Federal prosecutors have charged two U.S. men in an alleged scheme that placed North Korean information technology workers inside American companies using stolen identities and routed roughly $3 million in wages through cryptocurrency channels. The arrests expose a simple, repeatable method that other businesses can now learn to interrupt before a recruiter, a contractor, or a payment ledger turns into a national security problem.
What the indictment alleges
The U.S. Department of Justice announced an indictment filed in the Northern District of Ohio charging two American men with conspiracy to commit wire and mail fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft. Prosecutors say the defendants helped overseas IT workers obtain remote positions at U.S. companies using stolen identities, then moved the resulting wages through cryptocurrency transfers. An Ohio resident is named in the indictment as a co-conspirator but is not charged in this filing.
The criminal complaint focuses on a network pattern rather than a single transaction. Stolen identities give foreign workers a clean U.S. presence, remote access gives them a foothold inside the employer’s network, and cryptocurrency provides a payment rail that is hard for traditional banks to trace. Together, those three steps convert a routine hiring decision into a money pipeline tied to a foreign weapons program.
Why a laptop farm matters in this case
A “laptop farm” is the on-shore half of the operation. Devices are set up inside the United States, often inside the home of a recruited facilitator, and are remotely controlled from overseas. U.S. companies see a worker logging in from an American IP address, passing identity checks, and producing deliverables on schedule. The company never meets the real operator in person.
Earlier federal prosecutions have produced prison terms for domestic facilitators who ran these farms. Two individuals were each sentenced to 18 months after being convicted for running or managing laptop farms used in the fraudulent scheme. In one of those cases, employers paid more than $250,000 to workers tied to the laptop farm and absorbed more than $500,000 in audit and system repair costs, according to prosecutors.
Crypto transfers and the payment trail
The indictment specifically cites cryptocurrency transfers as part of the alleged payment network used to move funds tied to the scheme. A U.S. District Judge issued a Sept. 3 ruling covering funds in a wallet beginning with the characters “0x81c4,” illustrating how on-chain transactions leave a record that prosecutors can later freeze.
The same enforcement pattern has produced large seizures elsewhere. Federal authorities have frozen and seized more than $580 million in cryptocurrency tied to Southeast Asian scam networks, in a separate action that shows how broadly the U.S. government is willing to pursue cross-border crypto fraud.
Texas searches and the FBI warning to employers
The Northern District of Texas U.S. Attorney’s Office announced that searches in Texas resulted in the seizure of devices tied to the investigation. The seizure effort is part of a broader push to dismantle the support infrastructure that lets overseas workers operate as if they were sitting in an American home office.
The FBI has separately issued a warning to employers about the tactics used by North Korean IT workers. The bureau advised companies to verify employee identities through multiple channels and to watch for behavioral signs that a remote worker may be tied to a laptop farm. The commonly cited warning signs are:
- Reluctance or refusal to appear on a live video call.
- Inconsistent work hours that do not match the claimed location.
- The use of multiple identities across different employers.
- Requests to install remote-access software, ship hardware, or route work through an unfamiliar intermediary.
How the scheme has grown in scale and sophistication
This is not the first case of its kind, and the scope has widened each year. Federal authorities have previously described operations in which North Korean IT workers infiltrated more than 100 U.S. companies using fake identities and siphoned millions to fund weapons programs through remote IT jobs.
Recruitment tactics have also evolved. Foreign actors are now documented as using AI deepfakes to fraudulently obtain U.S. remote jobs, allowing them to pass video interviews while the real operator sits overseas. Targets have included defense contractors, Fortune 500 companies, and media networks.
Beyond hiring fraud, separate North Korean-linked hackers have stolen billions in cryptocurrency through digital heists that exploit the same remote-trust vulnerabilities. The U.S. Department of the Treasury has responded with sanctions against eight individuals and two entities accused of laundering stolen cryptocurrency to finance North Korean nuclear and missile programs.
Geographically, the threat has expanded into Europe. Google’s Threat Intelligence Group has reported that operatives have shifted focus to European targets, using fake identities to infiltrate blockchain firms and funnel profits to the country’s nuclear program.
What companies can do to close the gap
The playbook mirrors the steps the FBI has outlined in its warning.
Verify identity through more than one channel
Compare the face on a video call against the government ID submitted at hire. Use a live, unrecorded video check rather than a prerecorded clip, since AI deepfakes can defeat static verification.
Match claimed geography to network signals
Confirm that login IP addresses, time-zone activity, and device fingerprints match the worker’s stated location throughout the engagement, not just on the first day of work.
Audit who controls the hardware
Require company-issued laptops with managed endpoint software, and refuse requests to install third-party remote-access tools or to route work through personal devices. The laptop-farm model depends on a U.S.-based machine that an overseas operator can control; closing that loophole removes the farm’s value.
Watch payment and reimbursement patterns
Flag any contractor who requests payment in cryptocurrency, asks to split invoices across multiple accounts, or reroutes payroll to a new bank or wallet after onboarding.
Where the case stands now
The criminal case is pending in the Northern District of Ohio, and the Texas device seizures are part of the same investigative effort. The two men named in the indictment face a federal conspiracy case that will move at the pace of an Ohio federal docket. A separate co-conspirator identified in the filing has not been charged in this indictment.
Prosecutions lead to FBI warnings, seizures inform guidance employers are urged to follow, and sanctions designations reduce the financial channels available to overseas operators.
FAQ
What did the DOJ charge the two Americans with in the North Korean IT worker case?
The DOJ charged two U.S. men in an indictment filed in the Northern District of Ohio with conspiracy to commit wire and mail fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft, tied to an alleged $3 million scheme to place North Korean IT workers at U.S. companies using stolen identities and cryptocurrency payments.
How much money was involved in the alleged North Korean laptop farm scheme?
The indictment describes an alleged $3 million scheme. Prosecutors also cite prior laptop-farm prosecutions in which employers paid more than $250,000 to fraudulent workers and incurred more than $500,000 in audit and repair costs.
What warning signs does the FBI give about North Korean IT worker laptop farms?
The FBI has told employers to verify worker identities through multiple channels and to watch for reluctance to appear on video, inconsistent work hours, and the use of multiple identities across different employers. Requests to install unfamiliar remote-access software or to ship hardware to a personal address are also common red flags.