The Trump administration on Wednesday sanctioned ten individuals and one entity connected to a North Korean government operation that plants IT workers with stolen identities inside U.S. companies, funneling their wages to Pyongyang's ballistic missile and weapons of mass destruction programs.
The Treasury Department's Office of Foreign Assets Control announced the designations, which target facilitators and IT workers based in North Korea and Russia, according to Reuters. Six of the sanctioned individuals are linked to the First Financial and Technical Development Center, the entity named in the action.
"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," Treasury Secretary Scott Bessent said in a statement. "Under President Trump's leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable."
According to Treasury, North Korean workers conceal their true identities and nationalities using forged documents, stolen identities and fabricated personas to secure legitimate technology jobs in the United States and allied countries. Pyongyang then collects most of their wages, generating hundreds of millions of dollars for its weapons programs. Some workers have also used their access to company networks to deploy malware, steal proprietary data and extort employers, Treasury said.
The networks have moved money through cryptocurrency, sophisticated money-laundering techniques and artificial intelligence tools, according to the department.
Among those sanctioned is Vitold Viktorovich Obertas, a Russian intermediary accused of handling financial transactions for North Korean officials. Treasury says Obertas has processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions since January 2025. Another Russian national, Ilya Aleksandrovich Boykov, allegedly facilitated cryptocurrency transactions worth roughly $3.5 million since 2024 in support of Alis, a North Korean entity previously sanctioned in 2024.
The department framed the action as part of a coordinated international push, noting that Australia and the European Union also imposed North Korea-related sanctions this month. "These networks permeate through the global financial system, necessitating a unified response to match the threat," Treasury said in its statement.
North Korea's mission to the United Nations in New York did not immediately respond to a request for comment, Reuters reported.
The sanctions land as President Trump has signaled openness to restarting diplomacy with North Korean leader Kim Jong Un. Trump downplayed the idea of another high-profile meeting with Kim in China next month, according to Reuters. Trump met Kim three times in 2018 and 2019, becoming the only sitting U.S. president to meet a North Korean leader, but the talks collapsed over American demands for denuclearization. Trump has since referred to North Korea as a "nuclear power," though his administration continues to call for denuclearization and has not formally recognized the country as a nuclear-weapons state.
The scope of the problem extends beyond government networks. U.S. companies across the technology, financial services and defense sectors have reported hiring remote workers who turned out to be North Korean operatives using stolen identities, a scheme the FBI has warned about for years.
Our Take
This is what America First looks like in practice. While the Biden administration spent four years treating North Korea as a nuisance to be managed, the Trump Treasury is going after the money — the actual lifeblood of Kim's missile program. Every fraudulent paycheck, every crypto conversion, every stolen identity used to land a six-figure remote job at an American tech firm is a direct transfer from U.S. businesses to Pyongyang's arsenal.
Notice the detail buried in the Treasury announcement: these operatives didn't just take salaries. They deployed malware, stole proprietary data and extorted their employers. That means American companies weren't just victims of fraud — they were unwitting hosts to a hostile intelligence operation. And the enablers aren't only in Pyongyang. Two Russian nationals allegedly moved millions in cryptocurrency to keep the scheme running. The networks are global; the response must be too.
Critics of sanctions always say the same thing: they don't work. But this isn't a broad-brush embargo on a country. This is precision targeting of specific facilitators, specific intermediaries and a specific entity, the First Financial and Technical Development Center, with six operatives tied directly to it. That's how you choke a network. It's also notable that Australia and the EU moved in the same month. That's not a coincidence — that's American leadership pulling allies into line instead of begging them to follow.
Here's the question every American business owner should be asking: how many North Korean IT workers are sitting inside your company's systems right now, drawing a paycheck and copying files? The Trump administration just gave you the answer for ten of them. The rest is up to you.
