US Sanctions Hit Two Russians Over Alleged $5.5M Crypto Conversions for North Korea
The United States has sanctioned two Russian facilitators for allegedly converting approximately $5.5 million in cryptocurrency to fund North Korea's weapons programs through fraudulent IT worker operations.
On October 28, 2026, the United States imposed sanctions on 10 individuals and one entity connected to North Korean IT worker operations. Among them, two Russian facilitators reportedly converted approximately $5.5 million in digital assets, helping channel earnings from legitimate companies straight into North Korea’s weapons programs.
Today, Treasury’s Office of Foreign Assets Control sanctioned 10 individuals and one entity for their roles in Democratic People’s Republic of Korea (DPRK) government-run IT worker schemes that defraud U.S. businesses and generate revenue for the DPRK’s unlawful weapons of mass…
— Treasury Department (@USTreasury) October 28, 2026
Advertisement
US Sanctions Target Intermediaries Behind the Crypto Conversions
According to the Treasury Department’s Office of Foreign Assets Control (OFAC), Ilya Aleksandrovich Boykov has converted roughly $3.5 million in cryptocurrency for Alis—a North Korean IT worker enterprise—since 2024. Meanwhile, Vitold Viktorovich Obertas is accused of converting close to $2 million for North Korean representatives beginning in January 2025, CoinDesk reported.
Obertas additionally managed at least $1.25 million across separate currency transactions, a sum separate from the nearly $5.5 million in joint cryptocurrency conversions handled by the two individuals.
Blockchain Tracing Connects the Networks to Exchanges
Blockchain analysis firm Chainalysis followed digital funds generated by a North Korean tech employee directly to Boykov, who subsequently moved the money onto the Russian trading platform Garantex to liquidate it for cash. Garantex has been under US penalties since April 2022.
Investigators at Chainalysis also discovered that Obertas received cryptocurrency into his wallet from Amnokgang, a technology worker firm placed under sanctions on March 12. Obertas transferred capital into both standard commercial and penalized platforms, as noted by BeInCrypto.
IT Worker Schemes Put Corporate Data at Risk
The Treasury states that these clandestine networks rely on stolen identities, forged paperwork, and fabricated online profiles to land software engineering and tech jobs at legitimate businesses. The North Korean regime seizes the bulk of these wages, diverting income earned from development work back to the state.
The dangers stretch beyond corporate payrolls. The Treasury highlights that North Korean IT professionals have leveraged access to company networks to deploy malware, siphon confidential data, and steal proprietary assets. Chainalysis adds that operatives have also utilized generative artificial intelligence to streamline the hiring process and conceal their true identities.
The enforcement actions also target the First Financial and Technical Development Center, an entity controlled by North Korea and operating out of Vladivostok, Russia. The Treasury reports that this center deploys highly skilled IT personnel who leverage AI applications and complex cryptocurrency transactions to raise funds, according to Decrypt.
Sanctions Exposure and Blocking Duties
The Treasury did not identify the commercial exchanges that took in Obertas’ deposits, nor did it specify the exact timing of those transactions. Officials caution that certain dealings involving blacklisted parties can expose financial institutions and third parties to punitive measures.
OFAC enforces strict liability penalties for violations. Furthermore, the Treasury emphasizes that non-US citizens are barred from causing US citizens to breach sanctions regulations, regardless of whether it is done knowingly or inadvertently. These new designations additionally increase secondary penalties under North Korea-related restrictions.
US residents and entities possessing assets tied to the targeted parties are legally required to freeze and report them. Chainalysis noted that transactions involving the blacklisted crypto addresses will now trigger compliance alerts for its platform users, depending on their individual configuration settings.
FAQ
When was Alis, the company linked to Boykov’s conversions, sanctioned?
Alis was sanctioned in March 2024. Treasury identifies it as a North Korean IT worker company for which Boykov allegedly converted cryptocurrency beginning in 2024.
How much did the six designated workers generate for the First Financial and Technical Development Center?
Treasury says the six designated workers generated more than $750,000 for the center since 2025. They were North Korean IT workers based in Russia.
How did the workers use AI tools during recruitment?
Chainalysis says operatives used generative AI to write resumes and cover letters and prepare for technical interviews. In some cases, AI-generated profile photos and deepfake video helped conceal their identities during hiring calls.
What must US persons do with property belonging to the designated persons?
US persons must block the designees’ property in their possession and report it to OFAC. The October 28 action applies these obligations to the newly designated individuals and entity.
What happened to Garantex’s web domains in March 2025?
US authorities seized Garantex’s web domains in March 2025. The exchange had already been subject to US sanctions since April 2022.
This article is for information only and is not financial advice.
