Chainalysis Uncovers Russian Network Assisting North Korean IT Workers in Crypto Cash-Outs

The US Treasury's Office of Foreign Assets Control (OFAC) imposed sanctions on ten individuals and one organization for supporting schemes involving North Korean IT workers allegedly involved in funding the country’s weapons programs, according to an official statement released on Wednesday.

Among those sanctioned were Russians Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas. The Treasury Department detailed that since 2024, Boykov converted around $3.5 million in crypto for the sanctioned company Alis, while Obertas processed nearly $2 million in crypto exchanges on behalf of North Korean officials since January 2025.

Chainalysis provided an example linking a North Korean IT worker’s wallet, which regularly received stablecoin payments, converted those monies to Ethereum (ETH), then routed them through consolidation addresses to Boykov. Boykov subsequently transferred the cryptocurrency to the Russian exchange Garantex to convert it to cash.

North Korean IT specialists using counterfeit identities to secure employment in cryptocurrency companies remain a constant security concern. In June 2025, the US Department of Justice charged four North Korean nationals for orchestrating a fraudulent IT recruitment scheme that resulted in the theft of over $900,000 from American and Serbian crypto firms.

This revelation highlights ongoing threats posed by covert networks supporting North Korea’s illicit cryptocurrency activities, which undermine international sanctions and global security efforts.