US Sanctions Hit Two Russians Over Alleged $5.5M Crypto Conversions for North Korea

On October 28, 2026, fresh US sanctions were levied against 10 individuals and a single entity linked to North Korean IT employee operations. Two Russian facilitators are accused of exchanging approximately $5.5 million in cryptocurrency, effectively funneling payroll funds from legitimate businesses toward North Korea’s military programs.

Today, Treasury’s Office of Foreign Assets Control sanctioned 10 individuals and one entity for their roles in Democratic People’s Republic of Korea (DPRK) government-run IT worker schemes that defraud U.S. businesses and generate revenue for the DPRK’s unlawful weapons of mass…

— Treasury Department (@USTreasury) October 28, 2026

US Sanctions Target Intermediaries Behind the Crypto Conversions

According to the Treasury’s Office of Foreign Assets Control, Ilya Aleksandrovich Boykov has exchanged roughly $3.5 million in digital assets since 2024 for a North Korean IT enterprise known as Alis. Meanwhile, CoinDesk reports that Vitold Viktorovich Obertas allegedly converted nearly $2 million on behalf of North Korean officials starting in January 2025.

Additionally, Obertas reportedly managed at least $1.25 million across separate currency transactions. That figure remains distinct from the estimated $5.5 million in total cryptocurrency swaps tied to the two men.

Blockchain Tracing Connects the Networks to Exchanges

Chainalysis followed digital currency earned by a North Korean IT worker directly to Boykov, who then routed the assets to the Russian exchange Garantex to liquidate them into cash. Garantex has faced US sanctions since April 2022.

Furthermore, the analytics provider discovered that Obertas’ wallet received funds from Amnokgang, an IT worker agency sanctioned on March 12. BeInCrypto noted that Obertas deposited funds into both prominent commercial platforms and sanctioned exchanges.

IT Worker Schemes Put Corporate Data at Risk

The Treasury states that these rings utilize stolen identities, forged paperwork, and fabricated profiles to land positions at mainstream organizations. Pyongyang seizes the vast majority of these employees’ wages, redirecting payouts intended for programming and IT services directly to the government.

The threat extends past stolen payroll. The Treasury reports that North Korean personnel have leveraged access to corporate networks to plant malware and steal sensitive corporate and proprietary data. Chainalysis adds that operatives have also deployed generative AI to streamline recruitment and mask their true identities.

As detailed by Decrypt, the blacklistings encompass the First Financial and Technical Development Center, a North Korea-backed organization situated in Vladivostok, Russia. The Treasury notes that this center dispatches highly proficient IT professionals who leverage artificial intelligence and sophisticated crypto routing to produce income.

Sanctions Exposure and Blocking Duties

The mainstream exchanges that accepted Obertas’ deposits were not publicly identified, and the Treasury did not specify the dates of those transfers. The Treasury cautions that certain operations involving sanctioned parties can expose financial institutions and third parties to punitive measures.

OFAC maintains the authority to levy civil penalties under a strict liability framework. The Treasury also emphasizes that non-US persons are prohibited from causing US individuals to violate sanctions, whether intentionally or inadvertently. Furthermore, the fresh designations increase secondary sanctions exposure pursuant to North Korea regulations.

US residents and entities holding assets tied to the designees are required to freeze and report them. Chainalysis states that transactions involving these blacklisted addresses now fire sanctions alerts for its compliance clients, depending on how their filters are configured.

FAQ

When was Alis, the company linked to Boykov’s conversions, sanctioned?

Alis was sanctioned in March 2024. Treasury identifies it as a North Korean IT worker company for which Boykov allegedly converted cryptocurrency beginning in 2024.

How much did the six designated workers generate for the First Financial and Technical Development Center?

Treasury says the six designated workers generated more than $750,000 for the center since 2025. They were North Korean IT workers based in Russia.

How did the workers use AI tools during recruitment?

Chainalysis says operatives used generative AI to write resumes and cover letters and prepare for technical interviews. In some cases, AI-generated profile photos and deepfake video helped conceal their identities during hiring calls.

What must US persons do with property belonging to the designated persons?

US persons must block the designees’ property in their possession and report it to OFAC. The October 28 action applies these obligations to the newly designated individuals and entity.

What happened to Garantex’s web domains in March 2025?

US authorities seized Garantex’s web domains in March 2025. The exchange had already been subject to US sanctions since April 2022.

This article is for information only and is not financial advice.