The U.S. Treasury sanctioned 11 people on Thursday 29 October 2026 over a North Korean IT worker scheme that moved millions in crypto, Decrypt reported. For anyone holding digital assets, the action is a reminder that laundering routes and the venues tied to them, including the exchange Garantex, sit closer to ordinary crypto flows than most retail investors assume.
What did the U.S. Treasury actually announce on 29 October?
The U.S. Treasury sanctioned 11 individuals connected to a North Korean IT worker scheme that moved millions of dollars in cryptocurrency, Decrypt reported on Thursday 29 October 2026. CoinDesk framed the same action as sanctions on Russian nationals accused of laundering millions in crypto on behalf of those North Korean workers.
Separately, Cointelegraph reported on Thursday 29 October 2026 that blockchain analytics firm Chainalysis traced North Korean crypto cash-outs through Garantex, an exchange already named in earlier enforcement actions. Taken together, three independent newsrooms corroborated the event within roughly 90 minutes of each other.
- Who: 11 people, described by CoinDesk as including Russian nationals.
- What: laundering crypto tied to a North Korean IT worker operation.
- How it was traced: Chainalysis followed cash-outs through Garantex, per Cointelegraph.
What we do not know yet
The exact dollar figure is described only as "millions" across all three reports, with no single confirmed total stated. The specific tokens, wallet addresses and the full list of named individuals are not spelled out in these headlines, so treat any precise number circulating elsewhere as unverified for now.
What is the North Korean IT worker scheme?
The North Korean IT worker scheme refers to operations where workers linked to North Korea take remote technology jobs, often using false or stolen identities, and route their pay into crypto that is then laundered. CoinDesk and Decrypt both tie Thursday's sanctions to exactly this pattern.
For a retail investor, the mechanics matter less than the plumbing. Illicit proceeds need an off-ramp, and Garantex is named by Cointelegraph as one route North Korean actors used to cash out. That is the same infrastructure that touches legitimate trading when funds move between venues.
Does this affect the price of Bitcoin or any coin I hold?
These headlines do not report a price move, and no specific token was named as affected, so there is no confirmed market impact to report yet. Sanctions news of this kind targets people and laundering venues, not the protocols behind major assets like BTC-USD or ETH-USD.
What a holder can do is check exposure rather than guess at a reaction:
- Confirm which coins you actually hold and on which venues they sit.
- Check whether any exchange you use has been named in enforcement actions, now or previously.
- Review how large your crypto allocation is relative to the rest of your portfolio.
If you track both asset classes together, this is simpler. Our guide to tracking stocks and crypto in one app walks through keeping every holding in a single view so you are not logging into five exchanges to answer one question.
Why does an exchange like Garantex matter to ordinary investors?
An exchange named in a laundering trace matters because sanctioned venues can freeze, delist or lose banking access, and anyone with funds parked there can be affected regardless of intent. Cointelegraph's report places Garantex at the center of the North Korean cash-out route.
The practical lesson for retail is counterparty awareness. You do not control what an exchange does with other people's funds, but you do control:
- Where you keep balances: funds on an exchange are exposed to that exchange's legal standing.
- How much you leave on-venue: a trading balance is a counterparty balance.
- Whether you can account for everything: if a venue became inaccessible tomorrow, could you reconstruct your positions?
PortfolioTrackr does not connect to crypto wallets or read a wallet address, so self-custody coins are added by hand, by CSV or from a screenshot. That means your record of what you hold lives independently of any single exchange staying online.
How do I check my crypto exposure and set an alert right now?
Open your portfolio, confirm your crypto positions, and set a price alert on anything you want to watch closely while the story develops. On PortfolioTrackr, every position and every watchlist level is checked once a minute while the market is open, and around the clock for crypto.
A short checklist for today
- List your holdings: every coin, every venue, in one place.
- Set price levels: Target 1, Target 2 and a stop-loss level on a position, or a price above or below on a watchlist entry.
- Pick your channel: email, WhatsApp, Telegram and push alerts are on every plan; SMS is Pro and Lifetime only.
Alerts are price levels only. PortfolioTrackr reports status against your own levels, for example still below target or stop-loss level reached, and it does not give advice or send news, regulatory or sanctions alerts. You will hear within a minute of a level being hit for crypto, which runs around the clock.
If you have not centralized your holdings yet, our comparison of a portfolio tracker versus a spreadsheet explains why manual files tend to drift out of date exactly when you need them most.
How does this compare to other recent crypto enforcement news?
Thursday's sanctions sit alongside a steady run of 2026 regulatory developments that shape where and how crypto trades, each with different implications for a holder.
| Event | Type | What it touches |
|---|---|---|
| Treasury sanctions, 29 Oct 2026 | Enforcement | People and laundering venues |
| Moody's rates RLUSD A2 | Credit rating | A specific stablecoin |
| Ripple OCC trust bank approval | Licensing | Regulated banking rails |
The contrast is useful. A rating or a license changes the standing of a named product, while a sanctions action changes the standing of named people and the venues they used. For context on the ratings side, see our explainer on what a stablecoin rating means and our write-up of Ripple's final OCC approval.
What should I watch next?
Watch for the official Treasury designation details, since the headlines confirm the action but not the full named list, exact amounts or the specific wallets involved. Those specifics usually follow in the formal notice rather than the first reports.
Concretely, over the coming days:
- The confirmed figure: all three outlets say "millions" without a single agreed total.
- Venue consequences: whether any exchange faces new banking, listing or access restrictions.
- Follow-on analytics: whether Chainalysis or others publish more on the cash-out routes through Garantex.
The bottom line
The U.S. Treasury sanctioned 11 people on Thursday 29 October 2026 over a North Korean IT worker scheme that laundered millions in crypto, with Chainalysis tracing cash-outs through Garantex, as reported by Decrypt, CoinDesk and Cointelegraph. No price move and no specific affected token has been confirmed in these reports.
For a retail holder, the useful response is to check your exposure, confirm where your coins sit, and set price alerts on what you want to watch, not to react to a figure that has not been published. Keeping every position in one place, independent of any single exchange, is what lets you answer those questions in minutes rather than hours.
Sources
Frequently asked questions
What did the US Treasury sanction on 29 October 2026?
The U.S. Treasury sanctioned 11 individuals tied to a North Korean IT worker scheme that moved millions of dollars in cryptocurrency, Decrypt reported on Thursday 29 October 2026. CoinDesk described the action as targeting Russian nationals accused of laundering those funds on behalf of North Korean workers.
What is Garantex and why is it in the news?
Garantex is a crypto exchange that Cointelegraph reported on 29 October 2026 was used as a cash-out route for North Korean crypto, as traced by analytics firm Chainalysis. Exchanges named in laundering traces can face banking, listing or access restrictions that affect anyone holding funds there.
Does this sanctions news affect the price of Bitcoin?
These headlines do not report any price move and name no specific affected token, so there is no confirmed market impact yet. Sanctions of this type target people and laundering venues rather than the underlying protocols behind major assets like Bitcoin or Ethereum.
How can I check my crypto exposure after sanctions news?
List every coin you hold and the venue it sits on, then review your crypto allocation against the rest of your portfolio. PortfolioTrackr keeps stocks and crypto in one view and lets you set price alerts checked once a minute while a market is open and around the clock for crypto.
How much was laundered in the North Korean crypto scheme?
The exact figure is not confirmed. Cointelegraph, CoinDesk and Decrypt all describe the laundered amount only as millions of dollars, without a single agreed total. The precise figure, named wallets and full individual list typically appear in the formal Treasury designation that follows initial reports.