Russia. Treasury said the center has deployed North Korean IT workers to Russia since 2024, generating several million dollars, and uses complex crypto transfers and artificial intelligence (AI) tools. Six North Korean IT workers at the center in Russia have together generated more than $750,000 on behalf of the FFTDC since 2025.

Their SDN entries show all six were born in Pyongyang between 1999 and 2002, putting them in their 20s. Four hold North Korean passports issued on Sept. 1, 2025, and two hold passports issued on Feb. 18 of that year; all have addresses listed in Russia. Only Kim Ki Hyok and Kim Hyo Dong have their names also given in Korean script on the list.

Seven months after the March round

Treasury said the action builds on its March 12 designation of a separate North Korean IT worker network. On March 12, OFAC sanctioned six individuals and two entities in North Korea, Vietnam, Laos and Spain, saying the IT worker schemes generated nearly $800 million in 2024 alone. In the latest release, Treasury added that Australia and the European Union also designated people and entities this month that support North Korea's revenue generation and military activities.

All property of the designated persons in the United States or controlled by US persons is blocked, and US persons are generally barred from dealing with them. The designations also flag secondary sanctions risk, meaning financial institutions outside the United States can face sanctions for dealing with them. The listed addresses can be checked by anyone through OFAC's sanctions list search.

The legal basis comes in two parts. The two Russian intermediaries, Kim Ki Hyok, and Kim Hyo Dong were designated under Executive Order 13687 for materially assisting the North Korean government or sanctioned organizations. The FFTDC was designated under Executive Order 13722 for its role in exporting North Korean workers, and the six IT workers under the same order for supporting the center. On the same day, Treasury separately sanctioned Rwanda's Ministry of Defence and one financial institution for supporting the M23 rebel group in the Democratic Republic of the Congo.