--- title: "US OFAC Sanctions 10 Individuals and Entity Over DPRK IT Worker Scheme" description: "Treasury targets Russian and North Korean facilitators who converted and laundered millions in crypto for state-backed IT networks." url: https://basisdesk.news/news/ofac-sanctions-dprk-crypto-it-worker-network published: 2026-11-05T05:31:38.370Z modified: 2026-11-05T05:31:38.370Z section: Regulation & Policy author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: neutral tickers: [USDT, ETH, DAI, USDC] tags: [OFAC, Sanctions, DPRK, North Korea, Anti-Money Laundering, Ethereum, Tron] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # US OFAC Sanctions 10 Individuals and Entity Over DPRK IT Worker Scheme Treasury targets Russian and North Korean facilitators who converted and laundered millions in crypto for state-backed IT networks. ## At a glance - **What happened:** US OFAC sanctioned 10 individuals and one entity involved in North Korean IT worker schemes, identifying eight crypto addresses on Ethereum and TRON. - **Why it matters:** The designations cut off key financial intermediaries accused of laundering millions in crypto wages for the DPRK government. - **Who is affected:** Designated individuals, Russian entity FFTDC, and digital asset exchanges processing transactions linked to the listed addresses. - **What's next:** Global exchanges and financial institutions must block listed addresses and freeze associated assets. - **Status:** enforcement - **Primary source:** [U.S. OFAC Sanctions Individuals and Entities Linked to DPRK IT Worker Networks](https://slowmist.medium.com/u-s-ofac-sanctions-individuals-and-entities-linked-to-dprk-it-worker-networks-3d475a4152f5?source=rss-4ceeedda40e8------2) — SlowMist ## Key points - OFAC designated 10 individuals and one entity (FFTDC) for facilitating North Korean state IT worker operations and crypto laundering [1]. - Russian nationals Boykov and Obertas allegedly converted and routed over $5.5M combined in crypto assets for DPRK networks [1]. - OFAC added eight Ethereum and TRON addresses to its SDN list, with on-chain tracing revealing shared deposit wallets between targets [1]. ## Editorial remark - **Context:** North Korean state-sponsored networks deploy remote IT personnel worldwide under false pretenses, using digital assets and intermediaries in foreign jurisdictions to launder wages back to Pyongyang [1]. - **Impact:** Exchanges and compliant crypto platforms must freeze funds linked to the eight designated addresses and enhance transaction screening around associated intermediary wallets [1]. - **Watch:** Compliance teams are monitoring exchange deposit addresses identified in on-chain tracing for any subsequent secondary transactions or related enforcement actions [1]. The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) has designated 10 individuals and one entity accused of operating overseas North Korean information technology worker networks [1]. According to Treasury, these workers secured jobs at businesses in the United States and abroad using forged documents and false identities, subsequently routing earnings back to the government of North Korea [1]. The enforcement action focuses specifically on facilitators handling cryptocurrency conversions, team operations, and cross-border transfers [1]. Among those designated, Russian national Vitold Viktorovich Obertas is accused of processing nearly $2 million in cryptocurrency conversions and at least $1.25 million in additional currency transactions for North Korean officials since January 2025 [1]. OFAC also accused Russian national Ilya Aleksandrovich Boykov of assisting with approximately $3.5 million in cryptocurrency exchanges and transfers since 2024 [1]. In addition, Kim Ki Hyok allegedly moved nearly $500,000 in cryptocurrency for an IT worker team in Russia, while Kim Hyo Dong provided logistical backing and facilitated the transfer of over $100,000 in assets [1]. The lone designated company, Russia-based First Financial and Technical Development Center (FFTDC), allegedly deployed North Korean IT workers who generated more than $750,000 in revenue for Pyongyang since 2025 [1]. ## On-Chain Ties on Ethereum and TRON OFAC added eight digital currency addresses across Ethereum and TRON to its Specially Designated Nationals (SDN) list in connection with the designations [1]. On-chain analysis by blockchain security firm SlowMist's MistTrack showed direct flows and shared exchange deposit accounts linking the targets [1]. Specifically, Ethereum address 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510, identified by MistTrack as a Bybit deposit wallet, was designated under both Boykov and Obertas [1]. MistTrack reported that an address controlled by Boykov sent roughly $9.88 million directly to that shared deposit account between June 2023 and July 2025 [1]. On TRON, Boykov's wallets transferred 1.4 million $USDT across seven transactions to an Obertas-linked Bybit deposit address [1]. The same Obertas deposit address received roughly 31.02 million USDT in total between March 7, 2023, and October 31, 2026 [1]. Previous investigations into North Korean remote worker operations, such as the [US sanctions against DPRK IT fraud networks](https://basisdesk.news/news/us-sanctions-dprk-crypto-it-worker-fraud-network), highlight ongoing inter-agency efforts targeting remote identity theft and unauthorized digital asset transfers. Compliance departments are expected to block the listed addresses and monitor upstream and downstream transactions across both chains [1]. ## FAQ **Who was sanctioned by OFAC?** OFAC designated 10 individuals—including Russian facilitators Ilya Boykov and Vitold Obertas, and North Korean nationals Kim Ki Hyok and Kim Hyo Dong—as well as the Russian entity First Financial and Technical Development Center (FFTDC) [1]. **Which crypto addresses were listed on the SDN list?** OFAC added eight digital currency addresses spanning the Ethereum and TRON blockchains, including deposit addresses identified on centralized exchanges [1]. ## Sources 1. [U.S. OFAC Sanctions Individuals and Entities Linked to DPRK IT Worker Networks](https://slowmist.medium.com/u-s-ofac-sanctions-individuals-and-entities-linked-to-dprk-it-worker-networks-3d475a4152f5?source=rss-4ceeedda40e8------2) — SlowMist, 2026-11-05 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai