US sanctions North Korean IT workers in Russia and lists 8 crypto addresses, 5 on Tron
Treasury designated 10 people and a Russia-based center on October 28, 2026, saying they moved crypto for North Korea's IT worker schemes. One Ethereum address appears under two different men.
Key points
- OFAC sanctioned 10 individuals and one entity on October 28, 2026, for supporting North Korean IT worker schemes that Treasury says defraud US businesses and fund weapons programs.
- The sanctions list update includes 9 crypto address entries: 8 unique addresses, 3 on Ethereum and 5 on Tron.
- Treasury tied about $3.5 million in crypto conversions to one Russian national, and nearly $2 million to another.
What Treasury did
The US Treasury's Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity on October 28, 2026, for supporting North Korea's government-run IT worker schemes, Treasury said. In these schemes, North Korean workers take remote tech jobs, often under false identities, and the pay flows back to the state.
Treasury says the schemes defraud US businesses and raise money for North Korea's weapons of mass destruction and ballistic missile programs. It also says the workers have accessed company networks to deploy malware, steal data and take proprietary information. The action builds on a March 12, 2026, designation of a separate IT worker network.
Treasury Secretary Scott Bessent said the North Korean regime "continues targeting and exploiting American companies through fraudulent activities."
Who was named
The entity is the First Financial and Technical Development Center (FFTDC), which Treasury describes as a North Korea-controlled entity located in Russia that deploys IT workers. Treasury says those workers use artificial intelligence tools and money laundering methods, including complex crypto transfers. The individuals, according to Treasury:
- Ilya Aleksandrovich Boykov, Russia: supports the IT company Alis with crypto conversions, transaction monitoring and logistics.
- Vitold Viktorovich Obertas, Russia: an intermediary for illicit North Korean financial transactions.
- Kim Ki Hyok, North Korean national in Russia: leads a delegation of IT workers for Alis and monitors them and their financial targets.
- Kim Hyo Dong, North Korean national in Russia: leads a separate delegation and facilitates financial transfers.
- Six IT workers based in Russia, Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il, who generated revenue for FFTDC.
The crypto addresses
The OFAC sanctions list update attaches 9 digital currency address entries to three of the men: 4 on Ethereum and 5 on Tron, a blockchain widely used for token transfers. One Ethereum address is listed twice, so there are 8 unique addresses.
- Boykov: ETH 0x12Ea80238C7d805D003ce793594e92d84A6f4E8d; alternate ETH 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510; TRX TQKoDq5aCrWAciiNtete5pDYVN38i4qFN1; alternate TRX TXmrnVgsqCMJncYHTXchuJ5z111BXSj4g3
- Obertas: ETH 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510; TRX TCV4qdpTxoMyqkn7sSPeRrXmhH5JFxMvmT, TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm and TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg
- Kim Ki Hyok: ETH 0xE4C9a7F68B1EbA4508f54f07f7378847318dD1A3
The address ending in 3510 appears under both Boykov and Obertas. Treasury's release does not name the tokens, exchanges or stablecoins used, and it does not say how much passed through these addresses.
The money Treasury counted
Treasury gave rough figures for each target. Boykov handled crypto exchanges and conversions worth about $3.5 million since 2024. Obertas carried out nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. Kim Ki Hyok made crypto transfers for his delegation worth nearly $500,000 since 2024, and Kim Hyo Dong facilitated more than $100,000 since December 2023. The six workers generated more than $750,000 since 2025, and Treasury says FFTDC has made several million dollars for the North Korean government.
Amounts Treasury tied to each target
US$ million
Approximate figures as stated by Treasury; periods differ. Source: US Treasury
What the sanctions do
Under the sanctions, any property of the designated people within US jurisdiction is blocked, and so are entities 50% or more owned by them. Four of the men were designated under Executive Order 13687. FFTDC and the six IT workers were designated under Executive Order 13722, which targets the export of North Korean workers to earn money for the government or the ruling Workers' Party.
Treasury said Australia and the European Union also designated people and entities supporting North Korean revenue generation in October, and pointed to joint government advisories and an FBI public service announcement on IT workers.
The wider picture fits what the global standard setter has been reporting. In July, the Financial Action Task Force said that illicit use of stablecoins by actors including North Korea-linked groups and terrorist financiers has kept rising since its 2025 update, and that most identified on-chain illicit activity now involves stablecoins.
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- We think the published addresses are the most useful part for the crypto industry. Exchanges, stablecoin issuers and wallet providers can screen them directly, and any funds that touch them will be hard to cash out through compliant platforms.
- The shared Ethereum address under Boykov and Obertas suggests the two may have relied on a common point to move funds, though Treasury has not said so. On-chain analysts are likely to trace who else used it.
- Five of the eight addresses are on Tron. We read that as a sign that low-fee token transfers remain a practical route for these networks, which keeps pressure on issuers that can freeze tokens.
What's next
- Whether stablecoin issuers freeze any tokens held at the listed addresses
- Further US actions against IT worker facilitators, including any Justice Department cases
- Matching designations by the EU and Australia
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
