US Sanctions Two Russians and 8 Others in North Korean IT Crypto Laundering Network

The US Department of the Treasury has sanctioned 10 individuals and one entity for assisting North Korean IT workers in laundering cryptocurrency earned through fraudulent remote employment at corporate enterprises. These financial intermediaries operate within networks that generate hundreds of millions of dollars annually for Pyongyang's state programs. ## How the Multi-Million Dollar Cash-Out Scheme Functioned According to research from blockchain firm Chainalysis, Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas converted millions of dollars in crypto assets for front companies employing North Korean workers under fake credentials. In one tracked instance from late 2022 to early 2023, a developer contributing code to blockchain and DeFi projects received regular biweekly stablecoin salary payments. These funds were subsequently converted into ETH, transferred through consolidation wallets of sanctioned entities, routed to Boykov, and finally sent to sanctioned Russian exchange Garantex. Additionally, Obertas operated as a financial facilitator for North Korean officials. The Office of Foreign Assets Control (OFAC) revealed that Obertas converted nearly $2 million in crypto into fiat currency, receiving funds directly from sanctioned entity Amnokgang Technology Development Company. ## Sanctioned Personnel and Corporate Fronts OFAC also designated two North Korean managers stationed in Russia, Kim Ki Hyok and Kim Hyo Dong, along with the Russian-based entity First Financial and Technical Development Center (FFTDC). Six North Korean workers tied to FFTDC were also included in the action, having generated over $750,000 for the entity since 2025. Fake remote developer schemes represent a widespread security issue. The United Nations Panel of Experts estimates that these IT worker operations yield between $250 million and $600 million per year for North Korea, supplementing other state-sponsored cyber incidents like North Korea's illicit crypto operations. In April, investigator ZachXBT uncovered records revealing a fake-developer network that netted over $3.5 million, while security researcher Taylor Monahan noted North Korean developers had previously contributed code to prominent DeFi projects including SushiSwap and THORChain. Key details of the enforcement action include: - 10 individuals and 1 entity sanctioned by US authorities. - $2 million in crypto converted to fiat by Vitold Viktorovich Obertas. - $750,000+ earned by six designated workers for FFTDC since 2025. - $250M to $600M estimated annual revenue generated by North Korean IT remote workers. ## Why It Matters This enforcement action highlights how state-backed illicit networks exploit remote developer hiring practices and decentralized financial infrastructure to bypass international sanctions. As generative AI enables bad actors to deploy synthetic identities and deepfakes during hiring calls, crypto teams must adopt rigorous identity verification procedures. Moving forward, heightened compliance scrutiny will likely target OTC desks and off-ramps facilitating fiat conversion for high-risk jurisdictions.