US Treasury Targets 11 in North Korean Crypto Scheme

Treasury sanctions 11 over North Korean IT worker scheme that moved millions in crypto

The U.S. Department of the Treasury on Wednesday sanctioned 10 individuals and one entity for their roles in North Korean overseas IT worker schemes that the government says defraud U.S. businesses and generate revenue for Pyongyang’s weapons programs.

According to Treasury’s Office of Foreign Assets Control (OFAC), the networks relied on cryptocurrency transfers, sophisticated money-laundering techniques, and AI tools to move funds and obscure their origins.

A central target of the action was the First Financial and Technical Development Center, a North Korean-controlled organization based in Vladivostok, Russia. Treasury said the center deploys highly trained IT workers who use AI tools and “complex cryptocurrency transfers” to generate revenue.

Treasury said six Russia-based North Korean IT workers have generated more than $750,000 for the center since 2025. OFAC designated the organization and six of its operatives alongside it.

OFAC also sanctioned two North Korean nationals described as leaders of Russia-based IT worker delegations. One of them, Kim Ki Hyok, was identified by Treasury as responsible for monitoring personnel and ensuring financial targets are met; the department said he has transferred nearly $500,000 in cryptocurrency for his delegation since 2024.

The sanctions also named facilitators involved in converting crypto into traditional currency for North Korean-linked networks. Treasury said Russian intermediary Vitold Viktorovich Obertas allegedly handled nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.

In additional details cited by OFAC, two Russian nationals were described as having converted more than $5 million in crypto for North Korean networks, and the agency listed related wallet information in its designations.

The move follows earlier U.S. actions targeting similar activity. On March 12, 2026, OFAC sanctioned six individuals and two entities tied to North Korean government-orchestrated IT worker fraud schemes that Treasury said generated nearly $800 million in 2024 to fund the Democratic People’s Republic of Korea (DPRK)’s WMD and ballistic missile programs.

That March action included designations of specific crypto addresses linked to the scheme, including two Ethereum addresses associated with Yun Song Guk, described as leading North Korean IT workers operating out of Boten, Laos, and one Bitcoin address linked to Hoang Minh Quang, who Treasury said coordinated more than $70,000 in related financial transactions.

Treasury framed the latest designations as part of a broader, coordinated effort. The department said the action builds on the March sanctions and noted that Australia and the European Union have made their own designations this month.

More broadly, Treasury has repeatedly pointed to cryptocurrency as a key enabler of North Korea’s sanctions evasion. In describing recent cases, the department said DPRK-linked actors use digital assets to move value across borders, convert crypto into fiat through intermediaries, and route funds through complex transfers—supporting overseas IT worker operations that ultimately generate revenue for the regime.

• What happened: OFAC sanctioned 10 individuals and one entity tied to DPRK-linked overseas IT worker schemes involving crypto.
• Key entity: The First Financial and Technical Development Center, described as North Korean-controlled and based in Vladivostok, Russia.
• Why it matters: Treasury says the schemes target U.S. businesses and funnel proceeds toward DPRK weapons programs, using crypto and laundering techniques to move funds.
• Broader context: The action follows OFAC’s March 2026 designations and coincides with related moves by Australia and the EU.