\The US Treasury sanctioned 10 individuals and one entity on October 28 over North Korea’s IT worker schemes. Two of those named are Russians who allegedly converted millions in crypto for the regime’s networks.
Chainalysis's on-chain data connects one of the Russians to mainstream crypto exchanges, which the firm did not name.
Following the Money Out of Pyongyang’s Remote Payroll
Treasury’s Office of Foreign Assets Control (OFAC) identified Vitold Viktorovich Obertas as a Russian intermediary for North Korean financial transactions.
OFAC says he converted nearly $2 million in crypto for North Korean officials since January 2025. He also allegedly handled at least $1.25 million in other currency transactions.
Fellow Russian Ilya Boykov allegedly converted about $3.5 million in crypto for North Korean company Alis since 2024.
Chainalysis found that Obertas’ wallet received funds from Amnokgang, received funds from Amnokgang, an IT worker firm OFAC sanctioned on March 12. The same wallet also made deposits at both mainstream and sanctioned exchanges.
Chainalysis Reactor Graph Showing Transfers from Amnokgang to Obertas’ Wallet. Source: Chainalysis Chainalysis also traced funds from Boykov to Garantex, a Russian exchange under US sanctions since April 2022. US authorities seized its web domains in March 2025.
Follow us on X to get the latest news as it happens
Where Strict Liability Meets the Exchange Trail
Treasury said sanctions violations can bring civil or criminal penalties for US and foreign persons alike. OFAC may impose those civil penalties on a strict liability basis. Treasury added that non-US persons cannot cause US persons to violate sanctions, wittingly or unwittingly.
Prosecutors raised a similar concern in the Garantex case. The Justice Department alleged its operators redesigned the exchange to induce US businesses to transact with it unwittingly.
Treasury also warned that financial institutions and other persons may risk sanctions exposure for certain transactions involving designated persons. OFAC’s new listings flag secondary sanctions risk under its North Korea regulations.
For the unnamed mainstream exchanges that took Obertas’ deposits, any further dealings with him now carry that risk. Chainalysis did not say when those deposits took place.
Chainalysis said transfers involving the designated addresses now trigger sanctions alerts for its screening clients, depending on alert settings. US persons holding the designees’ property must block it and report it to OFAC.
The open question is which mainstream venues took Obertas’ deposits and whether their screening flagged them.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
https://youtu.be/eQ5VKGYaaDARead the Original story US Sanctions Two Russians Accused of Converting $5.5M in Crypto for North Korea by Kamina Bashir at beincrypto.com