Quick answer: In new North Korea IT worker sanctions on Oct. 28, 2026, the US Treasury’s OFAC blocked 10 people and one entity. The SDN entries list eight distinct Ethereum and Tron addresses tied to three facilitators, who moved roughly $6 million in crypto, per Treasury and TRM Labs.
North Korea IT worker sanctions landed again on Oct. 28, 2026. The US Treasury’s Office of Foreign Assets Control (OFAC) blocked 10 individuals and one entity that it says run or support North Korean remote IT worker schemes, and it listed eight crypto addresses on Ethereum and Tron.
The action matters for crypto because the money trail runs through wallets, not bank wires. As a result, any exchange, stablecoin issuer or wallet service that touches those addresses now carries US sanctions risk.
What happened in the North Korea IT worker sanctions?
According to the Treasury press release, the targets help North Korean workers land remote jobs with fake identities. Then the regime keeps most of their wages, which Treasury says funds its weapons and ballistic missile programs. In addition, Treasury says some workers used their access to deploy malware, steal data and extort employers.
The named facilitators and their alleged roles:
- Vitold Obertas, a Russian intermediary, ran nearly $2 million in crypto conversions since January 2025. He also handled at least $1.25 million in other currency deals for North Korean officials.
- Ilya Boykov, a Russian national, exchanged and converted the equivalent of $3.5 million in crypto since 2024 for Alis, a Russia-based IT worker company.
- Kim Ki Hyok leads the Alis delegation in Russia and moved nearly $500,000 in crypto since 2024.
- Kim Hyo Dong leads a separate delegation and moved over $100,000 in assets since at least December 2023.
OFAC also named the First Financial and Technical Development Center (FFTDC), a North Korean-controlled entity in Russia, plus six of its workers. Together, those workers generated over $750,000 since 2025. Treasury says they use AI tools and complex crypto transfers to hide the money.
Which crypto addresses did OFAC list?
The OFAC recent actions notice attaches addresses to three people: Obertas, Boykov and Kim Ki Hyok. TRM Labs counted nine address entries but only eight distinct addresses, because one Ethereum address appears under both Russian facilitators.
That leaves three Ethereum addresses and five Tron addresses. Notably, the Tron weighting is telling. Tron is the main network for Tether’s USDT transfers, and TRM says it traced direct USDT payments from addresses tied to Amnokgang, a company sanctioned in March, to Obertas.
By contrast, FFTDC and its six workers have no listed addresses. In other words, the wallet list covers the cash-out layer, not the workers themselves.
Why the North Korea IT worker sanctions matter for crypto
First, compliance teams have new names to screen. OFAC can fine firms on a strict liability basis, so a US platform that processes a transfer from a listed address can face penalties even without intent. Meanwhile, foreign firms that cause a US violation are also exposed.
Second, the action shows how this revenue moves. The pattern is wages in, stablecoins across, then conversion through Russian middlemen. That mirrors what investigators found in larger North Korea cases, such as the laundering trail we covered in the Drift exploiter Tornado Cash story.
Third, it widens a steady campaign. This round builds on OFAC’s March 12, 2026, action against a separate IT worker network. Treasury also says Australia and the European Union made their own North Korea designations this month. For context on how Washington uses crypto seizures as a policy tool, see our report on the US plan to seize $1 billion in Iran crypto.
“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives,” Treasury Secretary Scott Bessent said in the release.
Market data and context
The sanctions did not move prices. At 19:58 UTC on Oct. 28, 2026 (19:58 in Casablanca), CoinGecko showed Ether at $2,367, up 0.9% in 24 hours. Tron’s TRX traded at $0.3295, roughly flat, and USDT held its peg near $0.999. You can follow ETH on our Ethereum price page.
Still, by crypto standards, the sums are small. Added up, the three listed wallet owners moved about $6 million, per Treasury’s figures. However, Treasury says these schemes bring in hundreds of millions of dollars overall. So each named wallet is one node in a much larger network.
| Target | Role (per OFAC) | Amount cited | Listed addresses |
|---|---|---|---|
| Ilya Boykov | Converts crypto for Alis | $3.5M (since 2024) | 2 ETH, 2 TRX |
| Vitold Obertas | Intermediary for Amnokgang | ~$2M crypto + $1.25M other | 1 ETH, 3 TRX |
| Kim Ki Hyok | Leads Alis delegation | ~$500K (since 2024) | 1 ETH |
| FFTDC + 6 workers | IT worker revenue | Over $750K (since 2025) | None |
What to watch next
- Stablecoin freezes. Tether has frozen sanctioned addresses in past cases. Watch whether the five Tron addresses get frozen and how much USDT they hold.
- More addresses. TRM says it will keep tracing linked wallets. Typically, analytics firms find more addresses than the SDN List names.
- Hiring checks. Treasury, the FBI and the State Department have issued advisories on fake remote workers. Because crypto startups that hire remote developers are prime targets, expect tighter identity checks.
North Korea IT Worker Sanctions FAQ
What did OFAC announce on Oct. 28, 2026?
OFAC sanctioned 10 individuals and one entity, the First Financial and Technical Development Center, for running or supporting North Korean IT worker schemes. Their US assets are blocked, and US persons generally cannot deal with them.
How many crypto addresses are on the list?
In total, the SDN entries contain nine address listings but eight distinct addresses, per TRM Labs. Three are on Ethereum and five are on Tron, all tied to Obertas, Boykov and Kim Ki Hyok.
Do the sanctions affect regular ETH or TRX holders?
No. The rules target the listed people, entities and addresses. However, sending funds to or receiving funds from a listed address can create legal risk, and exchanges may freeze such deposits.
Sources
- U.S. Treasury: Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses (Oct. 28, 2026)
- OFAC: North Korea Designations, Recent Actions (Oct. 28, 2026)
- TRM Labs: OFAC Designates Facilitators of North Korean IT Worker Schemes
- The Defiant: US Sanctions Crypto Facilitators Linked to North Korean IT Worker Schemes
- CoinGecko: Ethereum price
This article is for information only and is not financial or legal advice.
