The U.S. Treasury Department on Tuesday ten individuals and one company, accusing them of helping collect wages from foreign employers, many of them American, through fake identities and forged paperwork.

The workers are typically placed at legitimate firms under invented personas, sometimes with AI-generated resumes, doctored photos, or deepfake video during interviews. 

Most of their pay goes back to the regime, which Treasury says uses the money to fund its weapons of mass destruction and ballistic missile programs. Some of these workers have also gained access to corporate networks, where they have planted malware and taken proprietary data.

The money and crypto behind North Korean fraud

The sanctions focused less on the workers themselves than on the people who move the money. Two Russian nationals are at the center of the action. 

Vitold Obertas, described by Treasury as a go-between for North Korean financial transactions, allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025. 

Ilya Boykov allegedly converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT worker company that the U.S. sanctioned in 2024.

Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were also named for leading Russia-based worker delegations. Kim Ki Hyok has reportedly moved close to $500,000 in crypto for his team since 2024. 

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who have generated more than $750,000 for it since 2025.

Treasury published wallet addresses on Ethereum and Tron tied to the sanctioned individuals, a signal to exchanges and other financial firms to watch for those accounts. One Ethereum address is linked to both Obertas and Boykov.

The action follows a March of a separate North Korean IT worker network, which Treasury said had laundered roughly $800 million in crypto for the regime. Australia and the European Union have also announced related designations this month, and Treasury coordinated the move with the Multilateral Sanctions Monitoring Team.

Under the sanctions, any property these individuals or entities hold in the United States, or that is controlled by U.S. persons, is blocked and must be reported to the Office of Foreign Assets Control. Transactions with them are generally prohibited unless licensed, and companies owned 50 percent or more by blocked parties are subject to the same restrictions. Treasury warned that civil penalties can apply even when a violation was unintentional.

For companies that hire remote contractors, the advisories from the State, Treasury and Justice departments and on spotting these schemes, including verifying identities, checking where payments are going, and watching for unusual access requests.

This post first appeared on and is written by .