US sanctions Russians, North Koreans for laundering IT worker earnings

The Treasury Department on Wednesday sanctioned Russian and North Korean nationals and companies in the latest round of actions targeting Pyongyang's illicit IT worker campaign. 

Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas are accused of helping North Korea launder millions in cryptocurrency payments earned by North Koreans based in Russia working in IT roles at U.S. companies.

Treasury Secretary Scott Bessent said North Korea’s government “continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.”

Obertas is accused of laundering at least $3.5 million in cryptocurrency since January 2025 on behalf of Amnokgang, a North Korean shell company sanctioned by the U.S. in March. 

Boykov was allegedly also a key money launderer for the North Korean company, exchanging and converting about $3.5 million in cryptocurrency since 2024. He is also suspected of providing logistical and financial support for North Korean company Alis, which is subordinate to several other sanctioned North Korean companies and was itself sanctioned in 2024. 

Wednesday’s sanctions also include multiple North Koreans, including Kim Hyo Dong and Kim Ki Hyok, a senior Alis employee. 

Hyok is the leader of a Russia-based delegation of North Korean IT workers tasked with monitoring the employees and ensuring they meet financial earnings targets, the Treasury said. Hyok has transferred at least $500,000 to North Korea for the delegation since 2024, they said. 

Dong allegedly leads another squad of North Korean IT workers, providing logistical assistance and transferring over $100,000 in financial assets in an effort to evade sanctions. 

North Korean company First Financial and Technical Development Center was also sanctioned on Wednesday for its alleged role in managing millions of dollars earned by North Koreans based in Russia. 

The company has helped IT workers use artificial intelligence as they attempt to get hired at U.S. companies, the Treasury said, and has used sophisticated money laundering methods to conceal the money earned by the workers. 

The sanctions also target six IT workers — Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il — who have earned at least $750,000 on behalf of the company since 2025.

The Office of Foreign Assets Control (OFAC) has sanctioned dozens of North Korean officials and companies this year in an effort to hamper the IT worker scheme, which has netted Pyongyang millions that are allegedly used to fund ballistic missile programs.

The wide-ranging scheme involves North Korean nationals using stolen or purchased identities to get hired in high-paying IT roles at U.S. and European companies or government agencies. In addition to regular salaries, the workers have found multiple ways to monetize their positions, including extorting companies that hire them, stealing sensitive corporate documents or facilitating multi-million dollar crypto thefts. 

Two weeks ago, the Justice Department disrupted dozens of laptop farms in Texas and arrested two people for their involvement in the scheme.  

Multiple Americans, including at least one active duty member of the U.S. Army, have been convicted and sentenced for allowing their identities to be used by North Korean IT workers or for hosting laptops that allow the North Koreans to appear as if they are working from the U.S. 

The FBI warned that North Korea is now targeting low-income Americans, offering freelance gigs with mundane requests like hosting laptops or interviewing on someone’s behalf. The FBI said it has seen North Korean IT workers strategize on the best locations to connect with Americans “facing financial stress.”

The Treasury Department noted that Australia sanctioned several North Korean nationals and companies last week that are allegedly involved in the IT worker scheme.