US sanctions North Korea IT worker fraud facilitators

The US Treasury has sanctioned 10 individuals and one entity for facilitating North Korea's overseas IT worker schemes, which Treasury says defraud US businesses and fund Pyongyang's weapons programs.

Why it matters: Treasury says the networks convert millions of dollars in cryptocurrency for North Korean officials and place workers inside legitimate companies, where they have stolen data and deployed malware, so the designations are an instruction to employers and crypto intermediaries as much as to banks.

Data as of US Department of the Treasury press release sb0669, published October 28, 2026 and read in full in this run. All designation facts and transaction figures are the Treasury's own, stated in the release as the basis for the action. Developing item.

The Treasury’s Office of Foreign Assets Control on Wednesday sanctioned 10 individuals and one entity for their roles in North Korean IT worker schemes, in which workers using fraudulent documents and stolen identities take jobs at legitimate companies, including in the United States, and hand most of their wages to Pyongyang. The designations cover Russia-based facilitators who Treasury says converted cryptocurrency for North Korean officials, including Vitold Viktorovich Obertas, at nearly 2 million dollars since January 2025, and Ilya Aleksandrovich Boykov, at 3.5 million dollars since 2024, along with the First Financial and Technical Development Center, a North Korea-controlled entity in Russia whose IT workers Treasury says generated several million dollars.

Secretary of the Treasury Scott Bessent said the regime weaponizes sensitive data and extorts businesses, and that Treasury will continue to use all available tools against the schemes. The action builds on OFAC’s March 12, 2026 designation of a separate North Korean IT worker network, and Treasury said Australia and the European Union are also designating supporters of North Korean revenue generation this month. All property of the designated persons subject to US jurisdiction is blocked.

US sanctions North Korea IT worker fraud facilitators

Sources