Blockchain analytics company Chainalysis has traced a long-running network that allegedly helped North Korean information-technology workers convert cryptocurrency into cash through Russian intermediaries and the sanctioned exchange Garantex. The findings followed US sanctions against 10 individuals and one entity accused of supporting North Korean government-run IT worker schemes linked by Washington to the country’s weapons programs.
How the cash-out network worked
According to Cointelegraph, the US Treasury Department’s Office of Foreign Assets Control announced the sanctions on Wednesday. Among those targeted were Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas.
Treasury said Boykov had converted about $3.5 million in cryptocurrency for Alis, a sanctioned company, since 2024. Obertas allegedly handled almost $2 million in crypto conversions for North Korean officials from January 2025 onward.
Chainalysis described one transaction pattern involving a wallet associated with a North Korean IT worker. The wallet received recurring payments in stablecoins, digital tokens designed to maintain a relatively stable value, before the funds were exchanged for Ether, the cryptocurrency of the Ethereum network. The Ether then moved through consolidation addresses—wallets used to combine funds—before reaching Boykov.
Boykov subsequently sent the cryptocurrency to Garantex, where it was converted as part of the cash-out process. The sanctions and the blockchain analysis together illustrate how digital-asset transactions can be followed across multiple wallets and intermediaries, even when the people behind those wallets use different identities or services.
The wider North Korean IT worker threat
North Korean IT workers using false identities to secure jobs have remained a persistent security concern for crypto companies, according to the source material. These schemes can allow workers to obtain access to company systems or receive payments while concealing their connection to North Korea.
The US Department of Justice said in June 2025 that it had charged four North Korean nationals in a scheme involving fraudulent IT employment. The case also involved the theft of more than $900,000 from cryptocurrency companies in the United States and Serbia.
The latest Treasury action focuses on people and an entity accused of helping process funds tied to North Korean IT worker operations. The allegations concern financial activity connected to weapons-program funding; the sanctions do not establish criminal guilt beyond the government’s stated accusations.
Moneyiar market picture
Moneyiar data recorded the following prices and performance at the stated times on October 25, 2026:
- Gram (prev. Toncoin) (GRAM): $1.2600996282, up 0.61% over 24 hours and down 6.31% over seven days, as of 22:39.
- OriginTrail (TRAC): $0.3709267304, down 3.98% over 24 hours and 5.10% over seven days, as of 22:38.
- FUNToken (FUN): $0.0089182414, up 1.62% over 24 hours and 0.08% over seven days, as of 22:39.
- ONEchain (ONE): $0.1019913497, down 0.44% over 24 hours and up 1.74% over seven days, as of 22:38.
These market figures are Moneyiar data and are separate from the sanctions and transaction analysis described above.
