OFAC sanctioned ten individuals and one entity for supporting North Korean government-run IT worker schemes that defrauded businesses and generated cryptocurrency revenue for the DPRK regime. Chainalysis traced worker payments through stablecoin and ETH transfers, sanctioned consolidation addresses, Russian facilitators, and the Garantex exchange, while OFAC attributed nearly $2 million in conversions to Vitold Obertas. DPRK managers Kim Ki Hyok and Kim Hyo Dong supervised Russia-based worker delegations, and six additional workers generated more than $750,000 for the DPRK-controlled FFTDC. The operatives also used generative AI, synthetic profile images, and deepfake video to strengthen fraudulent employment personas.