WarBrief Live | November 3, 2026 | Sanctions Tracker
On October 28, 2026, the United States designated 10 individuals and one entity for supporting North Korean government-run information technology (IT) worker schemes that, according to the Treasury Department’s Office of Foreign Assets Control (OFAC), defraud US businesses and fund North Korea’s weapons programs. The targets are the people OFAC says move, manage and cash out the earnings.
Key Takeaways
- OFAC designated 10 individuals and one entity on October 28, 2026.
- The entity is the First Financial and Technical Development Center (FFTDC), in Russia.
- Six FFTDC-linked workers generated more than $750,000 since 2025, OFAC said.
- Designation blocks US property; it is not a criminal conviction.
Who was designated on October 28?
The entity, the First Financial and Technical Development Center (FFTDC), is a North Korean-controlled entity in Russia that deploys IT workers abroad for government revenue, designated under Executive Order 13722. Six FFTDC-linked workers were designated under the same order — Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il — who OFAC said generated more than $750,000 for FFTDC since 2025; no crypto addresses were listed for them. Four more were designated under Executive Order 13687: Russian intermediary Vitold Viktorovich Obertas, linked to Amnokgang (designated March 12, 2026); Russian Ilya Aleksandrovich Boykov, accused of supporting Alis, subordinate to Chinyong (designated May 2023); and managers Kim Ki Hyok (Alis delegation) and Kim Hyo Dong (a separate Chinyong-subordinate delegation).
How do North Korean IT worker schemes work?
Workers take remote IT jobs using fraudulent documents, stolen identities or fabricated personas, often posing as freelancers. Most wages are routed to the North Korean government, and Treasury said workers may also exploit network access to steal data or extort employers. Earnings move through complex crypto transfers and money-laundering methods; three designated individuals carry eight listed crypto addresses, per TRM Labs, which employers, banks and crypto platforms must now screen against.
What measures are now in place?
Designation means property of the named persons in the United States, or held by US persons, must be blocked and reported, and US persons are generally prohibited from dealing with them; entities owned 50 percent or more by them are also covered. OFAC flagged secondary-sanctions risk for non-US parties facilitating significant transactions for them. Designation is an administrative blocking action, not a criminal conviction, and it does not by itself shut down a network outside US jurisdiction.
Recent actions: a dated timeline
- May 2023: OFAC designated Chinyong Information Technology Cooperation Company.
- March 12, 2026: OFAC designated Amnokgang Technology Development Company and a separate IT worker network.
- October 28, 2026: OFAC designated 10 individuals and FFTDC; Treasury said Australia and the EU joined related action this month.
- November 2, 2026: The ABA Banking Journal rounded up the action in its weekly OFAC summary.
By the numbers
| Figure | Detail | Source |
|---|---|---|
| 10 + 1 | People and entity designated, October 28, 2026 | OFAC, via TRM Labs |
| $750,000+ | Six FFTDC workers combined, since 2025 | OFAC, via TRM Labs |
| $3.5m | Crypto converted by Boykov for Alis since 2024 (alleged) | OFAC, via TRM Labs |
| ~$2m + $1.25m | Obertas crypto conversions and other transactions (alleged) | OFAC, via TRM Labs |
| 8 | Crypto addresses listed for three individuals | TRM Labs |
| $250m–$600m | Estimated annual revenue, UN Panel of Experts via Chainalysis | UN, via Chainalysis |
These are OFAC allegations or attributed estimates, not audited totals.
What impact will the designations have?
For compliance teams, new names and eight addresses enter screening lists. For employers, the case shows why US agencies urge deeper checks on remote IT hires, including work location and payment routing. Across WarBrief’s Sanctions Tracker, the action targets facilitators and financial plumbing, not only headline entities — the same logic as the earlier North Korean banking network measures and OFAC’s October Iran package. Educational summary of listings, not legal advice.
What to watch next
Watch for further designations linked to FFTDC, Chinyong or Amnokgang, enforcement against companies that employed designated workers or processed their pay, and updated agency advisories on remote-hire checks.
Frequently asked questions
What did OFAC do on October 28, 2026?
It designated 10 individuals and FFTDC for supporting North Korean IT worker schemes that defraud US businesses and fund weapons programs.
How do the schemes make money?
Workers take remote IT jobs under false identities, and most wages are routed to North Korea via crypto and money-laundering methods.
Does designation mean conviction?
No. It is an administrative blocking measure based on OFAC’s findings, not a criminal conviction.
Sources
- ABA Banking Journal: OFAC news, Nov. 2
- TRM Labs: OFAC designates facilitators of North Korean IT worker schemes
- Chainalysis: OFAC sanctions DPRK IT worker fraud
- CoinDesk: US sanctions Russian crypto middlemen
- Korea Times: US sanctions N. Korean network
- Steptoe: Weekly Sanctions Update, Nov. 2, 2026
