OFAC sanctions 10 people and a Vladivostok centre over North Korean IT work

The US Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity on 28 October for their roles in North Korean IT worker schemes that defraud US businesses, the Treasury said, naming facilitators based in Russia and North Korea.

The OFAC notice adds one entity, the First Financial and Technical Development Center (FFTDC), with addresses in North Korea and in Vladivostok, an established date of January 2024 and the organisation type "Financial and Insurance Activities". Each of the 10 individuals is listed with an address in Russia, and one, Kim Hyo Dong, also with Laos. Every entry carries a secondary sanctions risk under sections 510.201 and 510.210 of the North Korea Sanctions Regulations.

Treasury says the schemes rely on "fraudulent documents, stolen identities, and fabricated personas" to place North Korean IT workers with companies in the United States and allied countries, and that the government "appropriates most of these workers' wages" to fund its weapons of mass destruction and ballistic missile programmes. It adds that the workers have used their access to corporate networks to deploy malware and take sensitive data.

Two Russian nationals and a shared wallet

Treasury describes Vitold Viktorovich Obertas, a Russian national whom OFAC's notice lists as born in Vladivostok, as "a Russian intermediary for illicit DPRK financial transactions", including for Amnokgang Technology Development Company, which OFAC designated on 12 March 2026. Since January 2025, the release says, he has conducted nearly $2 million of cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials. He is designated under Executive Order 13687.

A second Russian national, Ilya Aleksandrovich Boykov, has since 2024 exchanged and converted the equivalent of $3.5 million in cryptocurrency for Limited Liability Company Alis, which OFAC designated in March 2024 as subordinate to Chinyong Information Technology Cooperation Company, and monitored its cryptocurrency transactions, according to the release. He is also designated under Executive Order 13687.

The notice gives digital currency addresses for both men: one Ethereum and three Tron addresses for Obertas, and two Ethereum and two Tron addresses for Boykov. One Ethereum address, ending in 3510, appears in both entries, so the two entries hold seven distinct addresses.

Delegation leaders and the Vladivostok centre

Two North Korean nationals are listed as delegation leaders. Kim Ki Hyok leads a Russia-based delegation of North Korean IT workers whose primary duties include monitoring Alis IT workers and "ensuring they meet their financial targets", and has transferred cryptocurrency worth nearly $500,000 for it since 2024, Treasury says. Kim Hyo Dong leads a separate Russia-based delegation subordinate to Chinyong, which OFAC designated in May 2023, and has facilitated the transfer of over $100,000 equivalent in financial assets since at least December 2023.

Treasury calls the FFTDC "a DPRK-controlled entity located in Russia" that uses North Korean IT workers who "employ Super Intelligence (SI) tools" and complex cryptocurrency transfers. It says six Russia-based workers listed with the centre have generated over $750,000 for it since 2025. The centre and the six are designated under Executive Order 13722, which covers the export of workers from North Korea to earn revenue for its government.

One spelling differs between the two documents: the release names a worker So Hyon Jin, while the SDN entry reads "SO, Hyong Jin", with the alias So' Hyo'n-chin. For screening, the SDN entry is the reference.

Treasury says the action builds on that 12 March designation of a separate IT worker network. It says the United States "is joined this month by Australia and the European Union" in designating people and entities that support North Korea's revenue generation and military activities.

What changes for hiring and payment screening

Treasury states that the goal of sanctions "is not to punish, but to bring about a positive change in behavior", and no response from the people or the entity listed was published with the action. Under the release, all their property and interests in property in the United States or held by US persons are blocked and must be reported to OFAC, and entities owned 50 per cent or more by blocked persons are blocked too. Non-US persons are prohibited from causing US persons to violate the sanctions, and Treasury notes that OFAC may impose civil penalties on a strict liability basis.

For banks and crypto exchanges, the practical step is to load the new names and the digital currency addresses in the notice into transaction screening: the seven in the two Russian entries and one Ethereum address listed for Kim Ki Hyok. For companies that hire remote developers, the release points to the advisories on North Korean IT workers issued by the State, Treasury and Justice departments and by the FBI.

Related reading: the Panama law firm OFAC listed on 21 October and the Sanctions Enforcement Ledger for 17 to 23 October.