US Treasury Slaps Sanctions on Two Russians Over $5.5M Crypto Conversions for North Korea

On October 28, the US Treasury imposed sanctions on 10 individuals and one entity linked to North Korean IT worker operations. Among them are two Russian nationals accused of converting millions of dollars in cryptocurrency for the regime's networks.

Blockchain analytics firm Chainalysis has on-chain evidence tying one of the Russians to mainstream crypto exchanges, though the company declined to identify them.

Tracking the Flow of Funds From Pyongyang's Remote Payroll

The Treasury's Office of Foreign Assets Control (OFAC) named Vitold Viktorovich Obertas as a Russian intermediary handling North Korean financial transactions.

According to OFAC, Obertas converted close to $2 million in cryptocurrency for North Korean officials starting in January 2025. He is also said to have processed at least $1.25 million in other currency deals.

Another Russian, Ilya Boykov, is accused of converting roughly $3.5 million in crypto since 2024 for the North Korean company Alis.

Chainalysis determined that Obertas' wallet received funds from Amnokgang, an IT worker firm that OFAC sanctioned on March 12. That same wallet made deposits at both mainstream and sanctioned exchanges.

Chainalysis also followed funds from Boykov to Garantex, a Russian exchange that has been under US sanctions since April 2022. US authorities seized Garantex's web domains in March 2025.

Where Strict Liability Meets the Exchange Trail

The Treasury noted that sanctions violations can result in civil or criminal penalties for both US and foreign individuals. OFAC can impose those civil penalties on a strict liability basis. The Treasury also said non-US persons cannot cause US persons to violate sanctions, whether knowingly or unknowingly.

Prosecutors raised a similar concern in the Garantex case. The Justice Department alleged that the exchange's operators redesigned it to inadvertently draw US businesses into transactions.

The Treasury further warned that financial institutions and others may face sanctions exposure for certain transactions involving designated individuals. OFAC's new listings highlight secondary sanctions risk under its North Korea regulations.

For the unnamed mainstream exchanges that accepted Obertas' deposits, any further dealings with him now carry that risk. Chainalysis did not disclose when those deposits occurred.

Chainalysis said transfers involving the designated addresses now trigger sanctions alerts for its screening clients, depending on alert configurations. US persons holding property belonging to the designees must block it and report it to OFAC.

The lingering question is which mainstream platforms accepted Obertas' deposits and whether their screening processes flagged them.