Chainalysis traces North Korean crypto cash-outs through Garantex

Blockchain analytics company Chainalysis mapped a long-running network of Russian intermediaries that helped North Korean IT workers cash out millions of dollars in cryptocurrency.

The US Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity on Wednesday for supporting North Korean government-run IT worker schemes that it said funded the country’s weapons programs, according to a press release.

Those sanctioned included Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas. Treasury said Boykov had converted about $3.5 million in crypto for sanctioned company Alis since 2024, while Obertas had handled nearly $2 million in crypto conversions for North Korean officials since January 2025.

In one example, a wallet linked to a North Korean IT worker received regular stablecoin payments, converted them into Ether (ETH) and transferred the funds through consolidation addresses to Boykov, according to Chainalysis’ Wednesday report. Boykov then sent the cryptocurrency to Russian exchange Garantex to cash out.

North Korean IT workers using false identities to obtain jobs at crypto companies have posed a persistent security threat. In June 2025, the US Department of Justice announced charges against four North Korean nationals over a scheme involving fraudulent IT employment and the theft of more than $900,000 from US and Serbian crypto companies.