US sanctions 10 individuals, entity over North Korean crypto fraud and $285M Drift hack

The US Treasury Department has imposed sanctions on 10 individuals and one entity for their roles in schemes designed to defraud American companies through North Korean IT workers. Officials stated that these operations have generated significant income for the country’s weapons programs by leveraging advanced cryptocurrency transactions, money laundering techniques, and artificial intelligence tools.

Sanctioned Networks and Methods

North Korea, according to Treasury, places its IT workers in legitimate foreign companies with fake documents and stolen identities. The regime then claims the majority of their wages, which have contributed hundreds of millions of dollars to its illicit weapons initiatives. Treasury highlighted the use of sophisticated crypto transfers and shell companies as key tactics in moving funds to the regime, bypassing traditional financial restrictions.

Among those sanctioned are two Russian nationals, Vitold Obertas and Ilya Boykov. Treasury explained that, since January 2025, Obertas has facilitated almost $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions on behalf of North Korean officials. Boykov, meanwhile, is reported to have exchanged and converted $3.5 million in crypto since 2024 for Limited Liability Company Alis, an IT worker firm tied to North Korea and sanctioned last year.

Sanctions listings also published multiple blockchain addresses. The listings showed two Ethereum and two Tron addresses for Boykov, and one Ethereum plus three Tron addresses for Obertas—one Ethereum address is linked to both men.

The First Financial and Technical Development Center, a Vladivostok-based entity under North Korean control, was also sanctioned. Thirty-party data identified it as deploying highly trained IT workers skilled in AI and “complex cryptocurrency transfers” to raise funds for the regime. Treasury stated that six North Korean IT workers based in Russia generated more than $750,000 for this center since 2025.

Mini dictionary: Office of Foreign Assets Control (OFAC) is a financial intelligence and enforcement agency of the US Treasury. It administers and enforces economic and trade sanctions based on US foreign policy and national security goals.

Key Individuals and Expanded Efforts

Two North Korean nationals were individually sanctioned: Kim Ki Hyok and another leader of Russia-based IT delegations. Treasury said that Kim and his team have transferred roughly $500,000 in cryptocurrency since 2024. The agency emphasized that North Korean cyber operatives regularly adopt false personas and embed themselves into company operations, sometimes using AI-powered developer tools to increase the effectiveness of their campaigns.

Officials described an ongoing pattern where North Korean IT operatives employ fabricated identities and sophisticated digital tools to exploit American businesses, channeling substantial earnings toward the regime’s ballistic missile and weapons of mass destruction programs.

The recent actions follow earlier sanctions in March against a separate North Korean IT network, as well as similar designations from Australia and the European Union during the same period.

Drift Protocol Hack Linked to North Korean Groups

The targeting of cryptocurrency projects by North Korean groups has drawn heightened concern in recent years. In April 2025, Google’s Threat Intelligence Group reported North Korean IT workers embedded in crypto startups and decentralized finance (DeFi) projects across several European countries, some using up to 12 fake identities simultaneously to avoid detection. These operatives reportedly contributed to Solana smart contracts and similar initiatives.

One of the largest related exploits involved the Solana-based decentralized exchange Drift Protocol. The Drift team revealed that an April 2025 attack, which siphoned approximately $285 million from the platform, was the result of a six-month intelligence operation orchestrated by a North Korean-connected threat group. The attackers built trust with Drift contributors using fake professional backgrounds, in-person meetings at conferences, and exploited software tools to breach company defenses before draining funds.

Drift Protocol detailed that North Korean operatives invested months crafting fake personas and establishing direct relationships with project contributors before executing the high-profile exploit.

Mini dictionary: Drift Protocol is a decentralized exchange built on the Solana blockchain, offering on-chain trading and derivatives features. Unlike centralized exchanges, Drift uses smart contracts to manage assets and automate trades directly on the blockchain.

These developments illustrate the ongoing risks facing the blockchain industry from actor groups employing both technical expertise and social engineering methods to infiltrate and exploit crypto companies and protocols.