U.S. Treasury Cracks Down on North Korean Crypto Money Laundering: Sanctions Imposed on 10 Individuals and 1 Entity

Author: TechFlow

TechFlow Editor's Note:In response to covert money laundering by North Korean shadow networks through crypto assets, regulators in the United States, Europe and other jurisdictions have coordinated enforcement. On Oct. 28, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) officially published a new sanctions list, imposing severe sanctions on 10 key individuals and 1 front entity.

The individuals and entities sanctioned in this action were deeply involved in a transnational fraud scheme involving North Korean IT workers. They used fabricated identities to apply remotely for positions at U.S. technology companies, then colluded with Russian intermediaries to convert millions of dollars in illicit salaries into crypto assets, laundered the proceeds and transferred them to North Korea's weapons of mass destruction development programs.

With Australia and the European Union taking action in the same month, Western allies are fully escalating their joint containment of this new cybercrime model. These sanctions not only reveal the money-laundering undercurrent created by combining remote employment with on-chain anonymity, but also sound an alarm for global technology companies on cross-border hiring background checks and digital asset compliance.

Precise Sanctions: OFAC Targets Cross-Border Impersonators and Offshore Money-Laundering Nodes

U.S. regulators are steadily intensifying enforcement against covert cross-border fund flows. As disclosed in theU.S. Department of the Treasury's official sanctions notice, OFAC on Oct. 28 formally imposed a comprehensive freeze on financial assets of 10 individuals and 1 key entity involved in the case.

Investigations show that these sanctioned targets formed an underground illicit network with precise division of labor. North Korean technicians used stolen legitimate citizen identities to infiltrate U.S. technology and business companies remotely, then covertly transferred millions of dollars in salaries and project payments to non-custodial wallets controlled by offshore intermediaries.

The U.S. Department of the Treasury stated clearly that these outflowing funds were not used for civilian development, but were systematically diverted and returned to directly finance North Korea's weapons of mass destruction (WMD) and advanced ballistic missile development. Cutting off this funding pipeline is a core strategic measure to weaken its weapons proliferation capability.

Under the sanctions order, all assets and financial interests of the sanctioned individuals and entities within the United States will be immediately blocked. Any financial institution or crypto service provider subject to U.S. jurisdiction is strictly prohibited from engaging in any direct or indirect transaction with the sanctioned parties.

Cross-Border Arbitrage Operators Exposed: Transfer Path of Millions in Crypto Funds Revealed

On the newly disclosed sanctions list, two Russian nationals serving as over-the-counter (OTC) crypto exchange intermediaries became key to the case. Official investigations detailed how they used peer-to-peer (P2P) markets and offshore channels to help North Korean entities launder large illicit payments.

Among them, Russian national Ilya Boykov acted as a highly active OTC dealer. Since 2024, Boykov has provided illicit funding channels for Alis, a company controlled by North Korea, helping convert approximately $3.5 million in crypto assets and rapidly moving them into hard-to-trace fiat cash.

Another Russian operator, Vitold Obertas, was also deeply involved in the laundering chain. Since Jan. 2025, Obertas has provided tailored exchange services for multiple senior North Korean officials, completing nearly $2 million in crypto asset laundering operations in a very short time.

In addition, FFTDC, a shell entity established in Russia and effectively controlled by North Korea, was also dismantled. Six core IT workers under this entity generated more than $750,000 in revenue since 2025, and all members and the entity were blacklisted in this action.

Fraudulent Remote Work: How Tech Companies Became Funding ATMs for Geopolitical Objectives

The remote fake job application scheme revealed behind this case reflects major hiring compliance vulnerabilities of global technology companies in the post-pandemic era. As remote and hybrid work has become the norm in Silicon Valley and Western tech sectors, transnational hacker teams have quickly weaponized the job market.

The North Korean IT technicians involved typically possess high-level software development skills. They used fake identity documents purchased or forged on the dark web, borrowed bank accounts of third-party agents, and evaded strict interview processes to secure core software development roles at multiple Western companies.

After being hired, these technicians earned legitimate high salaries as high as hundreds of thousands of dollars while also planting backdoor programs in development code and stealing companies' core code and proprietary data when possible. This not only caused substantial financial losses for victim companies, but also created a systemic intellectual property crisis.

In response to this rampant phenomenon, the U.S. Federal Bureau of Investigation (FBI) has previously issued multiple specialized security alerts. Regulatory authorities have warned technology employers across the United States that they must establish enhanced vetting mechanisms for technology outsourcing, third-party code submissions, and verification of employees' actual backgrounds to prevent infiltration of internal networks.

Multilateral Coordination Among Global Allies: Comprehensive Enforcement Sweep on Crypto Compliance and Cross-Border AML

It is worth noting that the U.S. sanctions in this case are by no means unilateral actions but an important part of a multilateral encirclement carried out by major Western economies in the digital anti-money laundering domain. Earlier this month, the Australian government and the Council of the European Union also successively issued coordinated sanctions against the same criminal network.

This intensive joint law enforcement spanning the Americas, Europe, and Asia-Pacific shows that the gray area of using decentralized crypto assets to circumvent international sanctions is being rapidly narrowed by major regulators with unprecedented force. The global monitoring network targeting darknet traders and OTC exchange intermediaries has enabled multinational intelligence sharing.

For the global crypto-asset industry, this case sends an extremely clear signal about the compliance bottom line. Any compliant exchange, decentralized cross-chain bridge, or liquidity market maker that neglects to apply real-time filtering to high-risk on-chain addresses can easily become a stepping stone in a money-laundering chain and face collateral penalties under long-arm jurisdiction.

In the face of increasingly complex cross-border fraud and AI-assisted money-laundering methods, traditional static blacklist systems are clearly insufficient to address the threat. Only by deeply integrating look-through vetting of corporate hiring backgrounds with multidimensional on-chain and off-chain intelligence tracking can the risk of sensitive funds leaking through digital-asset back channels be effectively blocked.

Source: TechFlow