US Sanctions Russians, North Koreans for Laundering Illicit IT Worker Earnings
The U.S. Treasury Department has sanctioned Russian and North Korean nationals and companies for their alleged roles in laundering millions of dollars earned by North Korean IT workers operating illicitly.
The U.S. Treasury Department has imposed sanctions on Russian and North Korean individuals and entities accused of facilitating the laundering of cryptocurrency payments generated by North Korean IT workers. These workers, often based in Russia, are allegedly employed by U.S. companies under fraudulent pretenses, with their earnings reportedly funneling back to support Pyongyang's revenue generation and cyber activities.
Treasury Secretary Scott Bessent stated that North Korea's government continues to target and exploit American companies through fraudulent activities conducted by its overseas IT operatives. These operatives allegedly weaponize sensitive data and extort businesses for substantial payments, contributing to Pyongyang's illicit financial streams.
Among those sanctioned are Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas. Obertas is accused of laundering at least $3.5 million in cryptocurrency since January 2025 on behalf of Amnokgang, a North Korean shell company previously sanctioned by the U.S. Boykov is also implicated as a key money launderer, allegedly exchanging and converting approximately $3.5 million in cryptocurrency since 2024. He is further suspected of providing logistical and financial support for Alis, another North Korean company subordinate to sanctioned entities.
The sanctions also target several North Koreans, including Kim Hyo Dong and Kim Ki Hyok, a senior employee at Alis. Hyok reportedly leads a Russia-based delegation of North Korean IT workers, tasked with monitoring their activities and ensuring financial targets are met. He is alleged to have transferred at least $500,000 to North Korea for this delegation since 2024. Dong, meanwhile, is accused of leading another squad of IT workers, providing logistical assistance and transferring over $100,000 in financial assets to evade sanctions.
North Korean company First Financial and Technical Development Center was also sanctioned for its alleged role in managing millions of dollars earned by North Koreans based in Russia. The Treasury Department indicated that this company has assisted IT workers in using artificial intelligence to secure employment at U.S. companies and has employed sophisticated money laundering methods to conceal illicit earnings.
Six IT workers—Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il—were also sanctioned for earning at least $750,000 on behalf of First Financial and Technical Development Center since 2025. The Office of Foreign Assets Control (OFAC) has been actively sanctioning North Korean officials and companies this year to disrupt this IT worker scheme, which is believed to net Pyongyang millions used to fund its ballistic missile programs.
The broader scheme involves North Korean nationals using stolen or purchased identities to obtain high-paying IT roles at U.S. and European companies or government agencies. Beyond regular salaries, these workers have reportedly extorted companies, stolen sensitive corporate documents, and facilitated multi-million dollar cryptocurrency thefts. This operation has also seen the Justice Department disrupt laptop farms and make arrests, while the FBI warns of North Korea targeting low-income Americans for assistance in these operations.
These U.S. sanctions follow similar actions by Australia last week, which also targeted North Korean nationals and companies involved in the IT worker scheme. The coordinated international efforts aim to dismantle the financial infrastructure supporting North Korea's cyber operations and illicit revenue generation.