OFAC sanctions 10 over DPRK IT-worker fraud and laundering
Treasury's sb0669 action names eight people, two Russia-based launderers and the Russia-sited First Financial and Technical Development Center for running and cashing out DPRK IT-worker fraud.
The US Treasury's Office of Foreign Assets Control sanctioned ten individuals and one entity on 28 October 2026 for running and laundering the proceeds of North Korea's fraudulent IT-worker scheme, naming two Russia-based money movers and a DPRK-controlled front company sited in Russia. The action is Treasury release sb0669; if you hire remote engineers, the designations are both a compliance trigger and a map of the current network.
Who was sanctioned
OFAC designated the First Financial and Technical Development Center (FFTDC), described as a DPRK-controlled entity located in Russia, alongside ten people:
- Ilya Aleksandrovich Boykov — Russian national; OFAC cites the equivalent of $3.5 million in cryptocurrency transactions supporting a previously sanctioned DPRK network.
- Vitold Viktorovich Obertas — Russian intermediary; cited for nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions.
- Kim Ki Hyok — leads a Russia-based DPRK IT-worker delegation; crypto transfers valued at nearly $500,000.
- Kim Hyo Dong — leads a separate Russia-based delegation; moved over $100,000 equivalent to evade sanctions.
- Six FFTDC-linked workers — Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il — who earned over $750,000 on the entity's behalf since 2025.
Treasury says the schemes have generated hundreds of millions of dollars for the regime overall, funding its WMD and ballistic-missile programs.
How the scheme works
The mechanics are by now well documented: DPRK nationals use fraudulent documents, stolen identities and fabricated personas to land salaried IT roles at companies in the US and allied countries. The regime takes most of the wages. Beyond salary, the workers exploit their corporate access — deploying malware, exfiltrating proprietary data and extorting employers — and route the money out through crypto and layered currency transactions. OFAC notes the networks lean on "emerging technologies, including artificial intelligence tools," and references "Super Intelligence (SI) tools" used by the FFTDC workers to generate and move funds.
Action checklist
- Screen your current and prospective remote staff against the newly added SDN entries — transacting with a sanctioned person is a strict-liability violation for US persons.
- Tighten remote-hire identity proofing: live video verification, hardware-shipping address checks, and scrutiny of candidates who refuse on-camera interviews or route equipment through third parties ("laptop farms").
- Treat AI-polished résumés and interview answers as a weak signal at best — the tooling is explicitly part of the playbook now.
- Watch for the post-hire tells: unexplained data access, off-hours activity aligned to overseas time zones, and pressure or extortion after offboarding.
Context
This is the latest turn of a campaign that has run all year: the DoJ's laptop-farm indictments charged 14 people in the same ecosystem, and OFAC has repeatedly leaned on the sanctions lever against crypto cash-out networks. Sanctions do not shut down the hiring fraud on their own — they raise the cost of cashing out, which is exactly where these two Russia-based launderers sat.