Four North Korean Nationals Charged After Stealing Crypto and Accessing Sensitive Data by Masquerading as Legit IT Workers

North Korean IT Worker Scheme Targets US Companies With Fake Identities and Crypto Theft

A complex fraud operation involving North Korean nationals has exploited remote IT jobs at American and international blockchain firms, stealing nearly $1 million in cryptocurrency and exposing sensitive company data.

The US Department of Justice (DOJ) revealed new charges against four North Korean suspects accused of posing as remote IT workers, using stolen and fake identities to infiltrate companies in the US and Serbia.

How Did North Koreans Gain Access to US Companies

Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il operated covertly, initially from the UAE in 2019, before securing remote IT positions at an Atlanta blockchain startup and a Serbian virtual token firm.

To hide their true nationality, they used falsified documents and stolen IDs, a method described by US Attorney Theodore S. Hertzberg as a “unique threat” to businesses that hire remote IT contractors without thorough verification.

Once inside these companies, the defendants abused their privileged access: Jong siphoned around $175,000 in cryptocurrency in early 2022, while Kim exploited smart contract source code to steal roughly $740,000 the following month.

The stolen funds were laundered using mixers and routed through exchange accounts created with fake Malaysian IDs, authorities said.

A Widespread Network of Facilitators in the US and Asia

The operation extended beyond the North Korean nationals.

US citizens Zhenxing “Danny” Wang and Kejia Wang, both from New Jersey, were indicted for helping the North Koreans by managing “laptop farms” — setups where devices belonging to legitimate US companies were housed, allowing overseas workers to appear as if they were working stateside.

The facilitators created shell companies, fake websites, and financial accounts to legitimise the scheme and funnel payments overseas.

According to the DOJ, the Wang duo and four other US residents earned nearly $700,000 in fees while assisting the operation, which also involved several Chinese and Taiwanese nationals.

This group helped compromise the identities of over 80 US citizens, enabling North Koreans to work at more than 100 American companies, including some Fortune 500 firms.

The resulting legal fees and remediation have cost victims at least $3 million.

Sensitive Data Exposure Raises National Security Concerns

Beyond theft, the North Korean workers accessed sensitive employer data and source code, including materials restricted under International Traffic in Arms Regulations (ITAR).

One notable target was a California-based defence contractor developing AI-powered military technology.

The DOJ highlighted that an active-duty US military member with a Secret security clearance was involved in facilitating the operation, revealing the broad national security risks.

In response, authorities have conducted multiple raids across the country, seizing laptops, servers, websites, and financial accounts linked to the scheme.

In October 2024 alone, searches at eight sites in three states uncovered more than 70 devices, with additional raids in mid-2025 resulting in the confiscation of nearly 150 laptops from “laptop farms” in 14 states.

What Are Laptop Farms and Why Do They Matter

Laptop farms are physical locations where laptops owned by US companies are kept and remotely accessed by overseas workers.

This setup enables North Koreans to bypass geographic restrictions and appear as legitimate US employees.

FBI Assistant Director Roman Rozhavsky warned that hosting such farms may unintentionally aid North Korea’s illicit schemes and urged companies to scrutinise their remote workforce carefully.

How the DOJ Is Fighting Back Against the North Korean IT Threat

The DOJ’s Domestic Enabler Initiative focuses on disrupting these revenue streams that support North Korea’s sanctioned weapons programmes.

The recent coordinated crackdown includes three indictments, one arrest, and the shutdown of 21 websites connected to the fraud network.

Zhenxing Wang faces five criminal counts after being apprehended in New Jersey, while others remain at large.

Roman Rozhavsky said,

“The FBI will do everything in our power to defend the homeland and protect Americans from being victimised by the North Korean government.”

The DOJ also emphasises that investigations are ongoing and further enforcement actions are expected.

Are Remote Work Policies Creating New National Security Risks

This case raises pressing questions about the vulnerabilities of remote work models, especially when access to sensitive data and systems crosses borders.

The balance between flexible hiring and national security appears increasingly fragile as bad actors exploit identity theft and technology loopholes.

As companies expand remote teams globally, the challenge remains: how to prevent malicious foreign interference without stifling the benefits of remote talent?