OFAC Designates Facilitators of North Korean IT Worker Schemes Targeting US Businesses

Key takeaways

• On October 28, 2026, OFAC designated ten individuals and one entity for their roles in North Korea IT worker schemes, targeting facilitators and workers based in North Korea and Russia.
• OFAC says the schemes defraud US businesses and generate revenue for North Korea’s weapons of mass destruction and ballistic missile programs.
• Three of the designated individuals have cryptocurrency ties. The designation lists eight addresses for them, and TRM has added all of them to TRM under sanctions.
• The action extends earlier designations of Chinyong Information Technology Cooperation Company (May 2023) and Amnokgang Technology Development Company (March 2026), and shows these networks relying on Russia-based delegations and intermediaries.
• The newly designated First Financial and Technical Development Center, and six workers tied to it, generated more than USD 750,000 since 2025. The designation lists no crypto addresses for them.

{{horizontal-line}}

On October 28, 2026, the US Office of Foreign Assets Control (OFAC) designated ten individuals and one entity for their roles in North Korean government-run IT worker schemes. According to OFAC, these schemes defraud US businesses and generate revenue for North Korea’s weapons of mass destruction and ballistic missile programs. The designations target facilitators and North Korea IT workers based in North Korea and Russia, and build on OFAC's March 12, 2026 designation of a separate North Korea IT worker network.

Three of the designated individuals have cryptocurrency ties, and the designation lists eight cryptocurrency addresses for them. TRM Labs has added all three individuals and their addresses to TRM under sanctions.

A Russian intermediary for North Korean financial transactions

According to OFAC, Vitold Viktorovich Obertas is a Russian intermediary for illicit North Korean financial transactions, including for Amnokgang Technology Development Company, which OFAC designated on March 12, 2026. Since January 2025, Obertas has conducted nearly USD 2 million in cryptocurrency conversions and at least USD 1.25 million in other currency transactions for North Korean officials. OFAC designated Obertas under Executive Order (E.O.) 13687.

The Alis delegation and its facilitators

OFAC also targeted a Russia-based delegation of IT workers. Limited Liability Company Alis (Alis) is a Vladivostok-based company that the UN Panel of Experts flagged in March 2024 as a possible North Korean-Russian joint venture owned in part by a North Korean national. OFAC describes Alis as a subordinate of Chinyong Information Technology Cooperation Company (Chinyong), which OFAC designated in May 2023. According to OFAC, Kim Ki Hyok leads Alis's Russia-based delegation of North Korean IT workers and monitors the workers, ensures they meet their financial targets, and has transferred nearly USD 500,000 in cryptocurrency for the delegation since 2024. Russian national Ilya Aleksandrovich Boykov has supported Alis since 2024 by exchanging and converting an equivalent of USD 3.5 million in cryptocurrency, monitoring cryptocurrency transactions, and providing logistical support. OFAC also designated Kim Hyo Dong, who leads a separate Russia-based Chinyong-subordinate delegation and has facilitated the transfer of over USD 100,000 equivalent in financial assets since at least December 2023. OFAC designated Kim Ki Hyok, Kim Hyo Dong, and Boykov under E.O. 13687.

The UN Panel of Experts has reported that Chinyong, which is subordinate to North Korea’s Ministry of People's Armed Forces, handled tens of millions of dollars in transactions between 2017 and 2022, using bank accounts in China and Russia to launder IT worker revenue. TRM already attributes addresses to both Chinyong and Amnokgang.

A North Korean-controlled entity in Russia

OFAC designated the First Financial and Technical Development Center (FFTDC) under E.O. 13722 for exporting workers from North Korea to generate revenue for the North Korean government. According to OFAC, FFTDC is a North Korean-controlled entity located in Russia whose IT workers use complex cryptocurrency transfers and other money laundering methods. Since 2025, six Russia-based North Korean IT workers have collectively generated over USD 750,000 on behalf of FFTDC: Kim Kyong Ju, Ri Thae Chol, So Hyong Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il. OFAC designated all six under E.O. 13722. The designation lists no cryptocurrency addresses for FFTDC or these six individuals.

Addresses in the designation

TRM analysis of the designation shows eight cryptocurrency addresses across three individuals. One Ethereum address appears on the listings for both Obertas and Boykov.

• Obertas, Ethereum: 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510
• Obertas, TRON: TCV4qdpTxoMyqkn7sSPeRrXmhH5JFxMvmT
• Obertas, TRON: TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm
• Obertas, TRON: TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg
• Boykov, Ethereum: 0x12Ea80238C7d805D003ce793594e92d84A6f4E8d
• Boykov, Ethereum: 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510
• Boykov, TRON: TQKoDq5aCrWAciiNtete5pDYVN38i4qFN1
• Boykov, TRON: TXmrnVgsqCMJncYHTXchuJ5z111BXSj4g3
• Kim Ki Hyok, Ethereum: 0xE4C9a7F68B1EbA4508f54f07f7378847318dD1A3

What this means for compliance teams

OFAC's action reaches individuals and an entity that operate in Russia and move funds through cryptocurrency conversions. Blocked-persons rules apply to any entity owned 50% or more, directly or indirectly, by the designated persons. TRM will continue to investigate and add any additional addresses as they are found.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What are North Korean IT worker schemes?

North Korean IT worker schemes use workers based in North Korea or abroad who pose as freelancers, often with fraudulent documents or stolen identities, to get remote jobs at US and other companies. Their earnings are sent back to the North Korean government.

2. Why do these schemes matter for national security?

According to OFAC, the revenue funds North Korea’s weapons of mass destruction and ballistic missile programs, so the activity is a sanctions and national security risk, not only fraud.

3. Who did OFAC designate on October 28, 2026?

Ten individuals and one entity: the First Financial and Technical Development Center, six North Korean IT workers linked to it, and facilitators including Vitold Obertas, Ilya Boykov, Kim Ki Hyok and Kim Hyo Dong.

4. What role does cryptocurrency play?

Cryptocurrency can serve several functions within North Korean financial operations, including:

• Moving funds across borders
• Laundering proceeds from cybercrime or fraud
• Converting revenue generated by IT worker schemes

5. How are Amnokgang and Chinyong connected to this action?

OFAC describes Obertas as an intermediary for Amnokgang and Alis as a subordinate of Chinyong. TRM identified direct USDT transfers from Amnokgang-attributed addresses to Obertas's addresses.