Analysis
The Justice Department said Tuesday that North Korean operatives used stolen American identities to land remote IT jobs at more than 70 U.S. companies, funneling fake-worker paychecks back to Pyongyang through a network of at least 40 "laptop farms" discovered across Texas. Prosecutors indicted and arrested at least two people in what TechCrunch reported is the largest such takedown disclosed to date, with FBI agents seizing more than 180 computers that had been shipped to new hires who were never who they claimed to be.
The scheme follows a pattern the FBI and private security firms have warned about for years: North Korean IT workers apply for ordinary remote engineering and support jobs using spoofed LinkedIn profiles and stolen U.S. citizen identities, then either work the job themselves from overseas or subcontract it to a facilitator who runs the laptops domestically. CrowdStrike, which assisted the FBI's investigation, called the laptop farms "vital" infrastructure for the operation and said North Korean IT workers were behind roughly half of all documented hands-on-keyboard intrusions it tracked over the past year.
How the scheme reached 70 companies
Tuesday's indictments span healthcare, cyber support, retail, communications and manufacturing employers across Ohio and 16 other states plus Washington, D.C. The Justice Department did not name any of the affected companies, but prosecutors say the operatives generated roughly $3 million in stolen wages and extorted some victim employers for additional payments after being discovered. Two American facilitators are accused of owning the Texas laptop farms outright, a role security researchers say is becoming more common as North Korean operators increasingly outsource physical presence to paid U.S. accomplices.
The FBI separately warned this week that "thousands" of North Korean state-controlled IT workers remain embedded at Western companies, a figure that dwarfs the 70-company count disclosed Tuesday and that outside researchers believe understates the real scope of stolen funds and compromised networks. Revenue from the scheme is one of several funding streams for North Korea's sanctioned nuclear weapons program, alongside direct cryptocurrency theft that researchers estimate topped $2 billion in 2025 alone.
The counterweight here is scale versus visibility: Tuesday's case is the largest single disclosure, but it is still a fraction of what the FBI itself says is happening, and the Justice Department's unwillingness to name victim companies means the startups and enterprises actually affected have little public signal to act on. Critics of current hiring practices argue the real fix -- stronger identity verification before a laptop ever ships -- remains optional at most companies rather than mandated.
For founders and GPs doing remote hiring at speed, the diligence question is no longer theoretical: does a company verify a new engineer's identity beyond a resume and a video call, and does it control where a company laptop can be activated. Expect identity-verification and background-check vendors to use Tuesday's case in sales pitches in the weeks ahead.
