On this page
Key takeaways
- On October 28, 2026, the U.S. Treasury's sanctions office (OFAC) put 10 people and one organization on its sanctions list for helping North Korea's government-run IT-worker schemes, which Treasury says cheat U.S. businesses and help pay for weapons programs.
- Treasury says two Russian nationals converted crypto for these networks: about $3.5 million since 2024 for one, and nearly $2 million since January 2025 for the other. OFAC's listing includes Ethereum and Tron addresses tied to them.
- For regular holders, nothing changes about your own wallet. But U.S. persons are generally barred from dealing with sanctioned people, and many exchanges screen transfers against listed addresses, so linked funds can be held for review.
The U.S. Treasury has sanctioned another network that helps North Korea earn money through IT workers hired under false identities, and it published the crypto addresses some of them used. Here's what was announced on October 28, 2026, and why it matters even if you've never heard of these people.
What happened
OFAC, the Treasury office that enforces U.S. sanctions, added 10 people and one organization to its sanctions list over their part in IT-worker schemes run by North Korea's government. Treasury says the schemes cheat U.S. companies and bring in cash for the country's banned weapons and missile programs. Treasury posted the announcement on its website and its official X account.
According to Treasury, North Korea hides its IT workers behind forged papers, borrowed or stolen identities and made-up online profiles so real companies will hire them, including U.S. ones. The government then takes most of their pay, which Treasury says adds up to hundreds of millions of dollars. Treasury adds that the networks lean on complicated crypto transfers, laundering and AI software to send millions back to Pyongyang.
Who was sanctioned, and the crypto involved
- Ilya Boykov, a Russian national. Treasury says that since 2024 he has swapped crypto worth about $3.5 million for Alis, a North Korean IT-worker firm that OFAC already sanctioned in March 2024.
- Vitold Obertas, a Russian national Treasury calls an intermediary for North Korean financial transactions. Since January 2025, Treasury says, he has handled nearly $2 million in crypto conversions for North Korean officials, plus at least $1.25 million in what Treasury calls "other currency transactions."
- Two North Korean delegation leaders in Russia. Treasury says one of them, Kim Ki Hyok, has moved crypto worth nearly $500,000 for his group since 2024.
- An organization in Vladivostok, Russia, that Treasury says North Korea controls (its listed name is First Financial and Technical Development Center), plus six North Korean IT workers tied to it. Treasury says the six have brought in over $750,000 for it since 2025.
OFAC's official listing attaches Ethereum and Tron addresses to Boykov and Obertas, and one Ethereum address to Kim Ki Hyok. One Ethereum address appears on both Boykov's and Obertas's entries. Treasury says this follows its March 12, 2026 action against a different network of the same kind, and that Australia and the European Union made their own designations this month.
What a sanction actually does
Once someone is on OFAC's list, any of their property in the U.S. or controlled by U.S. persons is blocked and has to be reported to OFAC. Unless OFAC grants a license, U.S. persons are generally prohibited from any transaction involving that property. Treasury notes that OFAC may impose civil penalties on a strict liability basis, meaning a person or business can be penalized even without knowing it broke the rules.
That's why the listing includes crypto addresses. Many exchanges and other regulated crypto businesses screen transfers against OFAC-listed addresses. A U.S. platform has to block property in which a sanctioned person has an interest, and platforms may also freeze or restrict other funds linked to a listed address while they review them. Self-custody wallets generally don't do this screening.
What it means for you
- Your own coins aren't affected. This targets specific people and addresses. Simply holding Ethereum, Tron or anything else isn't affected by this action.
- Be careful who pays you in crypto. If a stranger, an "employer" or a buyer pays you from an unknown address, the funds could be tied to criminal activity and get frozen. If you ever find that crypto you received came from a sanctioned address, consider getting legal advice before moving it. OFAC requires blocked property to be reported, and your platform may also need to review it.
- Check before you send. Always confirm a destination address through a channel you trust. Our guide to sending crypto safely walks through the steps.
- If you run a business or hire remote workers, the FBI has warned that North Korean IT workers have stolen company data and demanded ransom after being found out, and have used AI and face-swapping tools in video interviews. Its advice includes verifying identity throughout employment and doing as much hiring as possible in person. Suspicious contacts can be reported at IC3.gov (opens in a new tab).
North Korea is also behind some of crypto's biggest thefts. Chainalysis tied the September Bitget theft to North Korea-linked actors, which we covered in our look at that month's exchange hacks.
The takeaway
Treasury is going after the people who turn North Korea's fake-worker paychecks into usable money, and crypto conversion is a big part of how they do it. For everyday holders, the lesson is simple: know where crypto you receive comes from, and double-check where you send it. This is education, not legal or financial advice, and it reflects the announcements from Treasury and OFAC as of October 29, 2026.
Frequently asked questions
Do I need to do anything because of these sanctions?
Most people don't. Treasury's action targets the listed people and entity. It matters if you were ever paid by, or sent crypto to, an address on OFAC's list. If that happens, consider getting legal advice before moving the funds: U.S. persons are generally prohibited from dealing with blocked property, and OFAC requires blocked property to be reported.
What is an OFAC sanction?
OFAC is the Treasury office that enforces U.S. economic sanctions. When it adds someone to its Specially Designated Nationals (SDN) list, their property in the U.S. or held by U.S. persons is blocked, and U.S. persons are generally barred from doing business with them unless OFAC licenses it.
Why does a sanctions list include crypto addresses?
So that exchanges, wallet providers and other businesses can block transactions with them. OFAC's October 28 listing names specific Ethereum and Tron addresses for some of the people sanctioned.
What does this have to do with job scams?
Treasury says North Korea gets its IT workers hired at real companies using forged papers and fake or stolen identities, then keeps most of what they earn. The FBI has warned that some of these workers also steal company data and demand ransom after being caught.
Sources
- Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses (October 28, 2026) (opens in a new tab) — U.S. Department of the Treasury
- North Korea Designations; Democratic Republic of the Congo-related Designations (October 28, 2026) (opens in a new tab) — OFAC
- North Korean IT Workers Conducting Data Extortion (PSA, January 23, 2025) (opens in a new tab) — FBI / IC3
- Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto (October 29, 2026) (opens in a new tab) — Decrypt
Published October 29, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.