Washington Blacklists Figures Tied to North Korean IT Worker Scam
Washington has placed sanctions on 10 individuals and one organization accused of backing North Korea's IT worker operation. The United States Treasury announced the move on Wednesday, local time.
The department said the action targets workers and intermediaries inside North Korea and Russia, including people who exchange cryptocurrency and move money for North Korean officials. Investigators allege the network deceived American companies while raising funds for Pyongyang's weapons programs.
The Office of Foreign Assets Control, or OFAC, has frozen any assets these individuals and the organization hold in the US, along with assets they have in the possession of American persons.
According to the Treasury, North Korean operatives secured positions at legitimate companies in the US and allied nations by using forged paperwork, stolen identities and false online profiles. The department added that the North Korean state takes the bulk of the income these workers earn.
The Treasury estimates that the scheme brings in tens of millions of dollars for North Korea's weapons of mass destruction and ballistic missile efforts. Money is earned and transferred through cryptocurrency deals, money laundering and artificial intelligence tools.
Scott Bessent, the US Treasury Secretary, said, “The North Korean government keeps targeting and taking advantage of American companies.” In addition to raising money, the workers allegedly used corporate network access to plant malware, pull out sensitive data and steal confidential information. The department did not name the firms that suffered losses.
Among those listed is Russian middleman Vitaly Victorovich Obertas. He is accused of converting about $2 million in cryptocurrency for North Korean officials since January 2025, and of conducting at least $1.25 million in further transactions. His dealings included activity connected to Amnokgang Technology Development Company, which OFAC restricted in March.
Russian national Ilya Alexandrovich Boykov is accused of supporting Alice, a firm that was already sanctioned. Since 2024, he allegedly handled cryptocurrency transactions valued at $3.5 million, tracked them and offered logistics assistance.
North Korean nationals Kim Hyok and Kim Hyo Dong were also sanctioned for leading separate groups of IT workers in Russia. Kim Hyok monitored Alice workers to make sure they met financial targets and is accused of transferring around $500,000 in cryptocurrency for the team since 2024. Kim Hyo Dong is accused of providing logistical backing, helping to dodge sanctions and enabling transfers of financial assets worth at least $100,000 since December 2023.
The blocked organization is the First Financial and Technical Development Center, a North Korea-controlled body active in Russia. Its IT workers are accused of collecting several million dollars for Pyongyang.
The center is also linked to six North Korean workers who have been sanctioned: Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il. They are accused of raising more than $750,000 for the organization since 2025.
The Treasury said Americans are not allowed to carry out transactions involving blocked property unless they are authorized or exempt. Entities that are 50 percent or more owned by blocked persons will also be covered.