Treasury Blocks Assets of 10 Individuals in North Korean IT Fraud Ring

The U.S. Treasury Department sanctioned 10 North Koreans and Russians on Wednesday for operating a fraud scheme that places fake IT workers inside American and allied companies. The state-run operation generates hundreds of millions of dollars by selling stolen identities and fabricated resumes. North Korea uses these proceeds to finance its nuclear weapons and ballistic missile development.

The scheme relies on North Korean operatives posing as legitimate professionals to secure employment. Once inside corporate networks, these workers access sensitive data and deploy malware. They then send the majority of their salaries back to the regime.

Investigators identified Russian infrastructure as a critical component of this financial network. The Treasury designated Vitold Viktorovich Obertas, a Russian intermediary who processed financial transactions for North Korean officials. Since January 2025, Obertas converted nearly $2 million in cryptocurrency. He also handled at least $1.25 million in other currency transfers for Democratic People's Republic of Korea officials.

The agency also sanctioned Kim Ki Hyok, a North Korean national leading an IT delegation in Russia. Kim monitors personnel and ensures the group meets financial quotas. He transferred nearly $500,000 in cryptocurrency for the delegation since 2024. The First Financial and Technical Development Center, a Russia-based entity controlled by North Korea, also received sanctions. Six of its operatives were designated alongside the organization. The center procures trained workers for global jobs and manages behind-the-scenes cryptocurrency transfers.

All U.S.-linked property and interests of these designated persons are now blocked. Americans and U.S. residents are generally prohibited from engaging with them. The Treasury stated the action targets the machinery that converts fraudulent employment into illicit revenue. This revenue ultimately funds North Korea's weapons programs.

The designation list includes both individual operatives and the organizational hub in Russia. The financial flows traced by investigators show a direct link between corporate payroll in the West and military spending in Pyongyang. The blocked assets include cryptocurrency holdings and traditional bank accounts held in the United States or by U.S. persons.