OFAC sanctions DPRK IT worker facilitators and lists eight crypto addresses

OFAC sanctioned 10 people and one entity on 28 October 2026

On 28 October 2026 the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity.1 Treasury says each has a role in information technology (IT) worker schemes run by the government of the Democratic People's Republic of Korea (DPRK).1 By Treasury's account, the schemes defraud US businesses and fund the DPRK's weapons of mass destruction and ballistic missile programmes.1

The DPRK places its workers with legitimate companies using fraudulent documents, stolen identities and fabricated personas.1 Treasury says the regime then takes most of their wages, which generates hundreds of millions of dollars.1 Some workers have also used their access to corporate networks to deploy malware and take sensitive data.1

Four of the designated people moved money for these networks. Treasury gives these figures:1

• Vitold Viktorovich Obertas, a Russian intermediary, has conducted nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for DPRK officials since January 2025.1
• Ilya Aleksandrovich Boykov, a Russian national, has exchanged and converted the equivalent of $3.5 million in cryptocurrency transactions since 2024 in support of Limited Liability Company Alis, a DPRK IT worker company.1 He also monitored cryptocurrency transactions for Alis.1
• Kim Ki Hyok, the Alis lead, heads a Russia-based delegation of DPRK IT workers whose duties include monitoring Alis IT workers. Since 2024 he has transferred cryptocurrency valued at nearly $500,000 for the delegation.1
• Kim Hyo Dong leads a separate Russia-based delegation. Since at least December 2023 he has facilitated the transfer of over $100,000 equivalent in financial assets.1

The entity is the First Financial and Technical Development Center (FFTDC), a DPRK-controlled entity in Russia.1 OFAC also designated six Russia-based DPRK IT workers who, Treasury says, have generated over $750,000 for FFTDC since 2025.1 Treasury says FFTDC's workers use complex cryptocurrency transfers among their laundering methods.1

US persons must block the designees' property and report it within 10 business days

OFAC designated Obertas, Boykov and the two Kims under Executive Order (E.O.) 13687.1 It designated FFTDC and its six workers under E.O. 13722.1 Treasury states the effect of both:

The block extends to any entity that blocked persons own, directly or indirectly, 50% or more.1 A US person holding blocked property, including a financial institution, must file an initial report with OFAC within 10 business days of the property becoming blocked.3

Firms outside the US are exposed as well. Treasury says non-US persons may not cause or conspire to cause US persons to violate sanctions.1 It warns that financial institutions risk sanctions exposure for some dealings with designated persons, and that OFAC can impose civil penalties on a strict liability basis.1 Each new DPRK-related SDN entry carries a secondary sanctions risk tag under sections 510.201 and 510.210 of the North Korea Sanctions Regulations.2

Who the 28 October designations affect

Timeline of OFAC's DPRK IT worker designations

1. May 2023

   OFAC designates the Chinyong Information Technology Cooperation Company.1

2. January 2024

   FFTDC's SDN entry gives this as its established date.2

3. March 2024

   OFAC designates Limited Liability Company Alis as subordinate to Chinyong.1

4. January 2025

   Obertas begins the cryptocurrency conversions for DPRK officials that Treasury describes.1

5. 12 March 2026

   OFAC designates a separate DPRK IT worker network, including Amnokgang Technology Development Company.1

6. 28 October 2026

   OFAC designates 10 individuals and FFTDC.1, 2

7. Within 10 business days of blockingUpcoming

   A US person holding blocked property files an initial blocking report with OFAC.3

Three SDN entries list eight distinct crypto addresses

Treasury's press release names no wallet addresses.1 The SDN List entries do. We counted the digital currency addresses in OFAC's 28 October list update:2

That makes nine listings and eight distinct addresses: three on Ethereum and five on Tron.2 OFAC lists the Ethereum address 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510 on both Boykov's and Obertas's entries.2 The other seven designated individuals and FFTDC have no address on their entries.2

The addresses sit with the three men Treasury ties to cryptocurrency conversions and transfers.1, 2 A transfer touching the shared address is exposure to two designees, so an investigation into one man should check the other.

The 28 October action extends a line of designations. OFAC designated Chinyong in 2023, its subordinate Alis in 2024 and a separate network, including Amnokgang, in March 2026.1 Treasury says the new action builds on the March 2026 designation.1

What to change in screening, onboarding, investigations and reporting

Transaction monitoring and screening

• Add the eight addresses to your screening lists. Confirm your blockchain analytics provider has loaded OFAC's 28 October SDN update.2
• Look back for direct and indirect exposure to the addresses, from January 2024 onwards.
• Screen names against the SDN entries, as OFAC spells them. The press release spells one worker's name So Hyon Jin, and the SDN entry reads SO, Hyong Jin.1, 2

KYC and onboarding

• Re-screen customers and counterparties with Russian or North Korean links against the 10 names and FFTDC.
• If you hire remote developers, check them against the 10 names before you grant system access.

Investigations

• Treat any hit on 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510 as exposure to both Boykov and Obertas.2
• Record in the case file which designee each hit relates to and the executive order OFAC used.1

Reporting

• Block any property of the designees and file an initial blocking report with OFAC within 10 business days.3
• Have your MLRO decide whether a suspicious activity or suspicious matter report is also due in your jurisdiction.

Open questions on the Australian and EU designations and the addresses

How Cogentic helps

A screening hit on one of these addresses opens an investigation. Cogentic's agents work inside your existing stack, alongside the blockchain analytics and screening tools you already use. They triage the alert, trace the counterparty exposure and assemble the case with its evidence. Your MLRO reviews and signs. Cogentic never files autonomously.