OFAC sanctions DPRK IT worker fraud network and cash-out facilitators

The U.S. Treasury Department’s Office of Foreign Assets Control sanctioned 10 individuals and one entity on Oct. 28, 2026, targeting a North Korean IT worker network that Treasury said generated revenue for the regime’s weapons programs by posing as legitimate remote workers and moving proceeds through cryptocurrency channels, according to Treasury and Chainalysis.

Evidence and context

Chainalysis said the latest action targets Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas, along with DPRK nationals Kim Ki Hyok and Kim Hyo Dong, for roles in a broader scheme that placed North Korean IT workers at U.S. companies under false pretenses and converted earnings into cash. Treasury said the network is part of a long-running effort by North Korea to use overseas IT employment, intermediaries and digital assets to generate funds for the regime and its weapons programs.

According to Chainalysis, Obertas converted $2 million worth of cryptocurrency for DPRK officials since early 2025, while its on-chain analysis says the relationship extends back to early 2023. Chainalysis also said Boykov moved crypto linked to front companies used to cover DPRK IT workers, including Alis and Amnokang, to the sanctioned Russian exchange Garantex for cash-out. The report said Kim Ki Hyok and Kim Hyo Dong managed groups of IT workers based in Russia and collected the cryptocurrency income they generated.

Treasury’s action also designated the Russian-based First Financial and Technical Development Center, or FFTDC, which Chainalysis described as a DPRK-controlled entity that deploys overseas IT workers. Chainalysis said six Russia-based DPRK IT workers collectively generated more than $750,000 for FFTDC since 2025, and Treasury said the six individuals were also sanctioned.

The case underscores a shift in the threat environment Treasury has described for years: North Korean operatives using stolen identities, fabricated resumes, proxy infrastructure and money-laundering intermediaries to evade screening and move earnings back to Pyongyang. Chainalysis said the network increasingly relies on artificial intelligence to write resumes, tailor cover letters, prepare for interviews and, in some cases, generate profile photos and deepfake video to support the deception.

Treasury has previously warned that North Korean IT worker schemes can expose companies to sanctions risk, data theft and other security breaches. The department’s wider campaign against DPRK sanctions evasion has included prior actions in 2025 and March 2026, which Treasury said targeted facilitators involved in similar IT worker and laundering activity. The latest designations continue that pattern by focusing on the financial conduits that turn workers’ earnings into spendable funds for the regime.