Treasury Sanctions Russia-Based Network Accused of Moving Millions for North Korean IT Workers
OFAC designated 10 people and one entity, alleging that Russian intermediaries and North Korean teams used cryptocurrency and other transfers to move millions from fraudulent remote work.
The U.S. Treasury Department has sanctioned 10 people and one entity over what it calls a North Korean government operation that placed disguised IT workers inside American companies and moved their earnings through Russia. The Oct. 28 action reaches two Russian intermediaries, eight North Korean nationals and the First Financial and Technical Development Center, a North Korean-controlled organization that Treasury says operates in Vladivostok.
Treasury alleges that Vitold Obertas converted nearly $2 million in cryptocurrency and handled at least $1.25 million in other currency transactions for North Korean officials after January 2025. It says Ilya Boykov exchanged the equivalent of $3.5 million in cryptocurrency since 2024 while supporting Alis, a previously sanctioned North Korean company.
The action also names two alleged delegation leaders. Treasury says Kim Ki Hyok transferred cryptocurrency worth nearly $500,000 for a Russia-based Alis team, while Kim Hyo Dong moved more than $100,000 and provided logistical help to another group. Six further workers tied to the sanctioned center allegedly generated more than $750,000 from Russia after 2025.
The action is an administrative sanctions measure, not a criminal conviction. Treasury's transaction figures and descriptions are government allegations; the public designation record does not show that a court has tested them.
Reuters independently reported the sanctions and said North Korea's mission to the United Nations did not immediately respond to a request for comment. The Record separately traced the action to Russian facilitators and the North Korean teams. Its shorthand figure for Obertas differs from Treasury's itemized account, so this report retains the official breakdown rather than combining the totals.
The sanctions are separate from the Justice Department cases announced on Oct. 13. In Ohio, prosecutors alleged that one remote-work scheme reached more than 70 U.S. employers and generated about $3 million. In Texas, Operation Lonestar Roundup targeted alleged laptop farms and seized roughly 187 laptops and keyboard-video-mouse devices. Those criminal allegations concern different defendants and conduct from the people named in Treasury's Oct. 28 list.
Treasury's transaction figures and operational descriptions are allegations underlying administrative sanctions, not court findings. Reuters reported that North Korea's UN mission did not immediately respond. The Record's shorthand amount for Vitold Obertas differs from Treasury's itemized breakdown; this article uses Treasury's separate figures and does not aggregate them.
Sources & further reading
- Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. CompaniesU.S. Department of Justice · National Security
- North Korea Designations; Democratic Republic of the Congo-related DesignationsU.S. Treasury / OFAC
- US sanctions Russians, North Koreans for laundering IT worker earningsThe Record
- US sanctions North Korean network accused of defrauding businessesReuters
- Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. BusinessesU.S. Department of the Treasury
SPY REGISTER MEMBERSHIP
Stay on the case.
Follow this story through the case files, read The Brief and keep your own saved reports.
$6.67 a month equivalent · $80 billed annually. Or $8 monthly.
Get the member edition →Renews automatically. Cancel renewal online.
