Treasury Sanctions Russian Crypto Middlemen Serving North Korean IT Workers

От Coinvote

Опубликовано October 29, 2026 - 15:22 UTC | 5 мин. чтения

The US Treasury sanctioned ten people and one entity tied to North Korean IT worker schemes, naming two Russian nationals who allegedly converted millions in crypto for the regime. Published Ethereum and Tron addresses give exchanges concrete targets to screen.

Treasury goes after the people who cash out the wages

The US Treasury Department sanctioned ten individuals and one entity this week for helping North Korea profit from fake IT worker schemes, according to Bitcoin Magazine, Cointelegraph and Decrypt. Treasury says the proceeds support the regime's ballistic missiles and its arms capable of mass destruction.

The designations focus on the people who handle the money rather than on the workers alone. Two Russian nationals, Ilya Boykov and Vitold Obertas, sit at the center of the action. CoinDesk reported that Boykov is accused of exchanging roughly $3.5 million in crypto and Obertas nearly $2 million, both on North Korea's behalf.

How the fake-worker schemes operate

Decrypt relayed Treasury's description of the method. Fake documents, stolen identities and invented personas place IT workers at legitimate companies, and the regime then keeps most of their pay. Bitcoin Magazine added that applicants sometimes submit résumés produced by AI, edited pictures or fabricated video of themselves in job interviews.

Money is not the only risk for employers. Bitcoin Magazine reported that some of these workers gained access to corporate networks, where they planted malware and took proprietary data. Treasury Secretary Scott Bessent said the operatives "weaponize sensitive data and extort businesses for substantial payments."

Crypto companies have been a repeated target. Decrypt recalled that Google's Threat Intelligence Group reported in April 2025 that such workers had embedded themselves in projects in the UK, Germany, Portugal and Serbia, some using as many as 12 fake identities at once. Cointelegraph pointed to charges announced in June 2025 against four North Korean nationals over a scheme that involved fraudulent IT employment and the stealing of upwards of $900,000 from crypto firms in the US and Serbia.

The amounts and addresses Treasury attached to each name

Treasury's listings put numbers on each role, as relayed by the outlets. Decrypt also reported that the listings include wallet addresses on two networks, and Bitcoin Magazine said publishing them tells exchanges and other financial companies which accounts to monitor.

Obertas, described by Treasury as an intermediary for North Korean financial dealings, allegedly processed close to $2 million in crypto exchanges for North Korean officials starting in January 2025, together with no fewer than $1.25 million moved through other currencies.
Boykov is alleged to have exchanged crypto worth $3.5 million since 2024 on behalf of Alis, a North Korean IT worker firm that was sanctioned in 2024.
Kim Ki Hyok, who leads a Russia-based worker delegation, has transferred nearly $500,000 in crypto for it since 2024, according to Treasury.
The First Financial and Technical Development Center, a North Korean-controlled entity based in Vladivostok, was sanctioned, as were six workers who have brought in over $750,000 for it from 2025 onward.
Boykov's entry lists two Ethereum and two Tron addresses, Obertas's lists one Ethereum and three Tron addresses, and one Ethereum address appears on both.

Chainalysis shows one route out through Garantex

Cointelegraph reported that blockchain analytics firm Chainalysis published its own analysis the same day, mapping a long-running network of Russian intermediaries. In one example, a wallet tied to a North Korean IT worker received regular stablecoin payments and converted them into Ether. The funds then moved through consolidation addresses to Boykov, who sent the crypto on to the Russian exchange Garantex to cash out.

That path shows why intermediaries matter. Consolidation addresses gather many small payments into larger balances, which makes later conversion into other currencies simpler. Ethereum and Tron both appear in the sanctions listings, and DefiLlama puts DeFi value locked at $45.92 billion on Ethereum and $5.55 billion on Tron, so both networks offer deep places to move funds.

Where the outlets agree and where they differ

The core facts match across outlets: ten individuals, one entity, and the same headline figures for Boykov and Obertas. The timing does not. Bitcoin Magazine says Treasury acted on Tuesday, while Cointelegraph and Decrypt say Wednesday. Treasury's own post, embedded by Decrypt, is dated October 28, 2026.

Each outlet adds something different. CoinDesk's available summary carries only the two headline conversion figures. Decrypt supplies the address counts and a headline claim that the two Russians converted more than $5 million, plus a reminder that Drift Protocol attributed an April attack, which drained about $285 million, to a North Korean state-affiliated group that had spent six months on the operation. Cointelegraph contributes the Chainalysis tracing, and Bitcoin Magazine explains the legal consequences for companies.

What the designations mean for exchanges and hiring teams

According to Bitcoin Magazine, any assets of the sanctioned parties located in the United States or held by US persons are now frozen, and holders must notify the Office of Foreign Assets Control. Transactions are generally prohibited unless licensed, and the same restrictions reach companies owned 50 percent or more by blocked parties. Treasury cautioned that a company can face civil penalties for a breach it did not intend.

Bitcoin Magazine also noted that Treasury coordinated with the Multilateral Sanctions Monitoring Team, and that Australia and the European Union announced related designations this month. The action follows a March designation of a different network, which Treasury said had washed about $800 million in crypto on behalf of the regime.

For hiring teams, the same outlet pointed to advisories from the State, Treasury and Justice departments and the FBI. They advise confirming who applicants really are, tracing the destination of payments and staying alert to odd requests for system access. Teams that track new tokens, such as those on Coinvote's new Ethereum token listings, can apply the same checks to remote contractors.

Open questions to watch

The sources do not say whether the listed wallets still hold funds or whether exchanges have frozen any balances. It is also unclear whether Treasury will add more addresses as analysts such as Chainalysis trace additional routes.

Another open question is how the Russia-based delegations respond. Treasury described the Vladivostok center as deploying trained workers who use AI tools and complex crypto transfers, and the reports do not say whether the sanctions have disrupted that activity.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$81,414	+1.0%	-0.8%	$1.64 trillion
Ethereum (ETH)	$2,356	+0.9%	-2.8%	$287.83 billion
TRON (TRX)	$0.331131	+0.0%	+0.2%	$31.46 billion

CoinGecko data as of 2026-10-29 (UTC); DeFi TVL from DefiLlama: Ethereum $45.92 billion, Tron $5.55 billion.

On Coinvote

New Ethereum Tokens Listed Today: 2,929 projects tracked, 3 new listings in 7 days, 0 community votes today.
Best Ethereum Meme Coins Today: 258 projects tracked, 2 new listings in 7 days, 0 community votes today.

FAQ

Who did the US Treasury sanction over North Korean IT worker schemes?

Treasury sanctioned ten individuals and one entity, according to Decrypt and Cointelegraph. They include Russian nationals Ilya Boykov and Vitold Obertas, two North Korean delegation leaders, and the First Financial and Technical Development Center.

How much crypto did the sanctioned Russians allegedly convert?

Treasury said Boykov converted the equivalent of $3.5 million in crypto for Alis since 2024. It said Obertas processed close to $2 million in crypto exchanges for North Korean officials starting in January 2025, together with no fewer than $1.25 million moved through other currencies.

Which blockchains appear in the sanctions listings?

Decrypt reported that the listings include Ethereum and Tron addresses. Boykov has two of each, Obertas has one Ethereum and three Tron addresses, and a single Ethereum address is shared by the two entries.