DOJ: North Korean Hackers Infiltrated 70 U.S. Firms, Stole $3 Million

By Daniel Okafor

Federal prosecutors say North Korean IT workers infiltrated at least 70 U.S. companies and generated roughly $3 million in stolen funds. On Tuesday, the Justice Department announced indictments, arrests, and raids on more than 40 "laptop farms" across Texas — the largest number of such sites ever disclosed.

The scheme works through hiring. North Korean operatives use stolen identities of U.S. citizens to apply for jobs at American firms. The companies, believing they have hired a legitimate remote employee, ship a work laptop to a U.S. address. In reality, that address belongs to an American facilitator. The laptop lands on a farm. The hacker in North Korea connects to it remotely and works from inside the corporate network.

The DOJ said federal authorities seized over 180 computers tied to this pipeline. The machines were owned by at least two American facilitators operating across dozens of homes and residences in Texas.

What does the enforcement action change?

The raids mark the latest wave of U.S. action against North Korean revenue operations. Prosecutors have indicted and arrested at least two people. They did not name the 70 victim companies, but described them as operating in healthcare, cyber support, retail, communications, and manufacturing — spread across Ohio and 16 other states, plus the District of Columbia.

CrowdStrike, which helped the FBI investigate and disrupt the operations, said the laptop farms are "vital" to North Korea. They solve a basic problem: a hacker who cannot set foot in the United States still needs a machine that physically resides there. The farms bridge that gap, and CrowdStrike says they help the hackers overcome the physical, financial, and legal challenges of operating from abroad.

"Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals," the Justice Department said.

How do the hackers get hired?

Cover identities matter more than malware here. According to the DOJ, the operatives rely on real-looking email addresses, spoofed LinkedIn profiles, and extensive online and social media accounts. The human lies in the application, not in the code.

Once inside, the workers draw a wage, steal sensitive data and intellectual property, and in some cases extort the victim company for further payments, the DOJ said.

How big is the threat?

Bigger than this case. In a separate public service announcement, the FBI said "thousands" of North Korean state-controlled IT workers are employed at Western companies, and that they "pose a significant national security and intellectual property theft insider threat."

The IT-worker scheme is one strand of a broader revenue operation. The regime also hacks crypto exchanges and open-source developer projects. The goal, according to prosecutors, is funding its internationally sanctioned nuclear weapons program. North Korea is thought to have stolen at least $2 billion in crypto during 2025 alone.

Experts on North Korea believe the true number of hacked companies and the real amount of stolen crypto run well above the reported figures.

There is a scale signal in CrowdStrike's own data. In a separate report earlier this year, the company said North Korean hackers were behind roughly half of all documented "hands-on-keyboard" intrusions over the past year — meaning hacks carried out by humans rather than automated tools or AI.

For employers, the takeaway from Tuesday's action is concrete: verify who is physically holding the hardware you ship. The FBI's estimate of thousands of planted workers suggests the 70 infiltrated companies are a floor, not a ceiling, and Tuesday's indictments signal that the facilitators who run the farms now face the same federal exposure as the hackers they serve.