North Korean IT Workers and Crypto Laundering: How the Scheme Works

Imagine hiring a brilliant remote developer who undercuts every other bid by 30%, passes a technical test with flying colors, and agrees to start immediately without a signed contract. It sounds like a dream for any startup founder, but it's actually a common entry point for a state-sponsored operation. North Korean IT workers is a sophisticated network of overseas professionals deployed by the Democratic People's Republic of Korea (DPRK) to generate foreign currency through fraudulent employment. These operatives aren't just freelancers; they are agents of a regime using crypto laundering schemes to bypass UN sanctions and fund weapons of mass destruction (WMD).

The Mechanics of the Infiltration

The process starts with a carefully crafted lie. Operatives don't just apply for jobs; they build entire digital personas. They use Virtual Private Networks (VPNs) to hide their location and forged identity documents to pass basic background checks. To beat the modern video interview, they've started using AI-powered deepfake software to mimic the face and voice of a person living in a Western country.

Once they get their foot in the door, they usually target roles in software development or cybersecurity. They are often deployed via facilitators like the Chinyong Information Technology Cooperation Company, which was sanctioned by the U.S. Treasury in July 2025. By offering to work for significantly lower rates-often 20-30% below the market average-they make themselves an irresistible choice for companies looking to cut costs.

How the Money is Laundered

The real magic, or rather the crime, happens during payroll. These workers almost always insist on being paid in Stablecoins is cryptocurrencies pegged to a stable asset like the US Dollar to avoid volatility. Specifically, they request USDC or USDT (Tether). Why? Because these coins are incredibly easy to move and highly compatible with over-the-counter (OTC) traders who can swap digital assets for hard cash (fiat currency).

On-chain data shows a predictable pattern: regular payments of around $5,000 hitting wallets on a monthly basis. But the money doesn't stay in one place. It moves through a fragmented web of wallets, bouncing between dozens of addresses to break the trail. Eventually, these funds are consolidated and sent to senior operatives, such as the sanctioned individuals Kim Sang Man and Sim Hyon Sop.

The Role of Global Infrastructure

This isn't just a North Korean problem; it's a global logistics operation. To hide the money trail, the regime relies heavily on infrastructure in Russia and the UAE. They use fake documentation and IP addresses from these regions to make the transactions look like legitimate business dealings. In some cases, they use fictitious accounts on mainstream exchanges or rely on specialized money launderers, like the facilitator known as "Lu," who was sanctioned by the U.S. in late 2024.

The scale is staggering. Between January and September 2025, these operations generated at least $1.65 billion. While they make a steady living from salaries, they also use their insider access to pull off massive hits. For instance, a single $1.4 billion heist from the Bybit exchange occurred in February 2025, proving that these "employees" are often Trojan horses for larger cyber-attacks.

Real-World Impact on Businesses

For a company, the damage goes beyond the lost salary. One tech startup reported losing $280,000 over six months to a worker who used AI deepfakes during video calls. The pattern is usually the same: the worker performs well for 3 to 6 months to build trust, and then they either steal sensitive company data, plant a backdoor for future hacks, or disappear entirely after a large payment.

According to the Canadian Anti-Fraud Centre, the average loss per incident is about $47,000. In nearly 80% of these cases, the payment was made via cryptocurrency, making the funds almost impossible to recover once they hit the blockchain.

How to Spot and Stop Fraudulent Hires

If you're hiring remotely, you need a protocol that goes beyond a simple Zoom call. Standard background checks aren't enough when 92% of these fraudulent applications use forged credentials. You have to be more aggressive with verification.

First, stop paying remote contractors in cryptocurrency. This is the biggest red flag. If a candidate insists on USDC or USDT and refuses traditional bank transfers, be extremely cautious. Second, use "multi-modal" verification. This means conducting a video interview while simultaneously communicating via a different platform. Operatives often struggle to maintain a consistent AI deepfake response across two different streams of communication.

• Verify degrees directly with the issuing university, not via a provided PDF.
• Check for inconsistencies in their professional history-look for gaps that don't make sense.
• Be wary of candidates who bid 20-30% lower than everyone else.
• Demand a signed, legally binding contract before any work begins.

The Future of the Fight

Governments are catching up. The U.S. Treasury's FinCEN is developing a prototype system for 2026 that can identify DPRK-linked wallet clusters with 89% accuracy. When you combine this with improved AI detection tools that can spot deepfakes in real-time, the "easy money" era for these operatives is closing.

However, the regime is adaptable. As blockchain analytics get better, they will likely move toward more obscure privacy coins or more complex layering techniques. The fight is now a race between the AI used to deceive and the AI used to detect. For businesses, the best defense remains a simple rule: if a deal seems too good to be true-especially when it involves crypto payments-it probably is.