Blockchain security firm SlowMist has traced millions of dollars in historical cryptocurrency transfers between wallets associated with U.S.-sanctioned North Korean IT-worker intermediaries and deposit addresses linked to major exchanges, including Bybit, HTX and Binance.
The November 5, 2026, investigation uses MistTrack blockchain analysis to examine addresses identified in an October 28 U.S. sanctions action. Among the findings are approximately $9.88 million transferred from a wallet attributed to Russian intermediary Ilya Boykov to an Ethereum address jointly associated with Boykov and Vitold Obertas, another $4 million directed to a separate Bybit deposit address, and approximately 1.66 million USDT in transfers connecting their TRON wallets.
The transactions are old, but the map of them is new. Most of the identified transfers occurred between 2023 and 2025, rather than on November 5, when SlowMist published its analysis.
The investigation expands the publicly available transaction history behind a U.S. Treasury action targeting 10 individuals and one entity involved in networks that allegedly helped North Korea obtain overseas technology jobs using fraudulent identities and move earnings to the government.
Ethereum transfers reveal $19.5 million in historical flows
SlowMist examined Ethereum address 0x12Ea80238C7d805D003ce793594e92d84A6f4E8d, attributed to Boykov in U.S. sanctions records. The wallet was active between November 2022 and August 2025 and recieved approximately 19.55 million in USDT, USDC and DAI, alongside 49.5767 ETH.
More than half of its stablecoin transfers, approximately $9.88 million, went to 0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510, an address identified by MistTrack as a Bybit deposit destination.
The same destination appears under both Boykov and Obertas in the Treasury’s sanctions records. That address, it appears in both sanctions entries.
SlowMist identified 128 transfers from Boykov’s wallet to this shared address, accounting for approximately 77% of the receiving address’s total inflows. The largest individual transfer involved 511,000 USDC on June 12, 2024.
Another $4 million moved from Boykov’s wallet to a seperate Bybit-labeled deposit address, 0x197c6c66d9fc674d496ee232f418bd6f6013a13b, across 31 transactions.
That destination also appears in the transaction history of an Ethereum wallet associated with Kim Ki Hyok, a North Korean national sanctioned for overseeing a Russia-based delegation of IT workers.
SlowMist traced a 50,000 DAI transfer from Kim’s address through the identified deposit route. The funds had previously arrived through an intermediary wallet, creating another observable connection between addresses attributed to different individuals within the sanctioned network.
There were other routes too, smaller ones and some not so small.
According to SlowMist, approximately $5.65 million from Boykov’s Ethereum wallet reached two HTX-labeled deposit addresses, while another $9,870 went to an address classified as a Binance deposit destination. Transfers to the HTX addresses began in June 2023 and continued over more than two years.
These figures describe historical movements from a particular wallet, not the total revenue generated by North Korean IT workers or a newly identified amount of stolen cryptocurrency.
TRON analysis connects Boykov and Obertas wallets
SlowMist also identified direct stablecoin transfers between wallets attributed to Boykov and an Obertas-associated Bybit deposit address on TRON.
One Boykov-linked wallet, TQKoDq5aCrWAciiNtete5pDYVN38i4qFN1, received approximately 873,675 USDT between December 2022 and December 2025. Its largest outgoing transfer, around 257,732 USDT, went to the Obertas-associated deposit address.
A second wallet, TXmrnVgsqCMJncYHTXchuJ5z111BXSj4g3, transferred approximately 1.4 million USDT to the same destination across seven transactions. That represented around 86.2% of the wallet’s identified incoming USDT.
Combined, the two transfer streams amounted to roughly 1.66 million USDT.
The receiving address, TFksjBcHPYqgAax2USheQuaT1ydRKyZRdg, was attributed to Obertas in the sanctions records and labeled by MistTrack as a Bybit deposit address. SlowMist found that it had received approximately 31.02 million USDT between March 2023 and October 31, 2026.
Another Obertas-associated wallet transferred roughly 2.58 million USDT to that destination and 1.08 million USDT to an HTX-labeled address also attributed to Obertas.
These findings provide observable transaction links across Ethereum and TRON, including direct payments between addresses associated with sanctioned individuals and shared exchange deposit destinations.
Not a November transfer, any of this.
The transfers identified between Boykov’s two TRON wallets and the Obertas-associated deposit address predate the October 28 sanctions announcement. The larger historical totals also include activity outside the periods described in the Treasury’s specific allegations.
Why the blockchain totals exceed Treasury’s figures
The U.S. Treasury’s October 28 sanctions announcement attributed approximately $3.5 million in cryptocurrency exchange and conversion activity to Boykov since 2024 in support of Alis, a previously sanctioned North Korean-linked company.
It separately accused Obertas of conducting nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.
Kim Ki Hyok was linked to nearly $500,000 in cryptocurrency transfers for his IT-worker delegation since 2024.
SlowMist’s larger transaction totals are not directly comparable with these amounts. The Treasury describes particular conduct involving designated individuals and organizations, whereas MistTrack examines broader wallet histories, including transfers before the periods specified by Treasury.
A wallet receiving $19.55 million does not establish that its operator personally earned that amount, that every transaction was connected to North Korea, or that all the money represented proceeds from sanctions violations.
Some funds may also move between addresses associated with the same person or account, meaning that adding every identified transfer could count the same assets more than once.
That limitation is also relevent when comparing the research with ZachXBT’s investigation of Lazarus-linked cryptocurrency laundering. That separate investigation concerned networks allegedly handling proceeds from major cryptocurrency thefts, while the latest SlowMist analysis focuses on addresses associated with an IT-worker revenue and payment network.
The two investigations concern different financial activities. The latest address connections do not establish that the sanctioned IT-worker intermediaries participated in the thefts attributed to Lazarus or TraderTraitor.
Exchange deposit labels raise screening questions
The presence of Bybit, HTX and Binance deposit addresses in the transaction paths does not establish that those exchanges knowingly assisted sanctioned individuals or violated U.S. sanctions.
Exchange deposit addresses can be assigned to customer accounts and may aggregate deposits from numerous external wallets. Public blockchain records generally do not identify the account holder, the exchange’s internal handling of deposits or the information available to its compliance team when a transfer occurred.
The exchange labels help; they only go so far, though.
There is also a timing limitation. The relevant sanctions were imposed on October 28, 2026, while much of the activity documented by SlowMist occurred years earlier. Historical transactions cannot be treated as post-designation sanctions breaches merely because the addresses subsequently appeared on an OFAC list.
The new findings nonetheless provide additional transaction paths that exchanges and blockchain-monitoring providers can examine against their screening records.
Such systems can change how transactions are classified as new information becomes available. DaveFinances previously examined a Bybit customer complaint involving a previously accepted deposit destination that was allegedly classified as high-risk during a later withdrawal attempt. That case is unrelated to the sanctioned network, but illustrates the operational consequences that changing address-risk assessments can have for exchange customers.
SlowMist’s findings also arrive amid continued scrutiny of North Korean operations targeting cryptocurrency businesses. In a separate security investigation, DaveFinances reported how North Korea-linked indicators emerged following Bitget’s September security breach. Attribution in that incident remained preliminary, and the available evidence does not connect it to the wallets examined in the latest MistTrack report.
For the IT-worker network itself, Treasury says participants used false identities and documentation to secure legitimate employment, while intermediaries helped convert and transfer earnings. The department also warned that some workers had exploited corporate access to steal information or deploy malicious software.
The investigation therefore covers more than exchange deposits. Financial institutions face the task of screening counterparties and tracing transaction histories, while employers must independently verify the identities and access privileges of remote workers and contractors.
SlowMist has provided additional address-level evidence linking several individuals named in the sanctions action. Establishing who controlled the corresponding exchange accounts, whether any transactions were flagged internally and how the funds were ultimately used would require records beyond the public blockchain trail.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574