Chainalysis Maps Russian Intermediary Network Facilitating North Korean Crypto Cash Outs

TL;DR

• Chainalysis identified a network of Russian intermediaries that helped North Korean IT workers convert millions of dollars in cryptocurrency into cash.
• The United States sanctioned ten individuals and one entity for participating in operations linked to North Korean programs that finance weapons development.
• Chainalysis traced transfers to the Russian exchange Garantex and approximately $5.5 million in transactions handled by two sanctioned intermediaries.

Chainalysis identified a network of Russian intermediaries that facilitated the cashing out of millions of dollars in cryptocurrency linked to IT workers from North Korea. The investigation traced transfers between multiple wallets and their movement to platforms used to withdraw funds.

The Chainalysis report was published after the U.S. Office of Foreign Assets Control (OFAC) announced sanctions against ten individuals and one entity for supporting IT employment schemes organized by the North Korean government.

According to the Treasury Department, these operations generated revenue used to finance the country’s weapons programs. The workers used false identities to secure jobs at foreign companies and receive payments for their services.

Chainalysis Traces Transfers to the Garantex Exchange

Among those sanctioned were Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas, identified as intermediaries involved in cryptocurrency conversions.

U.S. authorities stated that Boykov had converted approximately $3.5 million in digital assets for Alis, a sanctioned company, since 2024.

Obertas, meanwhile, allegedly handled nearly $2 million in cryptocurrency conversions for North Korean officials since January 2025.

Chainalysis documented a case in which a wallet linked to a North Korean IT worker received regular payments in stablecoins.

The funds were subsequently converted into Ether (ETH) and transferred through consolidation addresses before reaching a wallet controlled by Boykov.

The intermediary then sent the cryptocurrency to Garantex, a Russian exchange, where the funds were converted for withdrawal.

Tracing these transactions allowed investigators to reconstruct part of the infrastructure used to move revenue from the workers’ wallets to the intermediaries responsible for cashing it out.

United States Investigates North Korean IT Worker Operations

North Korean IT worker schemes have raised concerns among U.S. authorities because they involve the use of false identities to obtain jobs at technology and cryptocurrency companies.

These activities generate revenue for North Korea and, in some cases, have also been linked to digital asset theft.

In June 2025, the U.S. Department of Justice filed charges against four North Korean nationals for their alleged involvement in a fraudulent IT employment scheme.

The investigation involved the theft of more than $900,000 from cryptocurrency companies in the United States and Serbia.

The sanctions announced by OFAC identify the intermediaries involved in converting the funds and their connections to the financial operations of North Korean officials and entities.