The U.S. Treasury's Office of Foreign Assets Control (OFAC) on Oct. 28 designated 10 individuals and one company for helping North Korea place IT workers in remote jobs at American businesses under stolen or fake identities.
Vitold Obertas and Ilya Boykov moved and converted the scheme's proceeds, OFAC said. Obertas converted about $2 million in cryptocurrency and moved at least $1.25 million through other transactions dating to January 2025, while Boykov exchanged the equivalent of $3.5 million in cryptocurrency since 2024.
Also designated were North Korean delegation leaders Kim Ki Hyok and Kim Hyo Dong, who moved more than $500,000 and $100,000, respectively, OFAC said. The action also targets six workers of the First Financial and Technical Development Center, who moved more than $750,000 since 2025, along with a Vladivostok-registered company called Alis.
OFAC said the schemes “defraud US businesses and generate revenue for North Korea's weapons of mass destruction and ballistic missile programs.”
Obertas, Boykov and the two delegation leaders were designated under Executive Order 13687, while the six Financial and Technical Development Center workers were designated under Executive Order 13722.
OFAC has targeted North Korean IT worker networks before, designating Chinyong Information Technology Cooperation Company in May 2023 and Amnokgang Technology Development Company in March 2026.
OFAC's list ties Obertas and Boykov to eight wallet addresses across the Ethereum and TRON networks; one Ethereum address appears under both men's names.
