OFAC sanctions North Korea IT worker network in 2026 and lists 8 crypto addresses Tether has frozen
On 28 October 2026 OFAC sanctioned 10 people and one entity tied to North Korea's IT worker schemes and listed 8 Ethereum and Tron addresses. The USDT contract records freezes on all 8, seven of them on 28 October.
On 28 October 2026 the US Treasury's Office of Foreign Assets Control sanctioned 10 individuals and one entity for their roles in North Korea's IT worker schemes, and attached 8 distinct crypto addresses to three of them: 3 on Ethereum and 5 on Tron. The USDT contract on both chains records a freeze on all 8. Seven were added to Tether's blacklist between 17:01 and 17:03 UTC that same day.
What the document says
Treasury says the networks used crypto to move money for the North Korean government:
These networks have leveraged sophisticated cryptocurrency transactions, money laundering techniques, and emerging technologies, including artificial intelligence tools, to generate and transfer millions of dollars for the DPRK government.
The release gives figures for each named person. It says Russian national Ilya Aleksandrovich Boykov exchanged and converted "an equivalent of $3.5 million in cryptocurrency transactions" since 2024 for Alis, a company OFAC designated in March 2024 as subordinate to North Korea's Chinyong Information Technology Cooperation Company. It says Vitold Viktorovich Obertas carried out "nearly $2 million worth of cryptocurrency conversions" since January 2025, and that Kim Ki Hyok transferred crypto for a Russia- based delegation of North Korean IT workers "valued at nearly $500,000" since 2024. Six workers at the First Financial and Technical Development Center, a North Korea-controlled entity in Russia, generated "over $750,000" since 2025, according to the release.
The OFAC listing names the addresses. Boykov has 2 Ethereum and 2 Tron addresses, Kim Ki Hyok 1 Ethereum address and Obertas 1 Ethereum and 3 Tron addresses. One Ethereum address, 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510, is listed under both Boykov and Obertas, so the 9 listings cover 8 addresses.
What the blockchain shows
Tether's USDT contract emits an AddedBlackList event when Tether blocks an address from sending the token. Read on 30 October 2026:
| Address group | Freeze recorded | Time (UTC) |
|---|---|---|
| 3 Ethereum addresses | 28 Oct 2026 | 17:02 to 17:03 |
| 4 Tron addresses | 28 Oct 2026 | 17:01 |
| TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm | 4 Dec 2025 | 08:48 |
Very little USDT was left to freeze. The 8 addresses held about 2,210 USDT between them on 30 October, about 2,121 of it in the Tron address frozen in December 2025. Set against the $3.5 million Treasury attributes to Boykov alone, the balances suggest most of the funds had moved on before the listing. Whether Tether acted on its own or at OFAC's request is not stated in either document, and no Tether statement was read for this piece: not verified.
What it changes for users
The addresses are now on the SDN list. US persons, and anyone dealing through the US system, are generally barred from transactions with them, and Treasury warns that financial institutions and other persons "may risk exposure to sanctions" for certain transactions involving blocked persons. Exchanges and wallets that screen transfers against the SDN list are likely to flag funds coming directly from these addresses; how far back they trace depends on each service's tools.
The freeze shows how USDT works: Tether can stop any address from moving the token, and the USDT explainer quotes the terms that let it do so. A sanctions listing is evidence about the named people, not about anyone who once received funds from them.
Quick answers
Who did OFAC sanction on 28 October 2026?
Ten individuals and one entity linked to North Korea's IT worker schemes, including Russian nationals Ilya Boykov and Vitold Obertas and the First Financial and Technical Development Center.
Did Tether freeze the sanctioned addresses?
The USDT contract records a freeze on all 8 listed addresses. Seven were added on 28 October 2026 and one on 4 December 2025.
How much USDT was frozen?
About 2,210 USDT sat in the 8 addresses on 30 October 2026. Treasury's figures for the network's crypto activity run into the millions of dollars.
Sources
- U.S. Treasury press release sb0669, Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses, 28 October 2026, retrieved 2026-10-30
- OFAC Recent Actions, North Korea Designations, 28 October 2026, retrieved 2026-10-30
- Tronscan, USDT AddedBlackList transaction for TQKoDq5aCrWAciiNtete5pDYVN38i4qFN1, 28 October 2026, retrieved 2026-10-30
- Tronscan, USDT AddedBlackList transaction for TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm, 4 December 2025, retrieved 2026-10-30
- Blockscout, USDT AddedBlackList transaction for 0x12Ea80238C7d805D003ce793594e92d84A6f4E8d, 28 October 2026, retrieved 2026-10-30
- Blockscout, USDT AddedBlackList transaction for 0xE4C9a7F68B1EbA4508f54f07f7378847318dD1A3, 28 October 2026, retrieved 2026-10-30
- Blockscout, Ethereum address 0x12Ea80238C7d805D003ce793594e92d84A6f4E8d, read 30 October 2026
- Tronscan, Tron address TQCBdU4K92oxLAkzwexZpqVZJhmPbtLYMm, read 30 October 2026
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.