Treasury Targets 10 People in North Korean IT Worker Scheme Moving Millions

The Treasury Department designated 10 people and one organization on Wednesday in connection with an IT worker fraud operation that officials say funds North Korean weapons programs. Property and interests in property tied to the United States are blocked as a result, and Americans are generally prohibited from dealing with them.

The Treasury's Office of Foreign Assets Control named Russian national Vitold Viktorovich Obertas as an intermediary who has handled financial transactions for North Korean officials. Since January 2025, Obertas has processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in additional currency transactions for officials of the Democratic People's Republic of Korea.

North Korean national Kim Ki Hyok was also designated. He leads an IT worker delegation in Russia, where he monitors personnel and ensures financial targets are met. Since 2024, he has transferred nearly $500,000 in cryptocurrency on behalf of the delegation.

The First Financial and Technical Development Center, a Russia-based organization controlled by North Korea, was designated along with six of its operatives. The Treasury says the center procures trained IT workers for jobs in the United States and other countries while running cryptocurrency transfers, generating millions of dollars for the regime.

The operation works by having North Korean operatives pose as IT professionals and take jobs at U.S. and allied companies, then sending most of their pay back to the regime. Once inside company networks, these workers can reach sensitive data, deploy malware and extort employers. The Treasury says the proceeds run to hundreds of millions of dollars that support North Korea's weapons of mass destruction and ballistic missile programs.