DPRK IT worker sanctions: OFAC targets the Russia-based crypto handlers behind fake hires

The new DPRK IT worker sanctions, announced by OFAC on 28 October 2026, block 10 individuals and one Vladivostok entity that place North Korean developers in Western jobs and move their pay through crypto. Eight wallet addresses are listed. Two weeks earlier the FBI warned that these workers buy identity verification accounts to test stolen identities.

• OFAC designated 10 individuals and the First Financial and Technical Development Center (FFTDC), a DPRK-controlled entity in Vladivostok established in January 2024.
• Treasury's per-person figures for four of the individuals add up to roughly 7.35 million dollars, and six FFTDC workers generated over 750,000 dollars.
• The SDN entries list three Ethereum and five TRON addresses. One Ethereum address appears on two different people's entries.
• Every entry carries secondary sanctions risk under sections 510.201 and 510.210 of the North Korea Sanctions Regulations, which reach foreign banks.
• The FBI's 13 October 2026 alert says these workers buy accounts or licences from identity verification providers to check that stolen identities will pass background checks.

What did OFAC announce on 28 October 2026?

In its latest DPRK IT worker sanctions, OFAC blocked 10 individuals and one entity for running North Korean government IT worker schemes that defraud US businesses and fund weapons programmes. The targets are a Russian intermediary, a Russian crypto converter, two North Korean delegation leaders, FFTDC and six FFTDC workers.

The Treasury press release explains the method in one line: the DPRK continues to "rely on fraudulent documents, stolen identities, and fabricated personas to conceal its IT workers". The regime then takes most of the wages. Treasury says the networks use complex crypto transfers and artificial intelligence tools, and that some workers have used their corporate access to deploy malware and steal data.

Source: Treasury press release of 28 October 2026. The five amounts for Obertas, Boykov and the two Kims add up to roughly 7.35 million dollars by our arithmetic; Treasury does not publish a total. The six FFTDC workers on the SDN List are Kim Kyong Ju, Ri Thae Chol, So Hyong Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il. Treasury's release spells the third name So Hyon Jin, so screen both spellings.

The action builds on the 12 March 2026 designations, which hit six individuals and two entities, including Amnokgang Technology Development Company. In March Treasury tied these schemes to nearly 800 million dollars in 2024. Alis was designated in March 2024 and its parent, Chinyong, in May 2023, so the October action targets the people still moving money for entities already on the list. Treasury adds that Australia and the European Union also designated supporters of the DPRK's revenue generation this month.

How does the scheme get past identity and payment checks?

The scheme defeats identity checks by giving each one something real to verify. According to the FBI, workers use stolen identities, pay Americans to lend theirs, pay to use facilitators' professional networking accounts and hire stand-ins for interviews. The money then leaves through rotating bank accounts and crypto conversions run by facilitators like those designated this week.

The FBI public service announcement of 13 October 2026, alert number I-101326-PSA, sets out the current tradecraft. Most names and addresses given to employers come from stolen identities. Facilitators are paid to appear on camera, sit interviews, verify fraudulent identities and host employer laptops at home. Workers rotate bank accounts, addresses and social media accounts "at an unusually high rate" as accounts get banned. Facilitators' networking accounts are attractive because they often contain years of legitimate activity history. The FBI's answer is what it calls identity in depth: layered controls across the employment lifecycle, because these workers "cannot be identified reliably with a single indicator".

One finding should concern every identity verification provider. The FBI states that workers "often purchase accounts or licenses from identity verification providers" to confirm that stolen personal data will pass employment background checks. The FBI also estimates that the North Korean government receives 85 to 90 percent of what the workers earn.

The payment side was described in the May 2022 joint guidance from State, Treasury and the FBI. It says workers falsify invoices and work agreements, likely to satisfy the KYC/AML checks of freelance platforms, and seek payment in virtual currency to evade those checks.

What obligations do the DPRK IT worker sanctions trigger?

The DPRK IT worker sanctions trigger four existing duties and point to one hiring control. Sanctions screening must now match eight new wallet addresses as well as names. Blocked property starts a 10 business day reporting clock. Foreign banks face correspondent account risk. Platforms paying remote workers need due diligence aimed at stand-in identities.

Sanctions screening, names and wallets. Every person in this action is blocked, and so is any entity owned 50 percent or more by blocked persons, in aggregate. OFAC enforces on a strict liability basis. For exchanges, custodians and payment firms, the eight addresses belong in blockchain screening on deposits, withdrawals and counterparty exposure. Name matching alone will miss a transfer that carries no name, so wallet screening and list screening are separate sanctions screening controls.

Source: OFAC recent action of 28 October 2026. Copy addresses from the official SDN entries into production systems rather than from any secondary page.

Blocking and reporting. A US person that holds property of these persons must block it and report it. Under 31 CFR 501.603, initial reports are due "within 10 business days from the date that property becomes blocked", with an annual report on property held at 30 June due by 30 September.

Foreign financial institutions. The SDN entries flag secondary sanctions risk under sections 510.201 and 510.210. Section 510.210 lets Treasury prohibit or restrict US correspondent accounts for a foreign bank that knowingly conducts or facilitates a significant transaction on behalf of a person blocked under the North Korea orders, including E.O. 13687 and E.O. 13722 used here. A Russian bank serving Obertas or Boykov is the obvious exposure. Every entry also flags section 510.214, which bars foreign entities owned or controlled by US financial institutions from knowingly dealing with designated persons it covers.

Customer due diligence and SARs. For payroll providers, freelance marketplaces and neobanks paying remote contractors, the 2022 guidance lists specific red flags: frequent transfers to PRC-based bank accounts, requests to switch to an account registered in a different name, and requests for payment in virtual currency. It also advises checking that banking details correspond to the identity documents. Those patterns support enhanced due diligence and, for US filers, a Suspicious Activity Report review.

Identity proofing at hiring. Employment checks are not AML duties, but the FBI's advice reads like an onboarding standard. It says E-Verify, a US passport, multiple forms of identification or live verification "can raise friction" for these workers. Treat hiring as identity proofing, with checks repeated during employment rather than once.

What is still uncertain, and where are the risks?

The open question is whether identity checks can stop a scheme built to pass them, which no round of DPRK IT worker sanctions answers. A stolen identity passes a database lookup. A paid stand-in passes a video interview. The FBI warns that aggressive controls risk false positives and that no single indicator works.

Over-blocking. The FBI warns that "ban lists" and filtering out names linked to these workers are unreliable, can block qualified applicants and can harm victims of identity theft whose names were used, which makes employment identity fraud unusually hard to filter. A team that adds every Korean or Russian-sounding name to a block list creates discrimination risk without stopping a worker using a stolen American identity.

Address hygiene. One Ethereum address, beginning 0x761edd, is listed under both Boykov and Obertas. Shared wallets mean a screening hit may attach to the wrong person in internal case notes. Screening addresses only at the moment of a transfer also misses funds that passed through them before 28 October. Exposure needs a look back, not only a forward screen.

Verification vendors as a vector. If workers buy access to identity verification services, a provider may be checking stolen identities on behalf of the people who stole them. That is a KYB problem for the provider: who is the customer, why do they need to test identities, and does their volume fit a real business?

Unclear scale. Treasury gives amounts per person, not a network total, and the FBI percentage is an estimate. The 800 million dollar figure for 2024 comes from Treasury's March release and covers the wider scheme, not this network.

How does this action compare with earlier DPRK IT worker sanctions?

This round of DPRK IT worker sanctions is narrower than March's but more financial. March hit a mix of facilitators in Vietnam, Laos and Spain. October concentrates on Russia: converters, quota-enforcing managers and a Vladivostok entity. Only Kim Hyo Dong's SDN entry also lists Laos.

Sources: Treasury press releases of 12 March 2026 and 28 October 2026.

OFAC also listed wallet addresses in its Tren de Aragua action and the Xinbi Guarantee case in September.

How should compliance teams respond?

Compliance teams should act on the DPRK IT worker sanctions this week in two stages. First, load the eight wallet addresses and the updated SDN entries into screening. Second, rework identity controls for remote workers and contractors. The steps below follow the Treasury and FBI documents and work regardless of vendor.

Load the eight addresses into blockchain screening and run a look back on historic exposure. Confirm that your list provider has ingested the 28 October update with all aliases, passport and national ID numbers. Check correspondent and nested relationships with Russian banks for exposure to the named converters.

For platforms that pay contractors, add the 2022 red flags to monitoring: payment details that do not match the identity record, switches to accounts in another name, transfers routed to PRC-based accounts and requests for crypto pay. Re-verify identity at payout changes, not only at signup. For identity verification providers, review customers whose volumes look like identity testing rather than onboarding.

Zyphe reads the NFC chip of a passport or ID card to ICAO 9303 and eIDAS standards and pairs it with two-step liveness, so the check rests on the document's signed chip data and a live person, not on an uploaded image. That is designed to reject forged or altered chip documents; it does not stop a facilitator lending a real identity, which is why re-verification at payout changes still matters. Verified identities become a reusable credential held by the user, and there is no central store of customer PII to steal and resell. Book a demo to see it on your onboarding flow.

The bottom line

The October DPRK IT worker sanctions show how this network moves its money: through Russian converters and wallets that OFAC can list. Identity controls are harder. Checks that verify data fail against stolen identities, and checks of the person fail against willing stand-ins. That is why the FBI calls for identity in depth: repeated, layered verification throughout employment.

Cited sources

• Treasury press release: Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses, 28 October 2026
• OFAC recent action of 28 October 2026 with SDN entries and digital currency addresses
• FBI IC3 public service announcement I-101326-PSA: North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment
• Treasury press release of 12 March 2026 on DPRK IT worker revenue networks
• State, Treasury and FBI guidance on DPRK information technology workers, 16 May 2022
• 31 CFR 501.603: reports of blocked, unblocked or transferred blocked property