US authorities have sanctioned a crypto cash-out network accused of converting North Korean undercover IT workers’ earnings into funds for the regime’s weapons programs, pulling back the curtain on a funding pipeline that touches legitimate crypto companies every day. The Oct. 28 Treasury action targets 10 individuals and one entity, including two Russian nationals accused of facilitating roughly 5.5 million usd in cryptocurrency transactions for North Korean operations.
How the fake-worker scheme operates
North Korean operatives have increasingly used stolen identities, fraudulent documents, and fabricated employment histories to secure remote jobs at legitimate businesses, including cryptocurrency companies. According to an investigation by blockchain analytics firm Chainalysis, some workers have also used generative AI to create convincing resumes, generate realistic profile photos, and produce deepfake videos during recruitment interviews. These techniques let operatives conceal who they are and slip past hiring checks, particularly at companies that recruit developers remotely.
The scale is enormous. A United Nations Panel of Experts estimate puts revenue from North Korean IT worker schemes at between 250 million and 600 million usd annually, money the regime allegedly appropriates for its weapons programs. Once employed, the workers collect salaries in crypto and send them up the chain.
A blockchain paper trail of a two-week salary
Chainalysis traced one suspected operative who contributed code to blockchain and decentralized finance projects while receiving regular cryptocurrency payments. The developer’s wallet received stablecoin transfers approximately every two weeks between late 2022 and early 2023, a cadence that resembled an ordinary salary. Later transactions revealed links to financial intermediaries associated with North Korea.
The laundering route then unfolded in stages. The wallet converted stablecoins into Ethereum before moving funds to consolidation addresses that Chainalysis linked to sanctioned entities. From there, the trail led to Russian national Ilya Aleksandrovich Boykov, who forwarded cryptocurrency to Garantex, a sanctioned Russian exchange, for potential cash conversion. According to Treasury, Boykov processed the equivalent of 3.5 million usd in crypto transactions since 2024 while supporting Limited Liability Company Alis, an organization associated with North Korean IT workers. He allegedly monitored transfers and provided logistical help to the group.
Two Russians and a web of exchanges
A second Russian national, Vitold Viktorovich Obertas, allegedly converted nearly 2 million usd in cryptocurrency and handled at least 1.25 million usd in other currency transactions for North Korean officials since January 2025. Chainalysis separately traced funds from Amnokgang Technology Development Company, a previously sanctioned organization managing North Korean IT worker delegations, to Obertas-linked wallets. Those wallets also deposited crypto into mainstream and sanctioned exchanges alike, revealing just how many channels the network can reach.
Treasury also identified the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia, as part of the network. Six workers associated with it allegedly generated more than 750,000 usd, a small window into how individual paychecks aggregate into a nine-figure annual operation.
Why crypto firms should worry about their own repos
The scariest part for the industry is not the money flow. It is the access. Treasury warned that North Korean IT workers have exploited their corporate access to deploy malware, steal proprietary information, and extract sensitive data. A contractor who merges legitimate code into a wallet or DeFi protocol while moonlighting for a sanctions-evasion network is a security problem no firewall solves. The MetaMask episode, in which a North Korea-linked contractor had access to code for a month before releases were halted, showed how real the exposure is.
What it means for everyday investors
For regular crypto users, the case is a reminder that sanctions compliance is not an abstraction. Stablecoins sit at the center of this network because they are the easiest way to pay remote workers across borders, and issuers’ freeze powers have become a frontline tool against state adversaries. Every high-profile enforcement action also increases pressure on exchanges and DeFi protocols to screen users harder, which shapes the privacy-versus-compliance tradeoff the entire industry is negotiating. The 600 million usd fake-worker empire is funded one paycheck at a time, and the blockchain trail those paychecks leave is now the map investigators follow.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Crypto markets are volatile, and readers should do their own research before making any decisions.
two russian nationals moving 5.5 million is the tip that got sloppy. the placement layer is recruiters and tiny llcs that never touch crypto headlines at all
deepfake videos during recruitment interviews is the part that should scare every hiring team. live camera checks are no longer enough when the candidate can be generated in real time
we moved to hardware key attestation for all remote hires last quarter. annoying for candidates but live deepfake interviews killed any trust in a camera check
we are heading the same way. the attestation vendor pitch basically says trust silicon over faces now, sad that this is where hiring landed
we moved the same direction after a candidate whose camera glitched in a very deepfake way. hardware attestation is annoying but it is the one check that cannot be generated live
live deepfakes during interviews is genuinely new territory. HR teams literally cannot trust their own eyes anymore
trust the eyes less, trust device attestation more. a fake face still needs a real laptop, thats the choke point
attestation helps but laptops get shipped to mule farms too. pair it with the payroll pattern or it is just a fancier checkbox
600 million a year and that is probably a low estimate. the two Russian facilitators moving 5.5 million are just the ones Treasury could trace. the untouched tail must be way bigger
@Yumi Sak and Chainalysis said they used AI for resumes AND profile photos too. the entire hiring funnel can be faked now. verification has to move to device and identity level, not interviews
The two-week stablecoin payroll cadence Chainalysis traced is basically a fingerprint. Any remote dev contractor paid like that deserves a second look, AI resume or not.
^ exactly. 5.5 million traced against a 600 million a year operation is under 1 percent. Treasury sanctions the tip of the pipeline and calls it progress
thats the part that stings. the scheme scales with remote work demand and the countermeasure is a sanctions list, arithmetic was never going to work
arithmetic was never going to work, exactly. every sanctioned broker is a job posting away from a replacement, the demand side is the actual target and nobody touches it
under 1 percent traced and then a press release. sanctions name 10 people while the broker network placing them runs the same job ads tomorrow
def a low estimate. UN said 250 to 600 million a year and that range has barely moved in two years while the scheme only grew
and the range has barely moved since the panel first published it. every cash-out network Treasury sanctions gets replaced by the next broker running the same job ads within a week
Fabricated employment histories and stolen identities, and companies still hire for remote roles off one video call. The 10 sanctioned names are a fraction of it, the brokers placing these workers are still operating.
10 sanctioned individuals and one entity for a pipeline worth hundreds of millions a year. Treasury is playing whack-a-mole with what is really a hiring problem
whack-a-mole is the right frame. you can sanction 10 workers but the remote dev, us company, paid in usdt job ads repost the same afternoon
5.5M traced against a 250 to 600M a year pipeline is under one percent. treasury sanctions the cash-out tail and calls the hiring problem solved
the two week stablecoin payroll cadence being traceable is the one detail that gives me hope. patterns survive identity fraud, faces dont
payroll cadence plus github commit timestamps is basically a signature. no deepfake generates a commit history at 3am pyongyang time every weekday
commit history angle is underrated. timezone consistent merges on prs that no western dev would file at those hours
commit timestamps plus a vpn latency check and this scheme dies at onboarding. the data is right there, nobody wants to be the team that slows down hiring to look at it
the ai generated profile photos detail is what gets me. recruiters are screening candidates that literally do not exist