The U.S. Treasury Department has sanctioned 10 individuals and one company over an alleged North Korean scheme that uses fake foreign IT workers to earn money from overseas employers and move the proceeds back to the regime.
According to Bitcoin Magazine, the action places particular emphasis on the financial intermediaries who converted and transferred the workers’ earnings, rather than focusing only on the workers using false identities. Treasury said much of the money ultimately supports North Korea’s weapons of mass destruction and ballistic missile programs.
The alleged operation relies on workers taking jobs at legitimate companies under invented personas. The scheme can involve AI-generated résumés, altered photographs and deepfake video in job interviews. Treasury also said some workers have obtained access to company networks, where they planted malware or stole proprietary information.
Russian crypto intermediaries targeted
Two Russian nationals are central to the sanctions announcement. Treasury identified Vitold Obertas as a go-between for North Korean financial transactions. Since January 2025, he allegedly handled almost $2 million in cryptocurrency conversions and at least $1.25 million in transfers involving other currencies for North Korean officials.
Ilya Boykov was accused of converting the equivalent of $3.5 million in cryptocurrency for Alis, a North Korean IT worker company that the United States sanctioned in 2024. Treasury’s action therefore covers both crypto conversion activity and the wider network used to collect and transfer compensation from foreign employers.
The designation also names two North Korean nationals who allegedly led worker groups operating from Russia. Kim Ki Hyok reportedly moved nearly $500,000 in cryptocurrency for his team since 2024. Kim Hyo Dong was also sanctioned.
Treasury additionally designated the First Financial and Technical Development Center, described as a North Korean-controlled organization operating in Russia. Six workers associated with the entity have generated more than $750,000 for it since 2025, according to the department.
Wallet addresses and sanctions consequences
Treasury published Ethereum and Tron wallet addresses associated with the sanctioned people. The move gives exchanges and other financial companies identifiers they can use when monitoring transactions linked to the designated network. One Ethereum address is associated with both Obertas and Boykov.
The sanctions block any property belonging to the designated individuals or entity that is located in the United States or controlled by U.S. persons. Such property must be reported to the Office of Foreign Assets Control. Transactions with the sanctioned parties are generally prohibited unless authorized by a license.
The restrictions also apply to entities that are owned 50% or more by blocked parties. Treasury warned that civil penalties may apply even when a violation was not intentional, increasing the compliance significance for financial institutions, crypto businesses and companies that engage overseas contractors.
The latest action follows a separate designation in March involving another North Korean IT worker network. Treasury said that network had laundered approximately $800 million in cryptocurrency for the regime. Australia and the European Union announced related designations during the month, and the United States coordinated the move with the Multilateral Sanctions Monitoring Team.
Implications for companies hiring remote workers
The case connects employment fraud, cybersecurity risks and cryptocurrency transfers. A company may believe it is hiring a remote technology contractor, while the person’s identity, location or employment history may have been misrepresented. Access to internal systems can create a second risk beyond the payment of wages.
Advisories from the State, Treasury and Justice departments and the FBI recommend that employers verify worker identities, examine where payments are being sent and pay attention to unusual requests for system access. These measures are intended to help companies identify arrangements that could involve North Korean workers or financial networks.
The sanctions do not prohibit all remote contracting or cryptocurrency activity. They specifically impose restrictions on dealings with the designated people, organization and covered entities, while placing responsibility on companies and financial intermediaries to screen transactions and counterparties.
Moneyiar market picture
Moneyiar data recorded on October 25, 2026, at the stated times showed Bitcoin at $80,430.51, down 0.08% over 24 hours and 1.32% over seven days. Gram (previously Toncoin) was $1.2601, up 0.61% in 24 hours but down 6.31% over seven days.
Monad stood at $0.02155, declining 0.49% over 24 hours while gaining 2.33% over seven days. AKEDO was $0.03102, up 0.80% over 24 hours and 2.50% over seven days. These figures are Moneyiar market data and describe prices and percentage changes at the supplied times; they do not indicate a direct market reaction to the Treasury action.
