US Treasury sanctions Russian intermediaries facilitating North Korean IT workers' crypto cash-outs, targeting a scheme generating $250–600M annually for the regime.
Regulation & Gov ·
The US Treasury announced sanctions against 10 individuals and one entity accused of operating as intermediaries in a scheme where North Korean IT workers use fraudulent identities to secure employment and convert earnings into cash. Russian nationals Ilya Boykov and Vitold Obertas played central roles in the network, with records showing they facilitated the conversion of approximately $2 million in cryptocurrency on behalf of regime officials.
The operation exploits deceptive hiring practices to funnel income back to North Korea, with estimates placing annual proceeds between $250 million and $600 million. Advances in artificial intelligence have reportedly made it easier for recruiters to execute identity fraud, allowing remote workers to bypass employment verification systems that would normally screen out such activity.
The Treasury action targets the final stage of the cash conversion pipeline, yet questions remain about the full scale of middlemen involved and the extent to which cryptocurrency exchanges and financial platforms have detected or blocked related transactions. The scope of North Korean IT worker placement across global companies and the long-term effectiveness of sanctions against these intermediaries have not been clarified.