Verify a decision

{"actor":"system:backfill","investigation_id":"3ecf6399-e95c-4342-a35a-b0309d5baab3","kind":"publish","page_slug":"first-financial-and-technical-development-center-fftdc","published_at":"2026-11-04T12:22:44.327Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"First Financial and Technical Development Center (FFTDC)","sections":[{"content":"OFAC added the First Financial and Technical Development Center (FFTDC) and ten individuals to its Specially Designated Nationals (SDN) List on October 28, 2026. According to reporting citing OFAC, FFTDC is a North Korean-controlled entity located in Russia that exports North Korean workers abroad to generate revenue for the North Korean government, with its IT workers allegedly using complex cryptocurrency transfers and other laundering methods to move proceeds. FFTDC was designated under Executive Order 13722, alongside six individuals described as FFTDC-linked IT workers (Kim Kyong Ju, Ri Thae Chol, So Hyong Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il). Four additional individuals -- Vitold Viktorovich Obertas, Ilya Aleksandrovich Boykov, Kim Ki Hyok, and Kim Hyo Dong -- were designated under Executive Order 13687, which concerns North Korea-related conduct outside the IT-worker export authority. The designation blocks all property of the designated parties within U.S. jurisdiction or in the possession of U.S. persons and generally prohibits U.S. persons from transacting with them.","heading":"OFAC Designation (October 28, 2026)","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: OFAC Designates Facilitators of North Korean IT Worker Schemes Targeting US Businesses","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-designates-facilitators-of-north-korean-it-worker-schemes-targeting-us-businesses"},{"credibility":2,"name":"Decrypt: Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto","type":"news_article","url":"https://decrypt.co/382132/treasury-sanctions-11-over-north-korean-it-worker-scheme-that-moved-millions-in-crypto"}]},{"content":"Reporting on the OFAC action describes a network in which North Korean IT workers, operating under false identities inside foreign (including U.S.) companies, were paid in cryptocurrency that was then converted to fiat by Russia-based intermediaries for use by North Korean state entities. Two Russian nationals were named in connection with this conversion role: Ilya Aleksandrovich Boykov, alleged to have exchanged and converted the equivalent of approximately $3.5 million in cryptocurrency since 2024 on behalf of LLC Alis, a Vladivostok-based North Korean IT-worker company that was itself sanctioned in 2024 and described as a subordinate of the previously sanctioned Chinyong Information Technology Cooperation Company; and Vitold Viktorovich Obertas, alleged to have handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. Kim Ki Hyok, described as leading a Russia-based IT-worker delegation, was separately alleged to have moved nearly $500,000 in crypto for that delegation since 2024, and Kim Hyo Dong was alleged to have transferred financial assets equivalent to more than $100,000 since at least December 2023. FFTDC's six designated IT workers were alleged to have collectively generated over $750,000 for the center since 2025. These figures come from OFAC's designation as relayed by TRM Labs and Decrypt; AVOID.NET has not independently verified them against the primary OFAC press release or SDN listing notice.","heading":"Alleged Crypto-to-Fiat Conversion Network","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: OFAC Designates Facilitators of North Korean IT Worker Schemes Targeting US Businesses","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-designates-facilitators-of-north-korean-it-worker-schemes-targeting-us-businesses"},{"credibility":2,"name":"Decrypt: Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto","type":"news_article","url":"https://decrypt.co/382132/treasury-sanctions-11-over-north-korean-it-worker-scheme-that-moved-millions-in-crypto"}]},{"content":"Decrypt reported that Treasury Secretary Scott Bessent stated that \"the North Korean regime continues targeting and exploiting American companies through fraudulent activities,\" in connection with the designation. Treasury and allied reporting describe the broader purpose of the network as generating hard currency for North Korea's weapons of mass destruction and ballistic missile programs, consistent with prior OFAC actions against DPRK IT-worker schemes, including a March 2026 designation of a separate network and earlier actions against Chinyong Information Technology Cooperation Company and its Vladivostok operations. This stated purpose is alleged by the U.S. government and has not been independently verified by AVOID.NET.","heading":"Treasury Statement and Alleged Purpose","severity":"high","sources":[{"credibility":2,"name":"Decrypt: Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto","type":"news_article","url":"https://decrypt.co/382132/treasury-sanctions-11-over-north-korean-it-worker-scheme-that-moved-millions-in-crypto"}]},{"content":"AVOID.NET could not directly retrieve the primary OFAC press release or SDN notice for this action at the time of writing; the facts above rely on secondary reporting from TRM Labs and Decrypt, which are largely consistent with each other on dates, names, and figures, and are treated here as medium-credibility sources. Other outlets covering the same action (including aggregator sites) reported some inconsistent or unconfirmed details -- for example, varying counts of how many Russia-based intermediaries were involved, and at least one report citing a figure of $5.5 million in total crypto moved that could not be corroborated against the two named individuals' figures as reported by TRM Labs. Those uncorroborated details have been omitted from this page. Readers should consult OFAC's recent actions page and SDN list directly to confirm specifics before relying on this designation for compliance purposes.","heading":"Sourcing Limitations and Discrepancies","severity":"medium","sources":[{"credibility":2,"name":"TRM Labs: OFAC Designates Facilitators of North Korean IT Worker Schemes Targeting US Businesses","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-designates-facilitators-of-north-korean-it-worker-schemes-targeting-us-businesses"}]}],"sources_used":[{"credibility":2,"name":"TRM Labs: OFAC Designates Facilitators of North Korean IT Worker Schemes Targeting US Businesses","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-designates-facilitators-of-north-korean-it-worker-schemes-targeting-us-businesses"},{"credibility":2,"name":"Decrypt: Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto","type":"news_article","url":"https://decrypt.co/382132/treasury-sanctions-11-over-north-korean-it-worker-scheme-that-moved-millions-in-crypto"},{"credibility":2,"name":"The Block: US sanctions DPRK IT facilitators over crypto transactions in $800 million scheme","type":"news_article","url":"https://www.theblock.co/news/regulation/2026-03-13-us-sanctions-dprk-facilitators-393518"},{"credibility":2,"name":"TRM Labs: OFAC sanctions individuals, entities, and crypto wallets associated with North Korean cyber activities","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-individuals-entities-and-crypto-wallets-associated-with-north-korean-cyber-activities"},{"credibility":3,"name":"onebullex: OFAC Sanctions 10 People And One Entity Over North Korea Crypto Laundering","type":"news_article","url":"https://www.onebullex.com/news/articles/ofac-sanctions-10-people-and-one-entity-over-north-korea-crypto-laundering"},{"credibility":3,"name":"coinalertnews: OFAC Sanctions North Korean Crypto Network Funding Weapons Programs","type":"news_article","url":"https://coinalertnews.com/news/2026/10/28/ofac-sanctions-north-korea-crypto"}],"summary":"On October 28, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated the First Financial and Technical Development Center (FFTDC), a North Korean-controlled entity based in Vladivostok, Russia, along with ten individuals, for operating an IT-worker fraud and crypto-laundering network that allegedly generated revenue for North Korea's weapons of mass destruction and ballistic missile programs. The designated individuals include Russian nationals alleged to have converted crypto to fiat on the network's behalf and North Korean nationals alleged to lead Russia-based IT-worker delegations. Figures for funds moved come from OFAC's designation as reported by blockchain-intelligence firms and crypto news outlets; AVOID.NET could not independently access the OFAC press release text at time of writing and relied on secondary reporting that is largely consistent across sources.","timeline":[{"date":"2023-05","event":"OFAC previously sanctioned Chinyong Information Technology Cooperation Company's Vladivostok representative and related cyber/IT-worker entities, part of the same broader DPRK IT-worker sanctions program.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-individuals-entities-and-crypto-wallets-associated-with-north-korean-cyber-activities"},{"date":"2024","event":"LLC Alis, a Vladivostok-based North Korean IT-worker company later linked to FFTDC designee Ilya Boykov, was sanctioned by OFAC.","source":"TRM Labs / Decrypt","source_url":"https://www.trmlabs.com/resources/blog/ofac-designates-facilitators-of-north-korean-it-worker-schemes-targeting-us-businesses"},{"date":"2026-03","event":"OFAC designated a separate North Korean IT-worker fraud network, described by reporting as having funneled close to $800 million to the regime in 2024.","source":"The Block","source_url":"https://www.theblock.co/news/regulation/2026-03-13-us-sanctions-dprk-facilitators-393518"},{"date":"2026-10-28","date_evidence":"OFAC's action was on October 28, 2026.","event":"OFAC designated the First Financial and Technical Development Center (FFTDC) and ten individuals -- including Russian nationals Ilya Boykov and Vitold Obertas and North Korean nationals Kim Ki Hyok, Kim Hyo Dong, and six FFTDC-linked IT workers -- for operating a crypto-laundering and IT-worker fraud network alleged to fund North Korea's weapons programs.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/ofac-designates-facilitators-of-north-korean-it-worker-schemes-targeting-us-businesses"},{"date":"2026-10","date_original":"2026-10-29","event":"Decrypt and other crypto news outlets reported on the designation, citing a Treasury statement from Secretary Scott Bessent.","source":"Decrypt","source_url":"https://decrypt.co/382132/treasury-sanctions-11-over-north-korean-it-worker-scheme-that-moved-millions-in-crypto"}]},"v":1}