US sanctions 10 in North Korea IT fraud network funding weapons
Synopsis
The US Treasury has sanctioned 10 people and one entity linked to a North Korean scheme where fake-identity IT workers infiltrate American firms, funnel wages back to Pyongyang, and — in some cases — plant malware and steal corporate data. The network spans Russia and North Korea, moves funds via crypto, and has generated hundreds of millions for Pyongyang's weapons programmes.
Key Takeaways
The US Treasury sanctioned 10 individuals and one entity on 29 October 2026 for supporting North Korean IT worker fraud schemes.
The schemes allegedly generate hundreds of millions of dollars for North Korea's weapons of mass destruction and ballistic missile programmes.
Russian intermediary Vitold Viktorovich Obertas allegedly conducted nearly $2 million in crypto conversions for North Korean officials since January 2025 .
Russian national Ilya Aleksandrovich Boykov allegedly converted the equivalent of $3.5 million in cryptocurrency since 2024 .
The First Financial and Technical Development Centre , a North Korean-controlled entity in Russia, was designated; six associated workers collectively generated more than $750,000 since 2025.
Workers reportedly used corporate network access to introduce malware and steal proprietary data beyond generating illicit revenue.
The United States on 29 October 2026 sanctioned 10 individuals and one entity accused of running North Korean information technology worker schemes that defraud American companies and channel funds to Pyongyang's weapons programmes. The action, announced by the Treasury Department, targeted operatives and facilitators based in North Korea and Russia.
What the Sanctions Cover
The designations were issued by the Office of Foreign Assets Control (OFAC), blocking the targets' property and interests in property within the United States or under the control of US persons. Treasury said the North Korean operatives used false documents, stolen identities, and fabricated profiles to obtain jobs with legitimate companies in the US and allied countries. The North Korean government allegedly takes most of their wages.
According to the Treasury Department, these schemes generate hundreds of millions of dollars for North Korea's weapons of mass destruction and ballistic missile programmes. The networks reportedly used cryptocurrency transactions, money laundering methods, and artificial intelligence tools to earn and move funds.
Key Individuals Designated
Among those sanctioned was Russian intermediary Vitold Viktorovich Obertas, who Treasury alleged had conducted nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. His activities reportedly involved Amnokgang Technology Development Company, which OFAC had designated in March.
Russian national Ilya Aleksandrovich Boykov was accused of supporting Alis, a previously sanctioned company. Since 2024, he allegedly exchanged and converted the equivalent of $3.5 million in cryptocurrency, monitored transactions, and provided logistical assistance.
North Korean nationals Kim Ki Hyok and Kim Hyo Dong were also designated. Treasury said Kim Ki Hyok led a group of IT workers in Russia, monitored their output, ensured they met financial targets, and transferred cryptocurrency valued at nearly $500,000 since 2024. Kim Hyo Dong allegedly facilitated logistical support, helped evade sanctions, and transferred more than $100,000 in financial assets since at least December 2023.
The Entity and Six IT Workers
The sole entity sanctioned was the First Financial and Technical Development Centre, described by Treasury as a North Korean-controlled organisation operating in Russia. Its IT workers had allegedly generated several million dollars for Pyongyang. Six workers associated with the centre — Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il — were designated, with Treasury alleging they collectively generated more than $750,000 for the organisation since 2025.
Corporate Espionage Dimension
Beyond revenue generation, the workers had reportedly used access to corporate networks to introduce malware, extract sensitive data, and steal proprietary information, according to Treasury. Treasury Secretary Scott Bessent said, 'The North Korean regime continues targeting and exploiting American companies.' Treasury's announcement did not identify the individual companies affected by Wednesday's designations.
What Happens Next
US persons are generally prohibited from conducting transactions involving the newly blocked property unless authorised or exempt. Entities owned 50 per cent or more by blocked persons are also covered under the designations. This action follows a broader multi-year US effort to cut off North Korea's illicit cryptocurrency pipelines, and analysts expect further designations as investigators trace remaining financial flows.
Point of View
Treasury has not named the American companies infiltrated, which means the full exposure remains publicly unknown and potentially much larger than the designated individuals suggest. The Russia dimension also complicates enforcement: with Moscow providing operational cover, the usual financial-pressure levers available to Washington are blunted.
NationPress
29 Oct 2026
Frequently Asked Questions
Who did the US sanction over the North Korea IT fraud scheme?
The US Treasury Department sanctioned 10 individuals and one entity on 29 October 2026. They include Russian intermediaries Vitold Viktorovich Obertas and Ilya Aleksandrovich Boykov, North Korean nationals Kim Ki Hyok and Kim Hyo Dong, six IT workers linked to the First Financial and Technical Development Centre, and the centre itself.
How do North Korean IT workers defraud American companies?
According to the Treasury Department, North Korean operatives use false documents, stolen identities, and fabricated profiles to secure remote jobs at legitimate US firms. The North Korean government then takes most of their wages, channelling the funds toward weapons of mass destruction and ballistic missile programmes.
How much money have these schemes generated for North Korea?
Treasury alleged the schemes have generated hundreds of millions of dollars for North Korea's weapons programmes. Specifically, the six IT workers linked to the First Financial and Technical Development Centre collectively generated more than $750,000 since 2025, while individual intermediaries moved millions in cryptocurrency.
What is the First Financial and Technical Development Centre?
It is a North Korean-controlled organisation operating in Russia that was designated by OFAC on 29 October 2026. Treasury alleged that its IT workers generated several million dollars for Pyongyang, and six of its associated workers were individually sanctioned.
What are the consequences of these US sanctions?
The OFAC designations block the targets' property and interests in property within the United States or under US-person control. US persons are generally prohibited from transacting with the blocked individuals or entities unless authorised or exempt, and entities owned 50 per cent or more by blocked persons are also covered.
