OFAC targets the Russia-based network cashing out crypto for North Korean IT workers

What happened

On 28 October 2026, the US Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity for their roles in North Korean government-run information technology (IT) worker schemes. Treasury says the schemes defraud US businesses and generate revenue for North Korea’s weapons of mass destruction and ballistic missile programs.

Treasury says North Korea relies on fraudulent documents, stolen identities, and fabricated personas to get its IT workers hired by legitimate companies, then takes most of their wages. The workers have also used their access to corporate networks to deploy malware and exfiltrate data. The action targets the facilitators and financial networks that move the proceeds.

Two of those designated are Russian nationals. Treasury says Vitold Viktorovich Obertas has, since January 2025, carried out nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials, including for Amnokgang Technology Development Company, designated in March 2026. Ilya Aleksandrovich Boykov has, since 2024, exchanged and converted the equivalent of $3.5 million in cryptocurrency for Limited Liability Company Alis, a North Korean IT worker company designated in March 2024. He also monitored cryptocurrency transactions for it.

OFAC also designated two North Korean delegation leaders in Russia. Treasury says one, Kim Ki Hyok, monitors Alis workers to make sure they meet financial targets and has transferred nearly $500,000 in cryptocurrency for the delegation. It also designated the First Financial and Technical Development Center, a North Korean-controlled entity in Russia, and six of its workers, who Treasury says generated over $750,000 since 2025. Australia and the European Union also designated people and entities supporting North Korea’s revenue generation this month.

Why it matters

The conversion step is where these schemes touch the regulated system. Wages paid by real employers have to be turned into money the regime can use, and Treasury’s release names the people it says did that converting. Over-the-counter desks, exchanges, and payment firms dealing with Russian counterparties are the most exposed to these names.

For banks and payroll providers, the risk sits upstream, in identity. Treasury describes stolen identities and fabricated personas, which suggests salary payments going to accounts held by someone other than the person doing the work. That pattern is hard to see from a single payment and easier to see across a customer’s history.

The proliferation link raises the stakes. Revenue from these schemes funds weapons programs, so a missed connection is a proliferation financing failure as well as a sanctions one.

Practitioner angle

• Load the new designations, including any digital currency addresses listed in the SDN entries, and rescreen customers and counterparties.
• Crypto firms: review over-the-counter and conversion counterparties with Russian links, and check for exposure to the named individuals.
• Banks: look for accounts receiving salary payments from several unrelated employers, especially remote technology roles, where the account holder’s profile does not fit the work.
• Corporate clients: if you advise or bank businesses that hire remote contractors, share the US government advisories on North Korean IT workers that the release points to.
• Record the proliferation financing angle in any SAR you file, so the report reaches the right team.

Start with the rescreening. It is the step that can catch an existing relationship this week.