U.S. Treasury Sanctions Crypto Network Linked to North Korea
Current overview (not historical)
The U.S. Treasury sanctioned 10 individuals and one entity for facilitating North Korean IT workers' conversion of cryptocurrency earnings into weapons funding. Two Russian nationals, Ilya Boykov and Vitold Obertas, were accused of handling approximately $5.5 million in crypto transactions. The Office of Foreign Assets Control identified Ethereum and Tron addresses linked to the Russians and a North Korean national. U.S. persons are generally prohibited from dealing with the designated individuals or their blocked property without authorization.
Written with AI from the reporting · updated 10/29/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Institutional statementOct 28, 00:00recorded Oct 29, 19:07revised
Treasury sanctions crypto cash-out network linked to North K
Read original source ↗ CryptoSlateReplay this moment in the explorerEvidence & revisions · 2 source records
- Subject：
- U.S. Treasury
- Action：
- sanctioned 10 individuals and one entity
- Object：
- crypto cash-out network facilitating North Korean IT worker earnings
- Occurred (fact side)：
- Oct 28, 00:00
- Published (valid side)：
- Oct 29, 19:00
- First seen (known side)：
- Oct 29, 19:07
- Published (valid side)：
- Oct 29, 21:27
- First seen (known side)：
- Oct 29, 22:22
Fact stationRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
- 2Institutional statementOct 29, 20:53single sourcereport-time only
U.S. sanctions Russian nationals for laundering millions in
Read original source ↗ CoinDeskReplay this moment in the explorerEvidence & revisions · 1 source records
- Occurred (fact side)：
- not recorded
- Published (valid side)：
- Oct 29, 20:18
- First seen (known side)：
- Oct 29, 20:53
Fact stationSingle source · one-sided claimReport-time onlyCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
- 3Institutional statementOct 29, 00:00recorded Oct 29, 23:05single source
美国财政部制裁朝鲜伪工人背后的加密货币洗钱者
Read original source ↗ Bitcoin MagazineReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- treasury
- Action：
- sanctioned ten individuals and one company
- Object：
- North Korean fake workers and money launderers
- Occurred (fact side)：
- Oct 29, 00:00
- Published (valid side)：
- Oct 29, 22:37
- First seen (known side)：
- Oct 29, 23:05
Fact stationSingle source · one-sided claimCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- Bitcoin MagazineSelectedRelated fact: single sourceU.S. Treasury sanctions crypto launderers behind North Korea's fake IT workers
Report first recorded Oct 29, 23:05
The U.S. Treasury Department sanctioned ten individuals and one company for helping North Korea collect wages from foreign employers, many American, through fake identities and forged paperwork. Two Russian nationals, Vitold Obertas and Ilya Boykov, are accused of handling millions in crypto conversions for North Korean officials and IT workers. Treasury also named North Korean nationals Kim Ki Hyok and Kim Hyo Dong for leading Russia-based worker delegations and linked one Ethereum address to both Obertas and Boykov.
Read original source ↗ - BeInCryptoUS sanctions two Russians for converting $5.5M in crypto for North Korea
Report first recorded Oct 29, 22:22
The US Treasury sanctioned two Russians, Vitold Viktorovich Obertas and Ilya Boykov, for allegedly converting a total of $5.5 million in cryptocurrency for North Korean entities. Chainalysis data links Obertas to mainstream crypto exchanges and funds from the sanctioned IT firm Amnokgang, while Boykov's transactions were traced to the sanctioned exchange Garantex.
Read original source ↗ - CoinDeskRelated fact: single sourceFact occurrence time unverifiedU.S. sanctions Russian nationals for laundering millions in crypto for North Korean IT workers
Report first recorded Oct 29, 20:53
The U.S. Treasury sanctioned Russian nationals Ilya Boykov and Vitold Obertas for allegedly laundering approximately $3.5 million and nearly $2 million in cryptocurrency, respectively, for North Korean IT workers.
Read original source ↗ - CryptoSlateSource report revisedUS Sanctions Target North Korean Crypto Cash‑Out Network Linked to Weapons Funding
Report first recorded Oct 29, 19:07
On October 28, the U.S. Treasury sanctioned 10 individuals and one entity for facilitating the conversion of North Korean undercover IT workers’ cryptocurrency earnings into funds for the regime’s weapons programs. The Treasury action singled out two Russian nationals who allegedly moved about $5.5 million in crypto transactions for North Korean operations over multiple periods. Chainalysis traced a recurring stablecoin salary paid to an undercover developer who contributed code to blockchain and DeFi projects; the developer’s wallet converted the stablecoins into Ethereum and then routed the funds through consolidation addresses tied to sanctioned entities before ultimately reaching Russian intermediaries such as Ilya Aleksandrovich Boykov and the exchange Garantex. The investigation also revealed that North Korean operatives use stolen identities, fabricated employment histories, and generative‑AI‑created resumes, photos and deep‑fake videos to secure remote jobs at legitimate crypto companies, where they collect salaries that the regime appropriates. Estimates from a UN panel suggest that these schemes generated between $250 million and $600 million annually for North Korea.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 38Oct 29, 23:00
- 24h change
- -87%
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.