The US action targets the cash-out stage of a scheme that the UN estimates generates $250 million to $600 million annually for North Korea.
The US Treasury has sanctioned 10 individuals and one entity for allegedly helping North Korean IT workers earn money through fraudulent employment at legitimate businesses and convert cryptocurrency into cash.
The action targeted financial intermediaries in a network that generates hundreds of millions of dollars annually for Pyongyang.
How the Cash-Out Chain Worked
According to a report by Chainalysis, Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas converted millions of dollars in crypto for front companies that placed North Korean IT workers at businesses under false identities. The workers’ earnings ultimately helped fund the North Korean regime and its weapons programs.
The blockchain analytics firm traced one payment trail to a developer who contributed code to blockchain and DeFi projects. From late 2022 to early 2023, the worker’s wallet received stablecoin payments every two weeks, resembling a regular salary.
Those funds were converted into ETH and sent through consolidation wallets associated with sanctioned entities, before being passed to Boykov, who forwarded the cryptocurrency to Garantex, a Russian exchange that was later sanctioned by US authorities.
Obertas was also accused of acting as a financial intermediary for North Korean officials, with his wallet receiving funds from another sanctioned organization, Amnokgang Technology Development Company, which was involved in managing overseas IT worker delegations.
According to the Office of Foreign Assets Control (OFAC), the Russian changed nearly $2 million worth of crypto into fiat currency for North Korean officials.
You may also like:
The designations also cover Kim Ki Hyok and Kim Hyo Dong, two North Korean nationals who managed IT workers based in Russia, along with First Financial and Technical Development Center (FFTDC), also based in the country, and six North Korean workers associated with it. Per Chainalysis, those six workers had generated more than $750,000 for FFTDC since 2025.
Fake Developer Identities Remain a Corporate Risk
As we have reported in the past, North Korean IT workers have been using fabricated identities and stolen credentials to secure jobs at legitimate companies, after which they transfer much of their income to the regime. The United Nations Panel of Experts estimates these operations generate $250 million to $600 million annually.
In April, blockchain investigator ZachXBT uncovered records linked to a North Korean fake-developer operation that generated more than $3.5 million in cryptocurrency, with another report from security researcher Taylor Monahan claiming that North Korean-linked developers had helped build some of the most prominent DeFi protocols, including SushiSwap and THORChain.
Chainalysis also warned that generative AI is making recruitment fraud harder to detect, with operatives using AI-generated resumes and profile photos, as well as deepfake video during hiring calls, to appear legitimate.
