U.S. Treasury Sanctions 10 Individuals and a Company for North Korea Worker Fraud

On Tuesday, the U.S. Treasury Department imposed sanctions on ten individuals and a single company, alleging they assisted North Korea in collecting wages from foreign employers—many of them American—by using false identities and fraudulent documents.

These workers are generally placed at legitimate firms under fake personas, sometimes using AI-generated resumes, altered photos, or deepfake videos during interviews.

Most of their earnings are sent back to the regime, which the Treasury says uses the funds to finance its weapons of mass destruction and ballistic missile programs. Some of these workers have also gained entry to corporate networks, where they have planted malware and stolen proprietary data.

The money and crypto behind North Korean fraud

Rather than targeting the workers directly, the sanctions are focused on the people who move the money. Two Russian nationals are at the heart of the operation.

Vitold Obertas, described by Treasury as an intermediary for North Korean financial transactions, allegedly handled nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025.

Ilya Boykov is accused of converting about $3.5 million worth of cryptocurrency for Alis, a North Korean IT worker company that the U.S. sanctioned in 2024.

Also named were two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, for leading Russia-based worker delegations. Since 2024, Kim Ki Hyok has reportedly moved nearly $500,000 in cryptocurrency for his team.

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who have generated over $750,000 for it since 2025.

The Treasury released wallet addresses on the Ethereum and Tron blockchains linked to the sanctioned individuals, signaling to exchanges and financial firms to monitor those accounts. One Ethereum address is tied to both Obertas and Boykov.

This action follows a March designation of a separate North Korean IT worker network, which Treasury said had laundered roughly $800 million in crypto for the regime. Australia and the European Union have also announced related designations this month, and Treasury coordinated the move with the Multilateral Sanctions Monitoring Team.

Under the sanctions, any property these individuals or entities hold in the United States, or that is controlled by U.S. persons, is blocked and must be reported to the Office of Foreign Assets Control. Transactions with them are generally prohibited unless licensed, and companies owned 50 percent or more by blocked parties face the same restrictions. Treasury warned that civil penalties can apply even when a violation was unintentional.

For companies that hire remote contractors, advisories from the State, Treasury, and Justice departments and the FBI offer guidance on spotting these schemes, including verifying identities, checking where payments go, and watching for unusual access requests.