The U.S. Treasury Department has sanctioned 10 individuals and one entity over North Korean government-run information-technology worker schemes that allegedly defraud American businesses and channel money into Pyongyang’s weapons programs.
The action, announced on Wednesday, includes two Russian nationals accused of converting millions of dollars in cryptocurrency for North Korean networks. Treasury’s sanctions listings also identify Ethereum and Tron wallet addresses, including one Ethereum address associated with both men.
According to Decrypt, the schemes rely on fake documents, stolen identities and invented online personas to place North Korean IT workers in legitimate jobs. The workers’ wages are then largely taken by the North Korean regime. Treasury said these operations generate hundreds of millions of dollars for the country’s weapons of mass destruction and ballistic missile programs.
Russian intermediaries and crypto transfers
Treasury identified Vitold Obertas as a Russian intermediary involved in North Korean financial transactions. Since January 2025, Obertas has carried out nearly $2 million in cryptocurrency conversions for North Korean officials, in addition to at least $1.25 million in transactions involving other currencies, the department said.
The second Russian national, Ilya Boykov, has exchanged or converted the equivalent of $3.5 million in cryptocurrency since 2024 for Limited Liability Company Alis. Treasury sanctioned Alis in 2024 and describes it as a North Korean IT worker company.
The sanctions records list two Ethereum addresses and two Tron addresses for Boykov. Obertas’s entries include one Ethereum address and three Tron addresses. One Ethereum address appears in the listings for both individuals, linking the two sanctions records through the same crypto address.
Treasury Secretary Scott Bessent said North Korea’s overseas IT operatives continue to target U.S. companies through fraudulent activity. He said the operatives can exploit sensitive data and pressure businesses into making substantial payments.
Sanctions generally restrict U.S. persons and entities from dealing with designated people and organizations, while also placing listed property and interests in property under U.S. jurisdiction on hold. The source material does not specify the value of assets frozen as a result of this action.
Entity in Vladivostok and North Korean delegations
The Treasury action also targets the First Financial and Technical Development Center, a North Korean-controlled organization based in Vladivostok, Russia. The department said the center deploys highly trained IT workers who use artificial-intelligence tools and complicated cryptocurrency transfers to generate revenue.
According to Treasury, six North Korean IT workers based in Russia have generated more than $750,000 for the center since 2025. Two North Korean nationals who lead Russia-based IT worker delegations were also sanctioned.
One of those individuals, Kim Ki Hyok, has transferred nearly $500,000 in cryptocurrency for his delegation since 2024, Treasury said. The figures cited by the department illustrate how employment fraud, overseas intermediaries and digital-asset transactions can be combined in a single revenue network.
Treasury said North Korea uses artificial intelligence, cryptocurrency transactions and money laundering techniques to move millions of dollars to the regime. The department’s account frames the issue as both a cybersecurity concern for businesses and a sanctions-enforcement issue because the proceeds support prohibited weapons programs.
The latest designations follow U.S. sanctions against a separate North Korean IT worker network announced in March. Treasury also said Australia and the European Union issued their own designations this month, indicating that the issue has drawn action from several jurisdictions.
North Korea’s expanding focus on crypto businesses
The networks described by Treasury are part of a broader pattern involving cryptocurrency companies and projects. In April 2025, Google’s Threat Intelligence Group reported that North Korean IT workers had embedded themselves in crypto projects in the United Kingdom, Germany, Portugal and Serbia. The activity included Solana smart-contract development, and some workers reportedly operated under as many as 12 fake identities at the same time.
North Korean-linked actors have also been accused of using extended deception campaigns against crypto firms. Solana-based exchange Drift Protocol said in April that an attack which drained about $285 million from its platform was a six-month operation by a North Korean state-affiliated group. The group’s intermediaries reportedly met Drift contributors in person while presenting themselves as a quantitative trading firm.
The sanctions do not establish that every cryptocurrency business or worker using the identified blockchains is connected to the scheme. Rather, the listings name specific people, an entity and wallet addresses that Treasury links to the activities described in its announcement.
Moneyiar market picture
Moneyiar market data recorded on October 25, 2026, at about 22:38-22:39 Tehran time showed mixed performance among the tracked assets:
- ORDI was priced at $3.5491459276, down 1.4% over 24 hours and 2.54% over seven days.
- Walrus (WAL) traded at $0.0343190471, down 0.3% in 24 hours and 11.97% over seven days.
- Loaded Lions (LION) stood at $0.0011817703, down 2.39% over 24 hours and 3.06% over seven days.
- Ore (ORE) was priced at $164.7502665491, up 4.48% over 24 hours and 56.42% over seven days.
These figures are Moneyiar data at the stated time and are separate from the Treasury’s sanctions announcement.
