The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned 10 individuals and one entity for their roles in North Korean government-run IT worker schemes that defraud U.S. businesses and generate revenue for Pyongyang’s weapons of mass destruction and ballistic missile programs.
Among those designated are two Russian nationals who served as key financial facilitators for the networks, according to the Treasury’s announcement on 28 October 2026.
Vitold Viktorovich Obertas (Витольд Викторович Обертас)
Obertas is a Russian intermediary for illicit DPRK financial transactions, including for Amnokgang Technology Development Company, which OFAC designated in March 2026. Since January 2025, Obertas has conducted nearly $2 million** worth of cryptocurrency conversions, as well as at least **$1.25 million in other currency transactions, for DPRK officials.
According to OFAC’s designation data:
-
Name: OBERTAS, Vitold Viktorovich (Cyrillic: ОБЕРТАС, Витольд Викторович)
-
Date of birth: 18 November 1968
-
Place of birth: Vladivostok, Russia
-
Nationality: Russia
-
Gender: Male
-
National ID No.: 4613339474 (Russia), issued 20 January 2013
-
Digital currency addresses (ETH): 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510
-
Digital currency addresses (TRX): TCV4qdpTxoMyqkn7sSPeRrXmhH5JFxMvmT; alt. TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm; alt. TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg
Obertas was designated pursuant to Executive Order 13687 for having materially assisted, sponsored, or provided financial, material, or technological support for the Government of North Korea.
Ilya Aleksandrovich Boykov (Илья Александрович Бойков)
Boykov has actively supported Limited Liability Company Alis since 2024 by exchanging and converting the equivalent of $3.5 million in cryptocurrency transactions, monitoring cryptocurrency transactions, and providing logistical support for Alis.
According to OFAC’s designation data:
-
Name: BOYKOV, Ilya Aleksandrovich (Cyrillic: БОЙКОВ, Илья Александрович)
-
Date of birth: 30 May 1994
-
Nationality: Russia
-
Gender: Male
-
Passport: 620645580 (Russia), expired 17 June 2009
-
Digital currency addresses (ETH): 0x12Ea80238C7d805D003ce793594e92d84A6f4E8d; alt. 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510
-
Digital currency addresses (TRX): TQKoDq5aCrWAciiNtete5pDYVN38i4qFN1; alt. TXmrnVgsqCMJncYHTXchuJ5z111BXSj4g3
Boykov was designated pursuant to E.O. 13687 for having materially assisted, sponsored, or provided financial, material, or technological support for Alis.
The Broader Network
The action also targeted DPRK nationals operating Russia-based delegations:
-
Kim Ki Hyok (김기혁) — leads a Russia-based delegation of DPRK IT workers under Alis, monitoring workers and ensuring they meet financial targets. Since 2024, he has transferred cryptocurrency for the delegation valued at nearly $500,000. DOB: 30 May 1980; nationality: North Korea; ETH address: 0xE4C9a7F68B1EbA4508f54f07f7378847318dD1A3.
-
Kim Hyo Dong (김효동) — leads a separate Russia-based Chinyong-subordinate delegation. Since at least December 2023, he has provided logistical assistance, engaged in sanctions evasion, and facilitated the transfer of over $100,000 in financial assets. DOB: 28 December 1989; passport: 108130286 (North Korea).
Six additional DPRK IT workers — Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il — were sanctioned for collectively generating over $750,000 on behalf of the First Financial and Technical Development Center (FFTDC), a DPRK-controlled entity located in Russia.
The FFTDC itself was designated pursuant to E.O. 13722 for engaging in, facilitating, or being responsible for the exportation of workers from North Korea to generate revenue for the North Korean government.
“Weaponizing Sensitive Data”
“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” said Treasury Secretary Scott Bessent. “Under President Trump’s leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable.”
The Treasury noted that DPRK IT workers have exploited their access to corporate networks to deploy malware, exfiltrate sensitive data, and steal proprietary information. The networks have leveraged sophisticated cryptocurrency transactions, money laundering techniques, and emerging technologies, including artificial intelligence tools, to move millions of dollars for the North Korean government.
The action builds on OFAC’s March 2026 designation of a separate DPRK IT worker network. The United States was joined this month by Australia and the European Union in designating individuals and entities supporting the DPRK’s revenue generation and military activities.
Sanctions Implications
All property and interests in property of the designated persons that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. Entities owned 50 percent or more, directly or indirectly, by one or more blocked persons are also blocked.
