U.S. Sentences ‘Laptop Farmers’ in Crackdown on North Korean IT Infiltration of Crypto Industry

North Korea has long dispatched IT workers overseas to apply remotely for technology jobs using false identities, stolen data belonging to U.S. residents and “laptop farms,” then remit most of their salaries to Pyongyang. Such operations target blockchain and cryptocurrency companies and may also involve planting malware and stealing confidential information. The proceeds are alleged to fund North Korea’s nuclear weapons and ballistic missile programs.

On March 12, 2026, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned six individuals and two entities, saying the network generated nearly $800 million for North Korea in 2024. A Vietnam-based operator converted about $2.5 million in cryptocurrency between mid-2023 and mid-2025. On April 15, the U.S. Justice Department separately announced that two accomplices had been sentenced to 92 and 108 months in prison for helping infiltrate more than 100 companies and generate over $5 million in revenue.

North Korea has long used false identities to place remote IT workers at overseas companies, diverting salaries to state-linked organizations to evade sanctions and finance its nuclear weapons and ballistic missile programs. The campaign is more than employment fraud: once hired, operatives can gain legitimate access to corporate systems, creating an insider threat that includes data exfiltration, theft of sensitive information and cryptocurrency losses.

NBC News reported on Sept. 11 that North Korean teams were recruiting IT workers in Iran, Lebanon and other third countries through LinkedIn to sit interviews under false identities before operatives took over the jobs. Threat-intelligence firm Flare said at least 14 Iranians had joined the operation since 2024 and two received formal offers from US employers. Some part-time “interview associates” were offered $500 a month in cryptocurrency. The US State Department, FBI and agencies from 10 partner countries issued a joint alert on July 31.