Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
BTCLIVE
BTC price on Oct 30, 2026 at 7am EDT
$77,400 or above1.56x64%
$77,500 or above2.00x50%
On October 28, 2026, US sanctions targeted 10 individuals and one entity tied to North Korean IT worker schemes. Two Russian intermediaries allegedly converted about $5.5 million in cryptocurrency, helping route money from legitimate employers to North Korea’s weapons programs.
https://x.com/USTreasury/status/2115452392690913530
US Sanctions Target Intermediaries Behind the Crypto Conversions
Treasury’s Office of Foreign Assets Control says Ilya Aleksandrovich Boykov converted about $3.5 million in crypto for Alis, a North Korean IT worker company, since 2024. Vitold Viktorovich Obertas allegedly converted nearly $2 million for North Korean officials since January 2025
Obertas also allegedly handled at least $1.25 million in other currency transactions. That amount sits outside the roughly $5.5 million in combined crypto conversions attributed to the two men.
Blockchain Tracing Connects the Networks to Exchanges
Chainalysis traced cryptocurrency earned by a North Korean IT worker to Boykov, who sent the funds to the Russian exchange Garantex for cash-out. The US has sanctioned Garantex since April 2022.
The analytics firm found that Obertas’ wallet also received funds from Amnokgang, an IT worker firm sanctioned on March 12. He deposited money at both mainstream and sanctioned exchanges, BeInCrypto reported.
IT Worker Schemes Put Corporate Data at Risk
The networks use stolen identities, fraudulent documents and fabricated personas to secure jobs at legitimate companies North Korea takes most of the workers’ wages, redirecting payments for software development and other IT work to the state
The threat goes beyond payroll. Treasury says North Korean IT workers have used corporate network access to install malware and steal sensitive data and proprietary information. Chainalysis says operatives have also used generative AI to aid recruitment and hide their identities.
The designations include the First Financial and Technical Development Center, a North Korean-controlled organization in Vladivostok, Russia. Treasury says the center deploys highly trained IT workers who use AI tools and complex crypto transfers to generate revenue, as Decrypt detailed.
Sanctions Exposure and Blocking Duties
The mainstream exchanges that received Obertas’ deposits were not named, and Treasury did not disclose when those transfers occurred. Certain transactions involving designated persons can expose financial institutions and others to sanctions, Treasury warns.
OFAC can impose civil penalties on a strict liability basis. Treasury also says non-US persons cannot cause US persons to violate sanctions, whether knowingly or unknowingly. The new listings also raise secondary sanctions risk under its North Korea regulations.
US persons holding property belonging to the designees must block it and report it. Chainalysis says transfers involving designated addresses now trigger sanctions alerts for its screening clients, depending on their alert settings.
When was Alis, the company linked to Boykov’s conversions, sanctioned?
Alis was sanctioned in March 2024. Treasury identifies it as a North Korean IT worker company for which Boykov allegedly converted cryptocurrency beginning in 2024.
How much did the six designated workers generate for the First Financial and Technical Development Center?
Treasury says the six designated workers generated more than $750,000 for the center since 2025. They were North Korean IT workers based in Russia.
How did the workers use AI tools during recruitment?
Chainalysis says operatives used generative AI to write resumes and cover letters and prepare for technical interviews. In some cases, AI-generated profile photos and deepfake video helped conceal their identities during hiring calls.
What must US persons do with property belonging to the designated persons?
US persons must block the designees’ property in their possession and report it to OFAC. The October 28 action applies these obligations to the newly designated individuals and entity.
What happened to Garantex’s web domains in March 2025?
US authorities seized Garantex’s web domains in March 2025. The exchange had already been subject to US sanctions since April 2022.
This article is for information only and is not financial advice.
Source: bitcoinfoundation.org