The US Treasury's Office of Foreign Assets Control (OFAC) sanctioned ten individuals and one company on Wednesday, October 28, for facilitating a North Korean scheme that places fraudulent IT workers inside Western firms to generate revenue for Pyongyang. Alongside the designations, OFAC published eight cryptocurrency wallet addresses on Ethereum and Tron linked to the network, giving compliance teams and exchanges a concrete list of destinations to block.
The action centres on two Russian nationals who acted as conversion points between the scheme's crypto proceeds and usable funds. Vitold Obertas is accused of converting nearly $2 million in cryptocurrency for North Korean officials since January 2025, drawing on one Ethereum address and three Tron addresses listed in the sanctions sheet. Ilya Boykov, who worked on behalf of Alis, a North Korean IT-worker placement company already under US sanctions, is said to have exchanged and converted approximately $3.5 million since 2024, using two Ethereum and two Tron addresses. One Ethereum address appears on both men's sanctions sheets, suggesting a shared point in the laundering chain.
Treasury also designated the First Financial and Technical Development Center (FFTDC), an entity it describes as controlled by Pyongyang and based in Vladivostok. According to the designation, six North Korean developers operating in Russia generated more than $750,000 through the FFTDC since 2025. A separate individual, Kim Ki Hyok, a North Korean official, is said to have transferred nearly $500,000 in cryptocurrencies on behalf of his delegation since 2024.
The practical effect of the designations is straightforward: the sanctioned individuals and the company can no longer hold assets in the United States, and US persons and firms are barred from transacting with them. Exchanges that screen against OFAC's list are expected to flag the eight published addresses.
Part of a wider pattern
Wednesday's action follows an earlier Treasury designation on March 12 against another IT-worker network, suggesting a sustained campaign against the scheme rather than a one-off measure. It also comes weeks after Washington sanctioned the A7 Network, a Russian clandestine banking system, in early October. Both Australia and the European Union announced similar designations against supporters of Pyongyang's schemes this same month.
The use of public blockchains by North Korean operators has been documented before. Earlier reporting found that by April 20, researchers had already unmasked around 100 North Korean profiles active on the Ethereum network. Separately, North Korean regime hackers have been linked to $577 million stolen from decentralised finance protocols, according to earlier reporting.
For European exchanges, custodians and businesses that unknowingly hire remote IT contractors, the latest OFAC list serves as an operational update: eight more addresses to screen, and two more intermediaries whose onward transfers should trigger scrutiny under existing sanctions-compliance obligations.
