US sanctions North Korea IT worker network; its eight listed wallets moved tens of millions and now hold about $2,300

The US Treasury’s Office of Foreign Assets Control (OFAC) on Wednesday 28 October sanctioned 10 individuals and one Russia-based entity that, according to a Treasury press release, help run North Korea’s IT worker schemes, in which North Koreans use fake identities to get hired by US and allied companies and send most of their pay back to the regime. Two of the people named are Russians whom Treasury accuses of turning North Korean crypto into cash: Vitold Obertas, for nearly $2 million since January 2025, and Ilya Boykov, for about $3.5 million since 2024.

OFAC also attached crypto addresses to three of the entries on its sanctions list: eight distinct addresses in all, three on Ethereum and five on Tron, according to the OFAC recent actions page. Coindaro checked all eight on public block explorers on 28 October between 17:40 and 17:50 UTC. Together they held about $2,300 in stablecoins and ether at that time. Yet more than $80 million in stablecoins flowed into them between November 2022 and November 2025, most of it in 2024 and 2025. That is a gross figure: it counts money that only passed through, some of it twice, and it is not a measure of what North Korea earned.

“The North Korean regime continues targeting and exploiting American companies through fraudulent activities,” Treasury Secretary Scott Bessent said in the release. The people and the company named are designated, not convicted: every allegation below comes from Treasury, and the release announces no criminal charges against them.

Who OFAC sanctioned over North Korea’s IT workers on 28 October

The action has two halves. Four individuals were designated under Executive Order 13687, which targets the North Korean government and those who support it. A Russia-based company and six of its workers were designated under Executive Order 13722, which covers, among other things, sending North Korean workers abroad to earn money for Pyongyang. On the OFAC list they carry the programme tags DPRK2 and DPRK3.

Vitold Viktorovich Obertas, a Russian national, acted as an intermediary for North Korean financial transactions, including for Amnokgang Technology Development Company, an IT worker front that OFAC sanctioned on 12 March 2026. Ilya Aleksandrovich Boykov, also Russian, worked for LLC Alis, a Russia-based IT worker company, exchanging and converting crypto, watching transactions and helping with logistics.

The two North Koreans each lead a delegation of IT workers living in Russia. Kim Ki Hyok runs one for Alis and tracks how much money its workers bring in, according to Treasury. Kim Hyo Dong leads a separate group that answers to Chinyong Information Technology Cooperation Company, the parent network OFAC first sanctioned in May 2023.

The entity is the First Financial and Technical Development Center (FFTDC), which Treasury calls a North Korea-controlled company operating in Russia since at least 2024. Treasury says it has made several million dollars for the North Korean government, using what the release calls “Super Intelligence” tools (AI software, in plain terms) and complex crypto transfers to move the money. Its six named workers are Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool diverge, compared with simply holding the same tokens in a wallet. It becomes permanent when the provider withdraws.">Il, all born between 1999 and 2002 according to their SDN entries.

How the IT worker schemes make money, according to Treasury

North Korean developers apply for remote jobs with forged documents, stolen identities or invented personas. Once hired, they do the work, collect a salary, and the state takes most of it. Treasury says the money goes to North Korea’s weapons of mass destruction and ballistic missile programmes.

Salary fraud is not the only risk for employers. Treasury says some of these workers used their access to company networks to install malware, take data and steal proprietary information. The release ties the networks to crypto in two ways: workers get paid or paid out through digital assets, and the money is then laundered, partly through people such as Obertas and Boykov who change it into ordinary currency.

Treasury gives no total for what the networks earned, names no exchange and mentions no stablecoin by name. CBS News, which covered the action on 28 October, did not name a trading platform either.

The eight crypto addresses on the SDN list

OFAC listed nine address lines, but one Ethereum address appears twice: it is Boykov’s alternate address and Obertas’s main one. That leaves eight distinct addresses. Boykov has two on Ethereum and two on Tron. Obertas has that shared Ethereum address and three on Tron. Kim Ki Hyok has one Ethereum address. Kim Hyo Dong, FFTDC and the six workers have none.

Being on the list means that any property of these people in the United States, or held by a US person, is blocked and must be reported to OFAC, and US persons are generally barred from dealing with them. Companies owned 50% or more by blocked persons are blocked too. OFAC can fine violations on a strict liability basis, which means a firm can be penalised even if it did not know.

For crypto platforms, the practical effect is in the addresses. Exchanges and wallet providers that screen against the SDN list can now flag any deposit coming from these eight, and any withdrawal headed to them.

What the eight wallets hold today: about $2,300

We queried each address through the Blockscout API for Ethereum and the TronGrid API for Tron on 28 October between 17:40 and 17:50 UTC, counting only the real USDT, USDC and DAI contracts and ignoring the fake lookalike tokens that spammers send to busy wallets. The shared Ethereum address can be checked on Blockscout.

At the ETH price of about $2,332 at 17:32 UTC, the ether left on the three Ethereum addresses was worth roughly $42. Almost all of the value still sitting on the list is the 2,120.81 USDT on one of Obertas’s Tron addresses. The rest is dust.

Most of the addresses went quiet more than a year ago. The Ethereum address OFAC attributes to Boykov last moved stablecoins on 25 August 2025. Kim Ki Hyok’s address was used for one round trip: 50,000 DAI arrived on 9 September 2024 and left the next day. The latest stablecoin movement on any of the eight was on 1 December 2025, on Obertas’s TQCB address.

One exception stands out. The address shared by Boykov and Obertas sent 0.0312 ETH, worth about $73 at that 17:32 UTC price, to an unlabelled address on 13 October 2026 at 14:56 UTC, fifteen days before the listing. It is a small amount, and the chain does not say who signed it.

Tens of millions in stablecoins passed through before the listing

The balances say little about how these wallets were used. Adding up every incoming USDT, USDC and DAI transfer of one token or more gives about $32.4 million on the three Ethereum addresses and about $53.8 million on the five Tron addresses, all in USDT. Part of that money moved from one listed address to another and is counted twice. On Ethereum, about $9.9 million went from Boykov’s main address to the address he shares with Obertas, leaving about $22.5 million that came from outside the group. On Tron, about $5.4 million moved between listed addresses, so the outside inflow was about $48.4 million. Taken together, roughly $71 million entered the eight wallets from addresses that are not on the list.

The pattern looks like routing, not saving. On the shared Ethereum address, 88,800 USDT arrived at 20:36 UTC on 6 September 2025 and left at 21:09. Two days later, 68,000 USDT came in at 06:15 and went out at 06:35. In July 2025 the same address received deposits on more than ten days, most of them between 67,000 and 95,000 USDT or DAI, and nearly all were forwarded within about 25 minutes. Every one of the eight wallets ends with an outflow almost equal to its inflow.

Read these totals with care. They are gross flows: when money goes out to a counterparty and comes back, it is counted twice. That happened here. Obertas’s TCV4 address sent all of its $9.16 million to a single Tron address, which in turn sent about $7.2 million back into the listed wallets. The activity also starts in late 2022, before the periods Treasury cites for Obertas (since January 2025) and Boykov (since 2024). And nothing on the chain tells us which share belongs to North Korean IT workers and which to other customers of the same intermediaries.

So the on-chain numbers do not contradict Treasury’s figures. They measure something else: how much money moved through addresses that the US government now ties to these men, not how much they converted for Pyongyang. We did not identify the exchanges or OTC desks on the other side of the transfers, and none of the largest counterparties carried a public label on the explorers we used.

What the listing changes for exchanges and stablecoin issuers

With almost nothing left in the wallets, the listing works mainly as a tripwire. If any of the eight addresses receives funds again, or if a platform finds old deposits from them, compliance teams now have a legal reason to block and report. For the many US-regulated platforms that screen every on-chain transfer against the SDN list, that check is automatic.

Stablecoin issuers can go further, because USDT and USDC carry a freeze function. Tether says it often freezes wallets before they are sanctioned, a claim US Senate staff questioned this month, as covered in our report on Tether’s freezes and the Hezbollah-linked wallets. How the company handles such requests is laid out in our page on Tether, its reserves and its freezes. Treasury’s release does not mention Tether or any stablecoin, and we found no public statement on a freeze linked to Wednesday’s action.

For readers in Europe, the OFAC list is US law. Platforms authorised in the EU screen against EU sanctions lists under their own rules, though those that serve US customers or handle dollar stablecoins usually screen OFAC as well. Treasury said Australia and the European Union also designated North Korea-linked people and entities this month; it gave no details, and we did not find any French or Italian measure tied to this network.

For anyone who sends crypto to an exchange, the screening happens at deposit, alongside the identity checks described in our guide to how centralised exchanges work. A deposit traced back to a listed address can be held while the platform checks it.

Earlier US actions against the same networks

Wednesday’s designations extend a chain of US actions. OFAC sanctioned Chinyong in May 2023 and added Alis in March 2024 as a company under Chinyong’s control. On 12 March 2026 it designated Amnokgang and a separate IT worker network. On 27 August 2025, OFAC sanctioned another Russian, Vitaliy Andreyev, for facilitating payments to Chinyong; he had converted more than $600,000 in crypto into dollars since at least December 2024, according to a TRM Labs summary of that action. One crypto address was listed with him, and a China-based front company, Shenyang Geumpungri, was designated the same day.

The Justice Department moved on a different part of the scheme two weeks ago. On 13 October 2026 it announced the arrests of two US nationals, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, under a four-count indictment for wire fraud, money laundering and identity theft filed in the Northern District of Ohio. The indictment names 12 defendants, including 10 China-based individuals, and two more are under seal. Prosecutors allege a scheme that hit more than 70 US employers and brought IT workers about $3 million in revenue between 2019 and about July 2025, using “laptop farms”: US homes hosting company laptops that North Korean workers controlled remotely. Between 21 and 25 September the FBI searched more than 40 homes in Texas known or suspected to be laptop farms and seized about 187 laptops and other devices, according to the department. All defendants are presumed innocent until proven guilty. Treasury’s release does not link Wednesday’s designations to that case.

North Korea’s crypto income has a second, far larger stream: theft. The FBI attributed to North Korea the theft of about $1.5 billion in virtual assets from the exchange Bybit around 21 February 2025. Hacks are sudden and huge; IT worker salaries are steady and small per person. Treasury did not connect Wednesday’s action to Bybit or to any hack, and the release does not name the Lazarus Group. Hack totals for the latest quarter are in our review of crypto hacks in Q3 2026.

What is still unknown

We do not know which exchanges or brokers received the tens of millions that left these wallets, or whether any of them has since frozen accounts. We do not know whether the 2,120.81 USDT still on Obertas’s Tron address can be moved. And with the designated people based in Russia or North Korea, the US measures mainly cut them off from US firms and from platforms that follow US rules.

Designated persons can ask OFAC to remove them from the list through its delisting process. The Justice Department case in Ohio continues separately. The next signs to watch are on-chain: any new transfer into one of the eight addresses would now be visible to every compliance team that screens the SDN list.