U.S. Treasury sanctions 10 individuals and 1 entity over DPRK IT worker fraud funding
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced on October 28 sanctions against 10 individuals and one entity for their involvement in a fraud scheme run by North Korea’s government-operated information technology (IT) workers, which used fraud to fund North Korea’s illegal weapons of mass destruction and ballistic missile programs by defrauding U.S. businesses.
The Treasury said that North Korea continues to use forged documents, identity theft and fabricated identities to conceal the true identities of its IT workers, thereby enabling them to work for legitimate companies, including companies in the United States and allied countries. The regime then takes possession of most of these workers’ wages, generating hundreds of millions of dollars in revenue to finance its illegal weapons programs. The action targets key facilitators and financial networks in North Korea and Russia that use sophisticated cryptocurrency transactions, money-laundering methods and emerging technologies including artificial intelligence tools to transfer millions of dollars for the North Korean government.
The sanctioned parties include Russian middleman Vitold Viktorovich Obertas (who has exchanged nearly $2 million in cryptocurrency and at least $1.25 million in other currencies for North Korean officials since January 2025), Russian Ilya Aleksandrovich Boykov (who has exchanged about $3.5 million in cryptocurrency for the related entity since 2024), as well as multiple North Korean IT worker managers and workers. The sanctioned entity is the Russia-based North Korean-controlled organization First Financial and Technical Development Center (FFTDC), whose related workers have collectively generated more than $750,000 in revenue since 2025.
Original source:
Title: Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses Publisher: U.S. Department of the Treasury Publication date: 2026-10-28 URL: https://home.treasury.gov/news/press-releases/sb0669 Nature of source: official press release Verification status: full text actually read this time (2026-10-30) Supporting content: number of sanctions targets, fraud methods (forged documents/identity theft), use of funds (WMD and ballistic missiles), specific amounts and personnel details
Title: Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control sanctioned 10 individuals and one entity... Publisher: U.S. Embassy and Consulates in China (@USA_China_Talk) Publication date: 2026-10-30 (provided by user) URL: original post provided by user Nature of source: official agency Chinese summary Verification status: cross-checked against the official press release this time (2026-10-30) Supporting content: summary of sanctions facts and methods; does not replace full details
ABAB AI Insight
North Korean IT worker remote work plans are one of the regime’s long-term mechanisms for evading sanctions and obtaining hard currency. Workers use forged or stolen identities to obtain work through freelance platforms or directly from U.S. and allied companies, and most of their wages are withheld by the regime. A United Nations expert panel previously estimated that such activities could generate annual revenue of $250 million to $600 million.
This round of sanctions focuses on facilitation networks in Russia: middlemen are responsible for cryptocurrency exchange and fund transfers, North Korean managers supervise workers to meet financial targets, and entities such as FFTDC deploy workers and use “Super Intelligence” tools to assist operations. OFAC previously sanctioned Chinyong in 2023, Alis in 2024, and Amnokgang in March 2026; this action is an extension of the ongoing campaign.
In terms of fund flows, cryptocurrency has become the main transfer tool. The sanctioned Obertas and Boykov respectively handled exchanges and conversions worth millions of dollars. In addition to earning wages, some workers also use corporate network access to deploy malware and steal data, increasing additional risks for victim companies.
This action works in coordination with related sanctions issued at the same time by Australia and the European Union, and relies on cooperation through the Multilateral Sanctions Monitoring Team (MSMT). The sanctions directly freeze the assets in the United States of the relevant individuals and entities and prohibit U.S. persons from dealing with them, aiming to cut off North Korea’s channel for continued funding through fraudulent IT employment.
ABAB News · Cognitive Law
After using forged identities to enter legitimate companies, most wages are withheld by the regime, becoming a stable source of income for sanctions evasion.
Cryptocurrency exchanges and Russian middlemen have become key links in fund repatriation.
AI tools are used to assist in identity forgery and operations, reducing the cost of sustaining large-scale remote fraud.