The US Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned ten individuals and one entity on Wednesday for supporting North Korean government-run IT worker schemes that fund the country’s weapons programs. The sanctions target a network of Russian intermediaries who assisted North Korean workers in cashing out millions of dollars in cryptocurrency.
Among those sanctioned are Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas. Treasury stated that Boykov converted approximately $3.5 million in crypto for the sanctioned company Alis since 2024, while Obertas handled nearly $2 million in crypto conversions for North Korean officials since January 2025. Blockchain analytics firm Chainalysis mapped this long-running network, detailing how funds moved from North Korean IT workers through consolidation addresses to these intermediaries.
In one specific example cited by Chainalysis, a wallet linked to a North Korean IT worker received regular stablecoin payments, converted them into Ether (ETH), and transferred the funds to Boykov. Boykov then sent the cryptocurrency to the Russian exchange Garantex to facilitate the cash-out process. This activity highlights the persistent security threat posed by North Korean IT workers using false identities to secure jobs at crypto companies. In June 2025, the US Department of Justice announced charges against four North Korean nationals for a scheme involving fraudulent IT employment and the theft of more than $900,000 from US and Serbian crypto companies.
The designation of specific intermediaries like Boykov and Obertas, along with their connection to Garantex, illustrates the sophisticated laundering pipelines North Korea employs to bypass financial restrictions. By leveraging Russian exchanges and local conversion services, these actors obscure the origin of funds derived from deceptive IT employment schemes. The detailed mapping by Chainalysis provides critical visibility into how digital assets are transformed into usable fiat currency, highlighting the role of non-US jurisdictions in facilitating these transactions.
Regulatory enforcement is increasingly targeting the operational infrastructure behind these schemes rather than just the end beneficiaries. Sanctioning entities involved in the conversion and transfer stages disrupts the liquidity channels necessary for funding weapons programs. However, the continued use of platforms like Garantex suggests that despite international pressure, certain exchanges remain accessible conduits for illicit finance, requiring ongoing vigilance from compliance teams regarding counterparty risks in cross-border crypto transactions.
