# US sanctions North Korean network, lists eight crypto addresses Author: Abdullah Özkurt Language: English Published: 2026-10-28T19:54:10+03:00 Updated: 2026-10-28T23:11:50+03:00 ![A red metal clamp holds a fibre cable bundle beside laptops and a folded North Korean flag.](https://kriptometa.com/uploads/abd-den-kuzey-kore-agina-yaptirim-sekiz-kripto-adresi-50636b8a41ab_article.webp) ## Key takeaways - The October 28 action covers two Russian intermediaries and North Korean managers and workers. - One Ethereum address appears under two people, leaving eight distinct addresses across nine entries. - OFAC does not require blocked cryptocurrency to be converted into US dollars. The US Treasury targeted North Korean IT workers using false identities and intermediaries moving their earnings. The listings include three Ethereum and five Tron addresses; the reported amounts cover different periods and activities. The US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 people and one entity on October 28 for supporting North Korean IT-worker operations. [Treasury says](https://home.treasury.gov/news/press-releases/sb0669) the workers use fraudulent documents and stolen identities to obtain jobs at companies in the United States and allied countries, while the regime takes most of their wages to support weapons of mass destruction and ballistic missile programs. The targets include team managers, workers and intermediaries who move their earnings. According to Treasury, the networks use cryptocurrency transfers, money-laundering methods and artificial intelligence tools. Some workers also deploy malware and take sensitive or proprietary information from company systems. The department estimates that the regime takes in hundreds of millions of dollars from IT workers’ wages. ## What did the intermediaries in Russia do? Russian national Vitold Viktorovich Obertas converted and moved funds for North Korean officials, according to Treasury. The organizations he supported include Amnokgang, which was sanctioned on March 12, 2026. Another Russian intermediary, Ilya Aleksandrovich Boykov, exchanged and converted cryptocurrency for the Alis IT team, monitored its crypto transactions and provided logistical support. Treasury says Kim Ki Hyok leads the Alis team in Russia and ensures workers meet their financial targets. Kim Hyo Dong leads a separate Chinyong team in Russia, provides logistical help and works to evade sanctions. OFAC had already designated Alis in March 2024 and its parent Chinyong in May 2023. Amounts Treasury attributes to individuals and groups. The periods and activities differ, and the department did not present them as a single total. | Person or group | Period | Reported activity and amount | |---|---|---| | Obertas | Since January 2025 | Nearly $2 million in crypto conversions, plus at least $1.25 million in other currency transactions | | Boykov | Since 2024 | $3.5 million in cryptocurrency exchange and conversion transactions | | Kim Ki Hyok | Since 2024 | Nearly $500,000 in crypto transfers for his delegation | | Kim Hyo Dong | Since at least December 2023 | Helped transfer more than $100,000 in financial assets | | Six workers linked to FFTDC | Since 2025 | More than $750,000 in collective revenue | The sole entity designated is the First Financial and Technical Development Center (FFTDC), operating in Russia. Treasury says the center, controlled by North Korea since at least 2024, deployed highly trained IT workers to Russia. The workers generated several million dollars for the North Korean government, using advanced AI tools and money-laundering methods that included complex crypto transfers. The six workers designated alongside the center are: Kim Kyong Ju, Ri Thae Chol, So Hyong Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il. Under Executive Order 13722, OFAC designated the center for its role in exporting workers from North Korea and the six workers for supporting the center. It used Executive Order 13687 to sanction the two Russian intermediaries and two team managers. Treasury does not describe all the financial assets Kim Hyo Dong helped transfer as cryptocurrency. The department reports money transactions and workers’ earnings separately, for different periods. The same transaction may be included in more than one figure, so adding the amounts could count some money twice. Treasury did not announce an amount actually frozen under this action or current balances at the addresses. ## Why do nine address entries identify eight distinct addresses? In its [October 28 SDN update](https://ofac.treasury.gov/recent-actions/20261028), OFAC also identifies [wallet addresses](https://kriptometa.com/en/glossary/wallet-address) associated with Boykov, Obertas and Kim Ki Hyok. Boykov’s entry contains two [Ethereum](https://kriptometa.com/en/glossary/ethereum-ether) and two Tron addresses, Obertas’s contains one Ethereum and three Tron addresses, and Kim Ki Hyok’s contains one Ethereum address. One Ethereum address appears under both Boykov and Obertas, leaving three distinct Ethereum and five distinct Tron addresses. OFAC uses the addresses to identify the sanctioned people. It did not disclose a victim count or the value of October 28 transfers for each address. The same daily SDN notice also includes two Rwanda-related entities; they are outside the North Korean action covering 10 people and one entity. ## What sanctions require for blocked cryptocurrency The action blocks the designated parties’ property and interests in property within the United States or held or controlled by US persons. Those holdings must be reported to OFAC. Entities owned directly or indirectly 50% or more by one or more blocked persons, individually or in aggregate, are also blocked. Unless a general or specific license or an exemption applies, US persons generally cannot transact in such property, and transactions within or through the United States are also prohibited. Under OFAC’s [guidance on blocking cryptocurrency](https://ofac.treasury.gov/faqs/646), a US person holding cryptocurrency subject to a block must deny all parties access to it. A company may block individual [wallets](https://kriptometa.com/en/glossary/crypto-wallet) or consolidate blocked cryptocurrency into an omnibus wallet. Under either approach, the assets can be returned to their owner only with OFAC authorization or once the prohibition requiring the block ends. Blocked cryptocurrency does not have to be converted into [fiat money](https://kriptometa.com/en/glossary/what-is-fiat-money) such as US dollars or held in an interest-bearing account. The person or company holding the cryptocurrency must report the block to OFAC within 10 business days and file annual reports while the block remains in place. OFAC also links to the October 15, 2021 crypto guidance in its [blocking and reporting FAQs updated on October 26, 2026](https://ofac.treasury.gov/faqs/updated/2026-10-26). Treasury warns that financial institutions and others conducting certain transactions with blocked parties may themselves face sanctions. Non-US persons may not cause US persons to violate the prohibitions or participate in evasion. The action imposes sanctions; it is not a criminal conviction. ## What checks does the FBI recommend for employers? Treasury’s announcement links to the FBI’s [January 23, 2025 IT-worker warning](https://www.ic3.gov/PSA/2025/PSA250123). The FBI reported that some North Korean workers, after being discovered, used stolen company data and source code to extort employers and sometimes released code publicly. It advises employers to verify identities at interview, onboarding and throughout employment, limit system access to what each job requires, and monitor unusual remote connections and data leaving company systems. The FBI also says it has observed artificial intelligence and face-swapping tools in interviews. Employers are advised to compare resumes, watch for changes in address or payment platforms, and check whether different applicants reuse phone numbers or email addresses. The alert predates the October 28 action and provides general security guidance; it does not establish a separate data-theft incident for every person newly listed. OFAC’s August 28, 2023 training video explains the general mechanism in its [blocking chapter, starting at 5:33](https://www.youtube.com/watch?v=pNPRvbr59lw&t=333s). The older recording is for training only; the OFAC sources above provide the current designation and rules for holding blocked cryptocurrency. Treasury’s October 28 X post, shown at 14:35 UTC, also announces the designation of 10 people and one entity and links to the official release. [Read the US Treasury announcement on X](https://x.com/USTreasury/status/2115452392690913530)