regulation
Treasury sanctions 10 individuals and one Russia-based entity over DPRK IT-worker crypto flows
OFAC sanctioned 10 individuals and the Russia-based FFTDC on Oct 28 over DPRK IT-worker crypto flows. Named intermediaries include Boykov ($3.5M) and Obertas (~$2M).
The U.S. Treasury's Office of Foreign Assets Control (OFAC) on Oct 28 sanctioned 10 individuals and one entity for their role in moving crypto earned by North Korean IT workers stationed in Russia and in North Korea itself. The entity, the First Financial and Technical Development Center (FFTDC), is a DPRK-controlled organization operating in Russia. Treasury's press release is at home.treasury.gov/news/press-releases/sb0669; the recent-actions notice with the SDN entries is at ofac.treasury.gov/recent-actions/20261028. Secondary coverage: CoinDesk and Decrypt.
Who was designated
Treasury's release names two main Russian intermediaries and six DPRK nationals operating from Russia on behalf of FFTDC, plus two leaders of IT-worker delegations.
| Name | Role per Treasury | Executive Order | Flows cited |
|---|---|---|---|
| Vitold Viktorovich Obertas | Russian intermediary for illicit DPRK financial transactions, including for Amnokgang | E.O. 13687 | ~$2M in crypto conversions + ≥$1.25M in other currency for DPRK officials since January 2025 |
| Ilya Aleksandrovich Boykov | Russian supporting Alis with crypto exchange, monitoring and logistics | E.O. 13687 | ~$3.5M in crypto exchanges/conversions since 2024 |
| Kim Ki Hyok | Leads a Russia-based IT-worker delegation tied to Alis (under Chinyong) | E.O. 13687 | ~$500K in crypto transfers for the delegation since 2024 |
| Kim Hyo Dong | Leads a separate Russia-based delegation under Chinyong | E.O. 13687 | >$100K equivalent in financial assets since Dec 2023 |
| Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, Hyon Se Il | Russia-based FFTDC IT workers | E.O. 13722 | Combined: >$750K generated for FFTDC since 2025 |
| First Financial and Technical Development Center (FFTDC) — entity | DPRK-controlled, exports workers from North Korea | E.O. 13722 | Treasury says FFTDC workers generated "several million dollars" |
OFAC's SDN entries list the full identifying details, including crypto wallet addresses the designated parties control. The press release itself does not reproduce the addresses — pull them from the OFAC action page.
How the flows worked
- Boykov's path is documented via Chainalysis attribution: crypto earned by a DPRK IT worker was traced to Boykov, who sent it to Garantex, the already-sanctioned Russian exchange, for cash-out.
- Obertas's conversions ran since January 2025 and are tied to Amnokgang, designated by Treasury in March 2026.
- Alis (designated March 2024) and Chinyong (designated 2023) are the North Korean fronts for IT-worker deployment that the Russia-side intermediaries served.
- FFTDC is the Russia-based deployment vehicle; its six IT workers are designated under E.O. 13722 for exporting labor from North Korea to generate state revenue.
Why E.O. 13687 and E.O. 13722
Treasury split the designations by legal theory:
- E.O. 13687 (Jan 2015) targets support for the DPRK government, Chinyong, or Alis. Treasury used it against the four leadership and intermediary figures.
- E.O. 13722 (March 2016) targets the export of workers from North Korea for state revenue — the direct hook for FFTDC and its six workers.
The authorities differ, but the sanctions effect is the same: SDN listing, US-nexus asset freeze, prohibitions on dealing by US persons.
Context — this is the third tranche this year
- March 2026: Treasury acted against six individuals and two companies tied to ~$800M in laundered crypto for North Korea (Amnokgang included).
- The March action and today's Oct 28 action together build the Russia leg of the DPRK IT-worker scheme — the one that walks earnings from freelance work on US clients back through intermediaries to Pyongyang.
- Chainalysis attribution is cited again in Boykov's case; the forensic chain of custody from on-chain exchange through Garantex is what OFAC relied on.
What to watch
- Garantex-tagged flows. OFAC's Garantex sanctions sit above today's intermediaries; whether the Garantex deposit addresses now listed in the SDN annex overlap with prior Garantex deposit books.
- Which US-nexus payroll providers paid the IT workers in the first place. Treasury's past actions on this scheme have named firms that unknowingly contracted DPRK developers through intermediary platforms; today's release stays focused on the laundering leg.
- FFTDC's successor. Export-of-workers designations do not shut down the operation — they rename it. Watch for a new Russia-based entity under the same Chinyong chain.
- Address publication. The press release does not include the wallet addresses — the OFAC SDN entries do. The timing of each address's final transaction before and after Oct 28 is the on-chain tell for operational security on the Russian side.