US Sanctions Target North Korean Crypto Cash‑Out Network Linked to Weapons Funding

On October 28, the U.S. Treasury sanctioned 10 individuals and one entity for facilitating the conversion of North Korean undercover IT workers’ cryptocurrency earnings into funds for the regime’s weapons programs. The Treasury action singled out two Russian nationals who allegedly moved about $5.5 million in crypto transactions for North Korean operations over multiple periods. Chainalysis traced a recurring stablecoin salary paid to an undercover developer who contributed code to blockchain and DeFi projects; the developer’s wallet converted the stablecoins into Ethereum and then routed the funds through consolidation addresses tied to sanctioned entities before ultimately reaching Russian intermediaries such as Ilya Aleksandrovich Boykov and the exchange Garantex. The investigation also revealed that North Korean operatives use stolen identities, fabricated employment histories, and generative‑AI‑created resumes, photos and deep‑fake videos to secure remote jobs at legitimate crypto companies, where they collect salaries that the regime appropriates. Estimates from a UN panel suggest that these schemes generated between $250 million and $600 million annually for North Korea.