OFAC Just Sanctioned the Crypto Cash-Out Route for North Korea's Fake IT Workers
The US Treasury just put names, numbers and wallet addresses on one of crypto's least visible money trails. On October 28, 2026, the Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity for supporting North Korean government-run IT worker schemes that defraud US businesses and funnel the proceeds toward the regime's weapons programs. Two Russian middlemen allegedly converted millions of dollars in cryptocurrency for the network, and eight crypto addresses on Ethereum and Tron are now on the sanctions list. For a crypto industry that spends most of its compliance energy on exchanges and mixers, this action is a reminder that the laundering route can also run through a payroll department.
What OFAC actually did
The designations target the financial conduits, not just the workers. The entity is the First Financial and Technical Development Center (FFTDC), described by Treasury as North Korean-controlled and based in Russia, whose six IT workers generated more than $750,000 for it since 2025. The individuals include eight North Koreans and two Russians. The sanctions freeze the designated parties' property in the United States or under the control of US persons, and US persons are generally barred from dealing with that property unless OFAC authorizes it. That last part is what turns a press release into a compliance event: any exchange, wallet provider or business that touches the listed addresses or parties without authorization is now exposed.
The money trail, in numbers
The figures Treasury published are unusually specific, and they map the whole route. Russian national Ilya Aleksandrovich Boykov allegedly exchanged and converted about $3.5 million in crypto transactions since 2024 for Alis, a company sanctioned in March 2024 and linked to North Korean IT workers. Blockchain analytics firm Chainalysis traced crypto earned by a North Korean IT worker to Boykov, who sent it to Garantex, the now-sanctioned Russian exchange, to cash out. Russian national Vitold Viktorovich Obertas allegedly conducted nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. North Korean national Kim Ki Hyok, who leads Alis LLC, transferred roughly $500,000 in crypto since 2024. The listed addresses break down as two Ethereum and two Tron addresses for Boykov, one Ethereum and three Tron addresses for Obertas, with one Ethereum address appearing on both lists.
The pattern Chainalysis described is the detail crypto compliance teams should study: fraudulent workers receiving regular stablecoin paychecks converted their salaries into ETH before moving balances to Boykov for cash-out through Garantex. Stablecoins in, ETH out, sanctioned exchange at the end. Each hop is individually ordinary — a salary payment, a swap, a transfer — which is why the scheme survived as long as it did. The sanctions list is, in effect, a map of the hops Treasury can now prove.
How the scheme works — and why AI made it worse
The workers obtain legitimate jobs at real companies, including in the United States and allied countries, using stolen identities, fraudulent documents and fabricated personas. North Korea then appropriates most of their wages, generating hundreds of millions of dollars for its weapons of mass destruction and ballistic missile programs, according to Treasury. Chainalysis notes that operatives have used generative AI to write resumes and cover letters and prepare for technical interviews, with AI-generated profile photos and deepfake video used in some cases to conceal identities during hiring calls.
The risk to employers goes beyond paying a disguised worker. Treasury says North Korean IT workers have used access to corporate networks to install malware, steal sensitive data and proprietary information, and extort businesses for substantial payments. Treasury Secretary Scott Bessent said the regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses. For crypto companies, which hire remote developers heavily and often pay in crypto, the exposure is double: a disguised hire is both a security risk inside the network and a sanctions risk in the payroll flow.
The wider crackdown this sits inside
This action does not stand alone. It follows a March 12 designation targeting a separate North Korean IT worker network, and an October Justice Department crackdown affecting more than 70 American companies. Australia and the European Union also imposed sanctions against people and entities supporting North Korea's IT worker schemes this month. The direction is clear: what was once treated as an employment-fraud curiosity is now being pursued as a coordinated, multi-country financial-enforcement campaign, with crypto conversion as one of its named pillars.
What this means for crypto hiring and compliance
Three practical consequences follow. First, the eight listed addresses are now radioactive for any compliant platform: screening must catch them, and any historical exposure to them needs review. Second, remote hiring diligence is now a sanctions-control issue, not just an HR issue — identity verification for developers, especially those paid in crypto, has to be robust enough to catch AI-assisted impersonation, not just forged paperwork. Third, the Garantex link reinforces a pattern regulators keep returning to: sanctioned venues remain the cash-out point for schemes that start in entirely legitimate-looking employment. Exchanges that cannot show they screen for downstream exposure to such venues will keep appearing in these announcements.
What to watch from here
Whether more designations follow this network's other intermediaries — the March-to-October cadence suggests Treasury is working through a list, not firing a single shot. Whether the Justice Department's company crackdown produces charges that name crypto payroll flows explicitly. And whether hiring platforms and crypto payroll providers respond with stronger verification, since the AI-assisted impersonation detail makes the old checklist of resume plus video call look thin. The workers' wages were real work, paid by real companies, for real code — and that is precisely what made the scheme hard to see until the money trail was mapped.
FAQ
What did OFAC do on October 28, 2026? Sanctioned 10 individuals and one entity — the Russia-based, North Korean-controlled First Financial and Technical Development Center — for supporting North Korean IT worker fraud schemes.
How much crypto was involved? Treasury alleges Boykov converted about $3.5 million in crypto since 2024, Obertas nearly $2 million in crypto plus at least $1.25 million in other currencies since January 2025, and Kim Ki Hyok about $500,000 in crypto since 2024.
Which crypto addresses were listed? Eight addresses on Ethereum and Tron, split between Boykov and Obertas, with one Ethereum address appearing on both listings.
How did the scheme use crypto? Workers received stablecoin paychecks from deceitfully obtained jobs, converted them to ETH, and moved them through intermediaries to Garantex, a sanctioned Russian exchange, to cash out.
Were any exchanges named in the Treasury release? The release itself names no exchanges; the Garantex link comes from Chainalysis tracing reported alongside the action.
Why should crypto companies care? Beyond sanctions screening for the listed addresses, remote-developer hiring is now a sanctions and security control: AI-assisted impersonation can defeat weak identity checks, and a disguised hire can also plant malware or exfiltrate data.
For more market news and discussion, follow Zimbuck News at https://zimbuck.com/pages/zimbucknews and join the Zimbuck Market News group at https://zimbuck.com/groups/zimbuckmarketnews. Related reading on the site: the regulation angle in our Ripple charter coverage at https://zimbuck.com/blogs/344/Ripple-s-Bank-Charter-Week-RLUSD-Lands-on-Coinbase-as
This article is market news and general information only, not financial advice.
