North Korea’s crypto-finance network is becoming harder to describe as a straightforward hacking operation.
On October 28, 2026, the U.S. Treasury Department sanctioned 10 individuals and one entity linked to North Korean IT-worker schemes. According to Treasury, the network used fake identities to place North Korean workers in legitimate jobs, converted their earnings through cryptocurrency and redirected the proceeds toward the country’s weapons programs.
Two Russian intermediaries were accused of converting approximately $5.5 million in crypto. The case also illustrates how generative AI, remote hiring and blockchain transfers can combine into a financial and cybersecurity risk for companies around the world.
How the North Korean IT-Worker Scheme Works
The alleged operation begins before any cryptocurrency transaction takes place. North Korean workers use stolen identities, false documents and fabricated professional profiles to obtain jobs at legitimate companies. These positions can involve software development, technical support or other roles that provide access to corporate systems.
The wages may appear to be ordinary employment payments, but U.S. officials say much of the money is ultimately redirected to North Korea. The risk increases when workers gain access to internal networks, source code, customer information or proprietary data.
The Treasury has warned that these workers may also install malware, steal sensitive information or use their access for extortion. In other words, the financial transfer is only one part of the threat. The employment relationship itself may become an entry point into a company’s infrastructure.
Where Crypto Entered the Picture
The Treasury says Russian nationals Ilya Boykov and Vitold Obertas helped convert cryptocurrency connected to North Korean IT-worker networks.
Boykov was accused of converting roughly $3.5 million in crypto for Alis, a North Korean IT-worker company sanctioned by the United States. Obertas was accused of converting nearly $2 million in crypto for North Korean officials since January 2025.
Blockchain analytics firm Chainalysis traced crypto linked to a North Korean IT worker to Boykov, who then sent funds to Garantex for cash conversion. Garantex has been under U.S. sanctions since 2022.
The transaction path matters because it shows how crypto can be used as a bridge between digital income and traditional money. The blockchain records transfers publicly, but the people behind the wallets may remain hidden unless exchanges, investigators and analytics companies connect the addresses to real-world identities.
Sanctions Now Include Wallet-Level Risk
The Office of Foreign Assets Control has added the targeted individuals and entity to its sanctions records. The listings include digital-currency addresses connected with some of the designated parties.
For financial institutions and crypto platforms, this creates a direct compliance obligation. A wallet address associated with a sanctioned person cannot be treated like an ordinary blockchain address. Platforms may need to block the funds, freeze accounts, investigate related transactions and report the activity to the relevant authorities.
The consequences can extend beyond U.S. companies. Non-U.S. businesses may also face sanctions exposure if they help U.S. persons violate sanctions or facilitate transactions involving designated parties.
This is why crypto compliance increasingly relies on more than customer identification. Platforms also need wallet screening, transaction monitoring and systems capable of identifying indirect exposure through intermediary addresses.
AI Is Making Fake Hiring Profiles More Convincing
One of the more recent developments in this threat is the use of generative AI. Chainalysis said North Korean operatives used AI tools to write resumes, prepare for technical interviews and create fake profile images. Deepfake video may also be used during remote hiring calls.
That changes the risk for companies hiring remote workers. A polished resume and successful technical interview no longer provide strong evidence of identity. Companies may need to verify employment history, identity documents, payment details, location and device activity through multiple independent checks.
This is particularly important in crypto, where remote teams, pseudonymous contributors and cross-border contractors are common. A weak hiring process can create both a cybersecurity vulnerability and a sanctions violation.
Why Garantex Still Matters
Garantex is an important part of the story because it represents the cash-out layer in the alleged network. Once cryptocurrency is sent to an exchange or service that can convert it into fiat currency, the funds may become easier to use outside the blockchain ecosystem.
The U.S. government seized Garantex-related web domains in 2025, but sanctions and enforcement actions do not automatically eliminate every replacement service. Funds can move through new wallets, informal brokers, peer-to-peer markets or other exchanges.
That makes the transaction history more important than any single platform name. Investigators look at the entire flow, including where the funds originated, which wallets received them and how quickly they moved after arriving at a service.
The Larger Policy Debate
North Korea’s use of crypto is likely to remain a major issue in global financial regulation. The country has been accused of using cyber theft, IT-worker fraud and digital-asset laundering to generate revenue for prohibited programs.
The latest sanctions show how governments are expanding their approach. Enforcement is no longer focused only on hackers and mixers. It now includes recruiters, intermediaries, front companies, employment networks and the infrastructure used to convert crypto into cash.
That broader approach will increase compliance costs, but it may also make the market more difficult for illicit networks to use at scale.
Final Takeaway
The U.S. sanctions against Russian crypto intermediaries reveal a wider risk than a single $5.5 million conversion. North Korean networks are combining fake employment profiles, AI-assisted identity fraud, corporate access and crypto transactions to move money across borders.
The case also demonstrates why blockchain transparency is useful but not sufficient. Public transactions become meaningful only when investigators and platforms can connect wallet activity with real-world identities and sanctioned entities.
For traders and readers following crypto regulation, cybersecurity and illicit-finance risks, Tapbit Learn provides further market education and digital-asset coverage. Users can visit Tapbit, log in, or create an account.
Frequently Asked Questions
What did the United States sanction?
The U.S. Treasury sanctioned 10 individuals and one entity linked to North Korean IT-worker schemes. The action included Russian intermediaries accused of converting cryptocurrency for North Korean networks.
How much cryptocurrency was allegedly converted?
The Treasury attributed approximately $3.5 million in crypto conversions to Ilya Boykov and nearly $2 million to Vitold Obertas, totaling roughly $5.5 million.
How are North Korean IT workers connected to crypto?
According to U.S. officials, they use false identities to obtain jobs at legitimate companies, earn income and route part of that income through cryptocurrency transactions to North Korea.
