North Korea's Crypto Workforce: Sanctions Evasion Goes Remote

The U.S. Treasury Department sanctioned ten individuals and one entity this week for what amounts to the most mundane-sounding financial crime imaginable: North Korean IT workers collecting paychecks from American technology companies under fake identities. The banality of the scheme—remote employment, cryptocurrency conversion, fund transfers—masks something considerably more sinister. These weren't random hires. They were part of a coordinated operation to launder millions of dollars in illicit compensation that would eventually fund North Korea's weapons of mass destruction programs.

The mechanics are almost elegant in their simplicity. North Korean operatives applied to U.S. tech firms using fabricated identities. They performed legitimate work, collected legitimate paychecks, then funneled those earnings through Russian intermediaries who converted the funds into cryptocurrency. From there, the money disappeared into the distributed ledger—and North Korea's weapons budget.

The numbers tell a story about the scale of the operation. Treasury identified Russian national Ilya Aleksandrovich Boykov as having converted approximately $3.5 million in crypto for the sanctioned company Alis since 2024. His colleague Vitold Viktorovich Obertas handled nearly $2 million in crypto conversions on behalf of North Korean officials since January 2025. Six North Korean IT workers affiliated with FFTDC, a company established in Russia specifically to manage this operation, generated more than $750,000 in revenue since 2025.

This is not, it bears emphasizing, a hacking operation or some dramatic breach. This is employment fraud scaled into a state-sponsored funding mechanism. The workers actually performed their jobs. They actually earned their salaries. The U.S. companies that hired them—likely without knowing who they were actually working for—paid real money into accounts that were real in every sense except one: the beneficiary was the North Korean government.

What makes this particularly revealing is the contrast with traditional sanctions enforcement. When the international community wants to pressure a state actor, it freezes bank accounts, restricts trade, and seals borders. These tools worked reasonably well when assets sat in recognizable places—correspondent banks in New York, real estate in London, port facilities that could be monitored. But cryptocurrency doesn't sit anywhere. It exists in distributed ledgers maintained by thousands of nodes worldwide. A North Korean official can be sanctioned on Monday and still access funds converted and stored on the blockchain on Tuesday, provided they have the private keys.

The previous round of Treasury sanctions in March targeted six people and two companies accused of laundering $800 million in crypto for North Korea. Australia and the European Union announced related designations this month. The Multilateral Sanctions Monitoring Team coordinated the October action, a reminder that this problem now requires international vigilance. One country's enforcement action means little when the money can be routed through another jurisdiction's cryptocurrency exchange.

What's instructive here is how thoroughly cryptocurrency's libertarian promise has failed to materialize in practice. The original appeal of blockchain technology was its resistance to state control—the idea that decentralized systems would make it impossible for governments to freeze assets or track money flows. Instead, what's happened is more complicated. Cryptocurrency hasn't freed ordinary people from state power. It's freed sophisticated state actors from the friction of traditional financial systems. North Korea doesn't need to negotiate with SWIFT or convince correspondent banks to cooperate. It needs a laptop, an internet connection, and a willingness to commit employment fraud against American technology companies.

The scheme also reveals something about the current state of sanctions enforcement: it's increasingly reactive rather than preventative. Treasury can identify and designate the participants after the fact. It can freeze whatever crypto holdings it can locate. But by then, the money has often already moved through multiple exchanges and wallets, passed through mixers designed to obscure transaction history, and emerged in a form that's nearly impossible to trace. The Treasury Department can shut down this particular operation. Three more will likely emerge.

For the macroeconomist watching international financial flows, the significance runs deeper. This represents a fundamental challenge to the post-war system of economic statecraft. Sanctions work when they can prevent access to capital and commerce. They fail when actors can simply extract what they need from a decentralized financial system without asking permission. North Korea's IT workers weren't stealing from the blockchain—that $6.3 billion figure the brief mentions doesn't appear directly in the Treasury action, though various crypto thefts linked to North Korean actors do circulate at that scale. Rather, they were extracting legitimate compensation and converting it into a form that existing sanctions architecture cannot effectively control.

The international response has been appropriately coordinated. But coordination has limits when the underlying asset class operates beyond traditional jurisdictional boundaries. Treasury can sanction Boykov and Obertas. It cannot sanction the Ethereum network itself. This is the real story buried beneath the employment fraud charges: sanctions regimes built for a world of correspondent banks and frozen accounts now face an adversary that simply moves through a parallel financial system. Until cryptocurrency exchanges are forced into genuine compliance with international sanctions regimes—and until that compliance is actually enforced—North Korea and actors like it will continue to fund their operations by doing exactly what they did here: applying for jobs, doing the work, and converting their paychecks into weapons programs.