OFAC sanctions the facilitators behind North Korea's IT worker earnings: what the blockchain shows

OFAC published eight wallet addresses for Vitold Obertas, Ilya Boykov and Kim Ki Hyok. In Scorechain they show about $86M in gross flows since 2022, money from a North Korean company OFAC designated in March, and transfers between the two Russians.

On 28 October 2026 the US Treasury's Office of Foreign Assets Control (OFAC) designated ten individuals and one entity for their roles in North Korea's government-run IT worker schemes. In these schemes, North Korean workers use stolen identities and fabricated personas to take jobs at companies in the United States and allied countries, and the regime keeps most of their pay. Three of the listings carry wallet addresses: the Russian nationals Vitold Viktorovich Obertas and Ilya Aleksandrovich Boykov, and Kim Ki Hyok, a North Korean who leads a delegation of IT workers in Russia. All eight addresses are attributed in Scorechain, and their activity links Obertas and Boykov to each other and to a North Korean company OFAC designated in March.

What OFAC designated

All three were designated under Executive Order 13687:

• Vitold Viktorovich Obertas, Russia. Treasury describes him as an intermediary for illicit DPRK financial transactions, including for Amnokgang Technology Development Company, which OFAC designated on 12 March 2026. Since January 2025 he has carried out nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for DPRK officials.
• Ilya Aleksandrovich Boykov, Russia. Since 2024 he has supported Alis, a DPRK company OFAC designated in March 2024, by exchanging and converting the equivalent of $3.5 million in cryptocurrency, monitoring cryptocurrency transactions and providing logistical support.
• Kim Ki Hyok, North Korea. He leads a Russia-based delegation of Alis IT workers, monitors them and makes sure they meet their financial targets. Since 2024 he has transferred cryptocurrency worth nearly $500,000 for the delegation.

The same action designates Kim Hyo Dong, who leads a separate delegation in Russia, and the First Financial and Technical Development Center, a DPRK-controlled entity in Russia, together with six of its IT workers. Treasury says the centre's workers use "Super Intelligence" tools and complex cryptocurrency transfers, and that those six generated more than $750,000 since 2025. Their listings carry no addresses. Treasury also notes that Australia and the European Union designated individuals and entities supporting the DPRK's revenue generation and military activities this month.

Eight addresses, already attributed

OFAC listed eight unique addresses, three on Ethereum and five on Tron. One Ethereum address, 0x761e…4a3510, appears on both Obertas's and Boykov's entries. In Scorechain all eight are attributed to the three designated individuals, typed Sanction List and scored 1 (critical risk), so exposure to any of them triggers the Sanction List risk indicator:

• Obertas: three Tron addresses, about $51.3 million in gross flows received.
• Boykov: two Ethereum and two Tron addresses, including the shared one, about $35.1 million.
• Kim Ki Hyok: one Ethereum address, $50,000.

Together the eight addresses received about $86.4 million across roughly 5,650 transactions between November 2022 and October 2026. Stablecoins make up 99.7% of it: $61.7 million in USDT, $13.8 million in DAI and $10.7 million in USDC. Tron carried $53.8 million and Ethereum $32.6 million. The addresses have since been emptied: about $2,300 is left across all eight, and most of them went quiet during 2025.

What the on-chain data show

Amnokgang pays Obertas. Treasury names Obertas as an intermediary for Amnokgang Technology Development Company. One of his Tron addresses, TQCBdU…btLYMm, received about $49,900 directly from an address OFAC listed for Amnokgang in March, plus $100 from a second Amnokgang address.

Boykov pays Obertas. The same Obertas address received about $80,400 directly from Boykov's Tron address TXmrnV…XSj4g3, and small amounts went back from Obertas to both of Boykov's Tron addresses. On Ethereum, Boykov's address 0x12ea…6f4e8d sent about $9.9 million to 0x761e…4a3510, the address OFAC lists under both men.

Garantex upstream. Funds reaching TQCBdU…btLYMm trace back to Garantex, the Russia-based exchange OFAC designated in April 2022, along hundreds of paths, most within two hops. Boykov's Tron address TXmrnV…XSj4g3 also received about $7,800 directly from Garantex.

Out through exchanges. Kim Ki Hyok's address received 50,000 DAI on 9 September 2024 and sent all of it to a deposit address at a centralised exchange the next morning. The shared address 0x761e…4a3510 shows the same pattern at a larger scale: stablecoins arrive and leave for exchange deposit addresses, in recent transfers within about half an hour.

Frozen before the designation. Tether blacklisted TQCBdU…btLYMm on 4 December 2025, almost eleven months before OFAC acted. About 2,121 USDT is still on it and cannot be moved.

What compliance teams should do

• Add the eight addresses to address screening, and the names, aliases and identifiers in the OFAC entries to name screening.
• Run a lookback to November 2022. Most of the addresses went quiet during 2025, so the exposure is mostly historical.
• Review indirect exposure as well as direct hits. The addresses connect to Amnokgang and Garantex, both already under OFAC sanctions.
• Exchanges should check their own deposit addresses for funds received from the eight addresses, since some of the funds left through exchange deposit addresses.
• Treat payouts to remote IT contractors as a sanctions risk as well as a fraud risk. The DPRK IT worker advisories from the State Department, Treasury, the Justice Department and the FBI list red flags for hiring and payments.

How Scorechain helps

Scorechain imports the digital currency addresses OFAC publishes and attaches them to a unified entity for each designated person, so screening and transaction monitoring pick them up once the entity is updated. Obertas, Boykov and Kim Ki Hyok are now Sanction List entities with a score of 1. Flux Analysis, Graph Analysis and the Exploration Tool show who paid these addresses and where the funds went, which is where the Amnokgang, Boykov and Garantex links above came from.