New OFAC sanctions target 10 people and one entity tied to North Korean IT worker schemes that allegedly funded weapons programs
The US Treasury has sanctioned 10 individuals and one entity accused of helping North Korean IT workers turn their paychecks into weapons funding. Blockchain analytics firm Chainalysis followed with a map of where much of that money went: through Russian intermediaries and into the sanctioned exchange Garantex.
The scheme is a remote-work story with a very dark ending. North Korean operatives allegedly land jobs at foreign companies, collect salaries in crypto, and route the proceeds back toward a regime that spends heavily on missiles.
What OFAC did and what Chainalysis found
The Office of Foreign Assets Control (OFAC) announced the designations on Wednesday, October 28, 2026. According to its press release, the targets supported IT worker operations run by the North Korean government. OFAC said those operations fund the country’s weapons programs.
Chainalysis then published its analysis of the cash-out network. The firm describes a long-running group of Russian facilitators who helped the IT workers convert millions of dollars in crypto.
The flows were not exotic. They mostly consisted of stablecoin salary payments and Ethereum (ETH).
Chainalysis found the workers received stablecoin salaries at least every two weeks. Those funds were then laundered back to Russia. The firm traced stablecoin receipts tied to salaries from late 2022 to early 2023 to the Russian facilitators.
The two names with the biggest numbers
Two of the sanctioned individuals stand out in the Chainalysis data.
Ilya Aleksandrovich Boykov is linked to approximately $3.5 million in crypto transactions since 2024.
Vitold Viktorovich Obertas converted nearly $2 million in crypto, according to the findings. He was also involved in an additional $1.25 million in transactions unrelated to the scheme, starting in early 2025.
The sanctioned addresses for both men included holdings in ETH and on Tron.
Why the IT worker scheme matters so much
The scale becomes clearer at the macro level. According to United Nations estimates, North Korean IT worker schemes may generate between $250 million and $600 million for the country every year.
The Russian dimension stands out. Chainalysis’s findings show extensive ties between North Korean IT worker operations and Russian financial networks. Garantex, already a sanctioned exchange, sits at the center of that flow.
What this means for exchanges, employers and the market
For crypto exchanges, the direct implication is more scrutiny. That applies especially to any platform with exposure to Russian intermediaries or counterparties that previously interacted with Garantex.
Compliance teams now have fresh wallet addresses, names and behavioral patterns to screen for. The biweekly stablecoin salary pattern is a useful signal.
Stablecoins also sit squarely in the frame. Their convenience as a payroll tool is what made them attractive here. Analytics firms like Chainalysis can trace those flows after the fact. Yet the scheme reportedly ran for years before these designations landed.
For employers, the risk is more practical than regulatory. Companies hiring remote developers and paying them in crypto may unknowingly be funding a sanctioned regime.
