The US Treasury Department announced fresh sanctions targeting a network accused of helping North Korea collect wages through the use of fake identities and forged documentation. Authorities allege these schemes allowed North Korean workers to operate under assumed personas for foreign employers, including American firms.
North Korea’s use of false identities and AI tools
Investigators stated that North Korean IT workers used AI-generated resumes, altered photographs, and deepfake videos to successfully secure positions at legitimate companies abroad. These workers reportedly sent most of their earnings back to the regime, providing crucial support for North Korea’s ballistic missile and weapons of mass destruction programs.
Officials warned that some of these workers had successfully accessed company networks, where they deployed malware and exfiltrated sensitive corporate data.
Network of sanctioned individuals and entities
The new US action centers on ten individuals and one company accused of orchestrating payment transfers for Pyongyang. Two Russian nationals, Vitold Obertas and Ilya Boykov, are alleged to have played key roles. The Treasury labeled Obertas as a facilitator for North Korean financial transactions, claiming he managed nearly $2 million in cryptocurrency exchanges and at least $1.25 million in additional currency transfers for regime officials since January 2025.
Boykov allegedly converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT company already facing US sanctions since 2024.
Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were identified as leaders of worker delegations based in Russia. Treasury asserted that Kim Ki Hyok processed approximately $500,000 in cryptocurrency transfers for his group since 2024.
The First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia, also came under sanction. Treasury named six of its workers, collectively accused of generating more than $750,000 for the entity since 2025.
Mini dictionary: The First Financial and Technical Development Center is a North Korean entity based in Russia, designated by the US for its involvement in supporting North Korean overseas labor and illicit finance operations.
| Individual/Entity | Alleged Activity | Amount (USD or equivalent) | Country |
|---|---|---|---|
| Vitold Obertas | Crypto transactions facilitation | $2 million (crypto); $1.25 million (other) | Russia |
| Ilya Boykov | Crypto conversion for Alis | $3.5 million | Russia |
| Kim Ki Hyok | Worker delegation leader, transferred crypto | $500,000 | Russia |
| First Financial and Technical Development Center (with 6 workers) | Funds for the entity | $750,000+ | Russia/North Korea |
Treasury released Ethereum and Tron wallet addresses linked to the sanctioned individuals, urging crypto exchanges and financial institutions to closely monitor transactions involving these accounts. One Ethereum address is reportedly connected to both Obertas and Boykov.
International cooperation and increased enforcement
This latest round of sanctions follows a March designation targeting another North Korean IT worker network. Treasury previously stated this network had laundered approximately $800 million in cryptocurrency on behalf of Pyongyang.
Australia and the European Union implemented similar designations in June, with the US Treasury coordinating these efforts alongside the Multilateral Sanctions Monitoring Team.
Current US sanctions freeze any financial assets held by the named individuals or entities within the United States or under US jurisdiction. All related transactions are barred unless specifically licensed, and companies at least 50% owned by sanctioned parties face the same restrictions. Officials cautioned that even unintentional violations of these measures can result in civil penalties.
Guidance from the State, Treasury, and Justice departments, along with the FBI, urges companies employing remote staff to verify identities, examine payment flows, and scrutinize irregular access requests to help prevent falling victim to these schemes.
