The DPRK is recruiting IT workers from Iran, Lebanon, and other countries to secure jobs at US firms for $500/month in crypto, with North Korean operatives taking over after hiring.
Crypto Security & Cybercrime News
North Korea has found a way around stricter job screening at US companies: pay someone in another country to pass the interview first. NBC reported on Sept. 12 that the Democratic People's Republic of Korea (DPRK) has been recruiting remote IT workers from third countries, including Iran and Lebanon, to secure contract positions at US firms. Once a position is obtained, North Korean operatives take it over.
NBC reported that these recruits were sourced on LinkedIn. Some were offered $500 per month in cryptocurrency to work part-time as interview stand-ins. The tactic is a direct response to tightening countermeasures from the US and its allies. Those measures had made it harder for North Koreans to obtain jobs by applying directly.
A joint government alert dated July 31, 2026, described the broader scheme in detail. It was signed by agencies from the US, Japan, South Korea, the UK, Australia, Canada, Germany, France, the Netherlands, New Zealand and several other countries. The alert warned that North Korean IT workers were using increasingly sophisticated methods, including AI, to hide their identities and expand their global reach.
Forged IDs, Laptop Farms, and Crypto Payments
The July 2026 alert described the specific methods North Korean IT workers use to obtain and hold contracts. They forge identity documents and use third-party proxies to create accounts on employment platforms. In some cases, they arrange in-person contact to build trust with hiring managers. Once employed, they avoid direct deposit. They request payment through money transfer services or cryptocurrency, routing funds through third-party bank accounts before sending earnings to North Korean agencies.
The alert also flagged "laptop farms" operating inside the US. Company-provided devices are delivered to US addresses, then remotely accessed by workers overseas. Those workers hide their real locations using VPNs and remote desktop software. Many operate in teams. The person a hiring manager communicates with may change depending on the time of day.
North Korean IT workers are known to reside in North Korea, China, Russia, Southeast Asia and Africa. Beyond standard software development work, including web pages, mobile apps, and blockchain applications, some generate foreign currency through automated trading systems they build themselves. The alert noted that contracting with North Korean IT workers may violate domestic laws in the US, Japan, South Korea, and many other countries, and could result in financial penalties.
Related Article: Web3 Lost $464.5M to Hacks in Q1 2026, Reports Hacken
$2B in Crypto Losses as North Korea's GDP Grows
The financial stakes behind these schemes are large. Cybersecurity firm CrowdStrike, cited by Cointelegraph in May 2026, attributed more than $2 billion in crypto losses in 2025 to North Korean state-affiliated hackers and threat actors. That figure represented a 51% increase compared to 2024. Despite global sanctions, the Bank of Korea estimated North Korea's GDP grew 3.5% in 2025.
The Financial Action Task Force (FATF) lists North Korea as a high-risk jurisdiction subject to a call for action. UN Security Council Resolution 2397 requires all member states to repatriate North Korean nationals earning income in their jurisdictions. The July 2026 alert urged companies operating online employment platforms to strengthen identity verification, require in-person interviews where possible, and flag accounts that request payment in cryptocurrency, show frequent changes to registered information, or have payment details that do not match the account holder's name.
This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.
