The US Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions against 10 individuals and one organization. According to the US Treasury, these individuals and the organization helped create and maintain overseas networks of IT workers operating under the control of the North Korean government. Participants in such schemes used forged documents and other people's identities to get jobs at companies in the US and other countries, and then transferred the money they earned to the North Korean government. The sanctions also targeted individuals accused of organizing the conversion of funds, crypto transfers and the coordination of such teams.
The new sanctions
The list of individuals and organizations sanctioned by OFAC includes IT workers, team leaders, financial intermediaries and related entities that operated in North Korea and Russia.
The published announcement provides details on several crypto transactions:
- Russian national Vitold Viktorovich Obertas is accused of carrying out crypto exchange operations worth almost $2M for North Korean representatives since January 2025, as well as other currency operations worth at least $1.25M.
- Kim Ki Hyok is accused of transferring crypto worth almost $500,000 for a team of IT workers that has been working in Russia since 2024.
- Kim Hyo Dong is accused of providing organizational support to another team and helping transfer financial assets worth more than $100,000.
- Russian national Ilya Aleksandrovich Boykov is accused of helping an organization linked to this activity carry out exchange operations and crypto transfers worth about $3.5M since 2024.
- The organization First Financial and Technical Development Center (FFTDC) is accused of hosting North Korean IT workers in Russia. According to the published data, since 2025 its employees have collectively generated more than $750,000 in revenue for the North Korean government.
Analysis of the links between the sanctioned addresses
The updated SDN sanctions list maintained by OFAC included eight digital asset addresses linked to the sanctioned individuals and organizations. These addresses belong to two blockchain networks – Ethereum and TRON.
An analysis of the movement of funds shows that there are noticeable links between these addresses. Some of them transferred funds directly to each other, and several others sent money to the same wallet, which was used to fund an account on a crypto exchange.
Kim Ki Hyok
According to OFAC, since 2024 Kim Ki Hyok has transferred crypto worth almost $500,000 for a team of IT workers that worked in Russia. The sanctions list links him to the following address on Ethereum:
This is the simplest address on the whole list, with the most limited activity: it existed for only two days and made only one transaction – it sent 50,000 DAI to a crypto exchange.
The funds first passed through the intermediary address 0x4865773f498186d838fe47227804a158cbed51de. On August 31, four different addresses sent it a total of about 100,000 DAI. On September 9 at 06:46, this intermediary wallet sent 50,000 DAI to the address listed in the sanctions list next to Kim Ki Hyok's name. About six minutes later, another 0.001 ETH arrived at it – the amount needed to pay the transaction fee. The next day at 09:39, the address linked to Kim transferred all 50,000 DAI to a Bybit exchange deposit address: 0x197c6c66d9fc674d496ee232f418bd6f6013a13b.
Ilya Aleksandrovich Boykov
According to OFAC, since 2024 Russian national Ilya Boykov has helped an organization linked to this activity carry out exchange operations and crypto transfers worth about $3.5M. The sanctions list links him to the following addresses on Ethereum:
An analysis of the address 0x12Ea8 shows that it was active from November 10, 2022, to August 25, 2025. During this time, it received a total of 49.5767 ETH, 4.7 million USDC, 4.63 million USDT and 10.22 million DAI.
Funds from this address were then withdrawn in four clearly identifiable directions:
- 50.54% of the funds – about $9.88M – were transferred directly to the Bybit exchange deposit address 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510, linked to Boykov and Obertas. The largest single transfer was 511,000 USDC, made on June 12, 2024. In addition, another 13.67 ETH arrived at the same deposit address.
- 20.47% of the funds – about $4M – were sent to another Bybit deposit address: 0x197c6c66d9fc674d496ee232f418bd6f6013a13b. A total of 31 transactions were made.
- 28.88% of the funds – about $5.65M – went to two deposit addresses on the HTX exchange: 0xee60121c763143a4fb17735ab86b5f0fc5cb1800 and 0x7f78ddf455f9f8eef56c4c9f76b5d53c75dc54ee. The first transfer took place on June 22, 2023. After that, funds kept arriving at these addresses without interruption for more than two years.
- The remaining 0.05% of the funds – $9,870 – were sent to a Binance deposit address: 0x4941c9481e9bb27b74be4e2b6c6fa349f8be99d5.
Boykov and Obertas's shared address
0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510 – this address is labeled as a Bybit exchange deposit wallet. OFAC officially listed it in the sanctions entries for both Obertas and Boykov.
Looking at the composition of the incoming funds, 128 transactions from Boykov's address 0x12Ea80238C7d805D003ce793594e92d84A6f4E8d accounted for 77% of all funds received by this wallet. These transfers were made from June 22, 2023, to July 25, 2025. Further tracing of the funds along the chain of transactions also revealed links to addresses labeled as belonging to the DPRK.
The OFAC sanctions list also includes two addresses on TRON next to Boykov's name:
The address TQKoDq5aCrWAciiNtete5pDYVN38i4qFN1 is Boykov's first wallet on TRON. Its transaction volume is relatively small, but the movement of funds can be traced quite clearly. From December 2, 2022, to December 21, 2025, it received a total of 873,675 USDT. The largest outgoing transfer was 257,732 USDT: the money was sent directly to Obertas's deposit address on Bybit – TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg. The rest of the funds were distributed in various directions.
The address TXmrnVgsqCMJncYHTXchuJ5z111BXSj4g3 is Boykov's later wallet on TRON, where funds were concentrated to a much greater degree. It is also the most direct point of contact between Boykov and Obertas. From March 21, 2024, to December 6, 2025, it received a total of 1.62 million USDT. Within three months, 1.4 million USDT – 86.2% of all incoming funds – was sent from this wallet. The money left in seven transactions, and each time the recipient was Obertas's deposit address on Bybit: TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg. Most of the funds came to the wallet from customers who transferred medium-sized amounts.
Direct transfers between these two TRON addresses and the wallet TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg make it possible to trace the link between the addresses OFAC listed next to Boykov's name and the addresses linked to Obertas.
In addition to the shared Ethereum address, which the sanctions list includes next to both Boykov and Obertas, OFAC listed three more TRON addresses linked to Obertas:
The address TCV4qdpTxoMyqkn7sSPeRrXmhH5JFxMvmT is labeled as an HTX exchange deposit wallet. Over 11 months – from September 10, 2024, to August 28, 2025 – it received a total of 9.16 million USDT.
The address TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm took part in numerous incoming and outgoing transactions. The analysis shows that from November 7, 2022, to February 25, 2026, it received about 11.09 million USDT, after which the funds were transferred to other addresses. Of this amount, about 2.58 million USDT went to Obertas's own deposit address on Bybit – TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg. Another 1.08 million USDT or so was sent to his deposit address on HTX – TCV4qdpTxoMyqkn7sSPeRrXmhH5JFxMvmT. These two transfers link the address TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm to two other Obertas wallets on the sanctions list.
The largest incoming transfer came from the address TEvYL8PU8EiC84kAoN67ZhHyUgPfvgVoD8. It amounted to 1,242,541 USDT. This wallet's transaction history is relatively complex.
The address TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg is labeled as a Bybit exchange deposit wallet. From March 7, 2023, to October 31, 2026, it received a total of about 31.02 million USDT.
The second-largest source of funds for this address was Obertas's own wallet TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm, from which 2.58 million USDT was transferred. The sixth-largest source was Boykov's address TXmrnVgsqCMJncYHTXchuJ5z111BXSj4g3, which sent 1.4 million USDT.
Taken together, the transaction data on Ethereum and TRON makes it possible to identify several types of links between the addresses that can be confirmed or traced:
- The Ethereum address 0x761ed is listed in the sanctions list next to both Boykov and Obertas. Earlier, about $9.88M arrived at it from Boykov's wallet 0x12Ea8.
- Funds were transferred from the Ethereum addresses linked to Boykov and Kim to the wallet 0x197c6. At the same time, this address itself is not among the eight wallets OFAC published as part of this sanctions action.
- USDT was transferred from both of Boykov's TRON addresses to the Bybit deposit address TFksj, linked to Obertas.
- USDT was transferred from Obertas's address TQCBd to his own Bybit deposit address TFksj and the HTX deposit address TCV4q.
How North Korean IT worker networks operate
Such schemes often begin with what looks like a completely ordinary process of hiring a remote employee. A company posts a vacancy, receives résumés, holds interviews, then sends the new hire a computer and pays a monthly salary. The problem is that the person on the other side of the screen may not be the candidate named in the résumé at all.
Some North Korean IT workers use stolen, borrowed or forged identity documents to get remote jobs. They also create matching email addresses and social media accounts and prepare professional biographies and work histories. To hide their real location, some use VPNs, proxy networks or the help of intermediaries based in the countries where the hiring companies operate. Computers that companies send to employees may first be delivered to local residents or to so-called «laptop farms», and only then used by remote operators abroad. As a result, the addresses, personal data and device locations the company sees may have nothing to do with where the person actually works.
Such schemes usually require coordination between several participants. Some provide or rent out other people's identities, others receive and store computers, help open payment accounts, or manage teams and transfer the money earned. The intermediaries may be aware of exactly whom they are helping, or they may believe they are providing ordinary services for receiving payments, making business contacts or organizing remote work.
Income in such schemes usually comes in the form of a salary for remote work or payment for completed projects. The money can be transferred through third-party bank accounts, payment platforms and crypto wallet addresses. Some of the individuals on the OFAC sanctions list were separately accused of helping exchange crypto, transfer funds or manage teams.
A more practical approach for companies is therefore comprehensive verification of an employee's identity, control over device delivery, contractor management and limiting system permissions. It is necessary to check not only who exactly is doing the work, but also which data and systems this person can access.
