US Sanctions North Koreans and Russians Over IT Worker Fraud
Left 50%
Center 0%
Right 50%
1 left · 0 center · 1 right
What happened
The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on Wednesday sanctioned ten individuals and one entity over an alleged North Korean government-run information-technology worker scheme. The designations covered eight North Korean nationals, two Russian nationals (Vitold Viktorovich Obertas and Ilya Aleksandrovich Boykov), and the First Financial and Technical Development Center, a North Korean-controlled entity located in Russia. Treasury said the network used stolen identities, fraudulent documents, and fake personas to obtain technology jobs at legitimate companies in the United States and allied countries, then diverted wages that officials said helped finance North Korea's weapons of mass destruction and ballistic missile programs and generated hundreds of millions of dollars. Officials further alleged that workers deployed malware, stole sensitive data, extorted companies, and moved funds through cryptocurrency and money-laundering methods, including conversions Treasury tied to Obertas of nearly $2 million in cryptocurrency and at least $1.25 million in other currency since January 2025, and crypto facilitation by Boykov equivalent to $3.5 million since 2024. The sanctions freeze any U.S. property of the designated parties and generally prohibit U.S. persons from dealing with them unless OFAC authorizes it.
Sourcing check · Fully on the record · 2 articles
2 of 2 articles cite a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 2 of 2
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Treasury Department and Scott Bessent
- Primary evidence · cites a document or data 0 of 2
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: None cited.
- Credits another outlet 0 of 2
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 2
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 28, 16:06 UTC by The Hill, naming its source.
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out
Unpacked
The alleged scheme's method and where the money went are missing from left-leaning coverage. Right-leaning coverage reports that North Korean IT workers used stolen identities to obtain jobs inside U.S. companies, with wages directed to weapons of mass destruction and ballistic missile programs. Left-leaning coverage in The Hill describes only a government-run IT scheme to defraud American businesses to benefit the North Korean military, so a reader of only that account would not know Treasury described infiltration tied to those weapons programs.
Each side assigns the action to a different principal in the lede. Right-leaning coverage in Fox Business leads with the Trump administration as the actor imposing the sanctions, and repeats that frame in the headline. Left-leaning coverage opens on the Treasury Department and never names the president at all.
Which U.S. companies hired the workers, and how many firms were affected?
Bottom line
Read only The Hill and Wednesday's action is IT fraud for North Korea's military; Fox Business led with workers using stolen identities to get inside U.S. companies, a method The Hill never states.
The receipts — 4 facts one side's coverage lacks
- Workers allegedly used stolen identities to obtain technology jobs in the U.S. and allied countries.
- The scheme generated hundreds of millions of dollars that Treasury says helped finance North Korea's weapons programs.
- Russian intermediary Vitold Viktorovich Obertas allegedly handled nearly $2 million in cryptocurrency conversions for North Korean officials.
- OFAC sanctioned eight North Korean nationals and two Russian nationals.
The Left View
The Hill frames the episode as a Treasury and OFAC action against an "alleged scheme to defraud American businesses to benefit the North Korean military," stressing a "government-run" IT operation and attributing the move to the department rather than the White House. The available coverage stays short and does not highlight infiltration of firms, weapons-of-mass-destruction finance, malware, or cryptocurrency.
The Right View
Fox Business casts the designations as a Trump administration sanctions package targeting a network "accused of infiltrating US companies," quoting Treasury Secretary Scott Bessent that overseas IT operatives "weaponize sensitive data and extort businesses for substantial payments" and that "Under President Trump's leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities." The outlet foregrounds fraudulent identities, WMD and missile finance, malware, cryptocurrency, "Super Intelligence (SI) tools," and continuity with a related sanctions round in March.
Our Take (balanced)
The Hill's strongest argument is institutional: this is Treasury enforcing against alleged fraud that benefits North Korea's military, told without partisan credit. Fox Business's strongest argument is the administration's own, more severe Treasury narrative—infiltration, data theft, extortion, and WMD finance—plus Bessent's on-the-record link to Trump's leadership and protecting U.S. firms. The central unresolved tension is whether readers should see a routine counter-proliferation designation or a distinctive Trump-era campaign against corporate infiltration; the two accounts also diverge on how much of Treasury's operational case belongs in the story.
2 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.