US Sanctions North Korean IT Worker Network Operating in Russia
The US Treasury targets a scheme involving North Korean IT workers in Russia and their crypto-to-cash conversion network.
The US Treasury targets a scheme involving North Korean IT workers in Russia and their crypto-to-cash conversion network. This is an original TLT brief synthesising 2 outlets (Cryptopolitan, Decrypt), plus live market data, as of Thu, 29 Oct 2026 13:00:04 UTC.
This action disrupts a significant financial pipeline for North Korea, highlighting the use of crypto by sanctioned entities and the US's focus on cutting off these channels.
- US sanctions 10 individuals and one company linked to North Korean IT worker scheme.
- Over $5 million in crypto was converted for North Korean networks, according to OFAC.
- Action targets Russia-based intermediaries facilitating crypto-to-cash conversion.
Cryptopolitan and Decrypt both report that the US Treasury's OFAC has sanctioned 10 individuals and one company as part of a crackdown on a network that placed North Korean IT workers in American companies. The outlets agree that the scheme involved Russia-based intermediaries who converted crypto into cash for Pyongyang. However, Decrypt provides the specific detail that over $5 million in crypto was converted, while Cryptopolitan focuses on the broader sanctions and the involvement of intermediaries without citing the exact amount.
The US Treasury's Office of Foreign Assets Control (OFAC) has imposed sanctions on 10 individuals and one company as part of a crackdown on a network that placed North Korean IT workers in American companies. This action, taken on October 28, targets intermediaries based in Russia who facilitated the conversion of crypto wages earned by these workers into cash for Pyongyang.
According to OFAC, two Russian nationals played a key role in this operation by converting more than $5 million in cryptocurrency for North Korean networks. Their wallets have been listed by OFAC, indicating a direct link between the crypto transactions and the sanctioned activities.
The sanctions highlight the ongoing efforts by North Korea to generate revenue through illicit means, including the use of crypto. The involvement of Russian intermediaries underscores the transnational nature of these operations and the challenges in tracking and disrupting such networks.
This development comes weeks after raids on a laptop farm in Texas, which may have been connected to similar activities. The US continues to focus on cutting off financial channels that support North Korea's weapons programs and other illicit activities.
In the broader market context, the total crypto market cap stands at $2.75 trillion, with 
Bitcoin down 1.32% in the last 24 hours. The Fear & Greed Index is at 51, indicating a neutral market sentiment. While no specific coin is named in the sanctions, the news highlights the continued scrutiny of crypto's role in illicit transactions.
Figures and sectors in this story, checked live against on-chain aggregators · October 29, 2026.
TLT reads these figures directly from on-chain aggregators (DeFiLlama, mempool.space) at build time — independent of what any outlet reported. Sector totals aggregate every protocol DeFiLlama tracks in that category. Values are live and will change.
US Sanctions North Korean IT Worker Network Operating in Rus — questions & answers
What is the total amount of crypto converted by the sanctioned individuals?
Over $5 million in crypto was converted for North Korean networks, according to OFAC.
Who are the key targets of the US sanctions?
The sanctions target 10 individuals and one company involved in placing North Korean IT workers in American companies and facilitating crypto-to-cash conversion.
Why is this development significant?
This action disrupts a major financial pipeline for North Korea and highlights the use of crypto in illicit transactions, prompting increased scrutiny from regulators.
Which outlets reported this story?
This is an original TLT brief that synthesises reporting from Cryptopolitan, Decrypt, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original TLT brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.