US authorities sanctioned a crypto cash-out network accused of turning North Korean undercover IT workers’ earnings into weapons funding.
The Oct. 28 Treasury action targets 10 individuals and one entity, including two Russian nationals accused of facilitating approximately $5.5 million in cryptocurrency transactions for North Korean operations over different periods.
A separate Chainalysis investigation traced salary payments to an undercover developer who contributed code to blockchain and decentralized finance (DeFi) projects, showing how earnings from legitimate crypto businesses reached Russian financial intermediaries.
How North Korean operatives infiltrated crypto companies
North Korean operatives have increasingly used stolen identities, fraudulent documents, and fabricated employment histories to secure remote jobs at legitimate businesses, including cryptocurrency companies.
According to Chainalysis, some workers have also used generative AI to create convincing resumes, generate realistic profile photos, and produce deepfake videos during recruitment interviews.
These techniques allow operatives to conceal their identities and potentially bypass conventional hiring checks, particularly at companies that recruit developers remotely.
Once employed, the workers collect salaries that North Korean authorities allegedly appropriate to support the country’s weapons programs.
Chainalysis identified one such operative who contributed code to blockchain projects and DeFi protocols while receiving regular cryptocurrency payments.
The discovery raises security concerns for crypto firms that unknowingly grant disguised operatives access to software repositories and sensitive development infrastructure.
Treasury warned that North Korean IT workers have exploited their corporate access to deploy malware, steal proprietary information, and extract sensitive data.
Meanwhile, these employment operations extend beyond cryptocurrency companies. Chainalysis cited a United Nations Panel of Experts estimate that North Korean IT worker schemes generated between $250 million and $600 million in annual revenue for the regime.
Russian intermediaries converted crypto salaries into usable funds
Chainalysis’s blockchain investigation provides a clearer picture of how the employment proceeds moved through the financial system.
The firm identified a wallet belonging to the suspected North Korean developer that received stablecoin transfers approximately every two weeks between late 2022 and early 2023.
The recurring payments resembled a regular salary, but later transactions revealed links to financial intermediaries associated with North Korea.
The developer’s wallet converted stablecoins into Ethereum (ETH) before transferring the funds to consolidation addresses that Chainalysis linked to sanctioned entities.
From there, the firm’s written analysis traced the funds to Russian national Ilya Aleksandrovich Boykov, who forwarded cryptocurrency to Garantex, a sanctioned Russian exchange, for potential cash conversion.
Chainalysis said these relationships dated back several years, indicating that parts of the network were operating well before the transactions highlighted in the latest Treasury action.
According to Treasury, Boykov processed the equivalent of $3.5 million in cryptocurrency transactions since 2024 while supporting Limited Liability Company Alis, an organization associated with North Korean IT workers.
He allegedly monitored cryptocurrency transfers and provided logistical assistance to the group’s operations.
Another Russian national, Vitold Viktorovich Obertas, allegedly converted nearly $2 million in cryptocurrency and handled at least $1.25 million in other currency transactions for North Korean officials since January 2025.
Chainalysis separately traced funds from Amnokgang Technology Development Company, a previously sanctioned organization managing North Korean IT worker delegations, to Obertas-linked wallets.
Those wallets also deposited cryptocurrency into mainstream and sanctioned exchanges, revealing additional channels through which North Korean-linked funds could reach financial markets.
The Treasury also identified the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia, as part of the network. Six workers associated with the organization allegedly generated more than $750,000 since 2025.
The transactions show how Russian intermediaries allegedly helped convert earnings from fraudulent employment into funds North Korean officials could access.
The latest sanctions aim to disrupt those channels by restricting the designated individuals’ access to property and financial services under US jurisdiction.
The Office of Foreign Assets Control identified Ethereum and Tron addresses associated with Boykov and Obertas, along with an Ethereum address linked to North Korean national Kim Ki Hyok.
These designations give cryptocurrency exchanges and other financial intermediaries additional identifiers for detecting exposure to the sanctioned network.
US persons are generally prohibited from dealing with the designated individuals or their blocked property without authorization, while affected assets under US jurisdiction must be blocked and reported.