US Sanctions Two Russians Over North Korean IT Workers’ Crypto Cash-Outs

The US Treasury has sanctioned 10 individuals and one entity for allegedly helping North Korean IT workers earn money through fraudulent employment at legitimate businesses and convert cryptocurrency into cash. The action targets the cash-out stage of a scheme that the UN estimates generates $250 million to $600 million annually for North Korea.

Crypto Cash-Out Network

According to Chainalysis, Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas converted millions of dollars in crypto for front companies that placed North Korean IT workers at businesses under false identities. The workers' earnings ultimately helped fund the North Korean regime and its weapons programs.

Fraudulent Employment Scheme

The blockchain analytics firm traced one payment trail to a developer who contributed code to blockchain and DeFi projects. From late 2022 to early 2023, the worker's wallet received stablecoin payments every two weeks, resembling a regular salary. Those funds were converted into ETH and sent through consolidation wallets associated with sanctioned entities.

Obertas was accused of acting as a financial intermediary for North Korean officials, with his wallet receiving funds from Amnokgang Technology Development Company, which was involved in managing overseas IT worker delegations.

Growing Threat

The sanctions also cover Kim Ki Hyok and Kim Hyo Dong, two North Korean nationals who managed IT workers based in Russia, along with First Financial and Technical Development Center (FFTDC). Six North Korean workers associated with FFTDC had generated more than $750,000 for the organization since 2025.

Chainalysis warned that generative AI is making recruitment fraud harder to detect, with operatives using AI-generated resumes and profile photos, as well as deepfake video during hiring calls, to appear legitimate.