DOJ Announces Coordinated Actions in 16 States Against North Korean Remote IT Worker Revenue Schemes
On June 30, 2025, the Justice Department in Washington announced coordinated actions across 16 states against the North Korean government’s schemes to fund its regime through remote information technology work for U.S. companies. The actions include two indictments, an arrest, searches of 29 known or suspected “laptop farms,” and the seizure of 29 financial accounts used to launder illicit funds, 21 fraudulent websites, and approximately 200 computers.
According to the Department, North Korean individuals used stolen and fake identities to pose as U.S. residents and obtain remote IT jobs at more than 100 U.S. companies, assisted by individuals in the United States, China, the United Arab Emirates, and Taiwan. Once employed, the workers received regular salary payments that were funneled to the North Korean regime, and in some cases they stole sensitive employer information, including export-controlled U.S. military technology and virtual currency. In one scheme, North Korean IT workers stole virtual currency worth more than $900,000 from an Atlanta, Georgia-based blockchain research and development company.
In a five-count indictment in the District of Massachusetts, U.S. national Zhenxing “Danny” Wang of New Jersey was arrested. The indictment describes a multiyear scheme that generated more than $5 million in revenue. Also charged are Chinese nationals Jing Bin Huang, Baoyu Zhou, Tong Yuze, Yongzhe Xu, Ziyou Yuan, and Zhenbang Zhou, and Taiwanese nationals Mengting Liu and Enchia Liu. A second U.S. national, Kejia “Tony” Wang, agreed to plead guilty. From about 2021 to October 2024, the conspirators allegedly compromised the identities of more than 80 U.S. persons to obtain jobs at more than 100 companies, causing at least $3 million in legal, remediation, and other losses. U.S. facilitators hosted company laptops at their homes, enabled remote access through keyboard-video-mouse switches, and created shell companies such as Hopana Tech LLC, receiving at least $696,000 in total. An overseas co-conspirator also accessed a California defense contractor’s files and stole technical data controlled under the International Traffic in Arms Regulations. The FBI and the Defense Criminal Investigative Service seized 17 web domains and 29 financial accounts.
In a second indictment unsealed in the Northern District of Georgia, four North Korean nationals, Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il, were charged with stealing virtual currency valued at more than $900,000 from two companies and laundering the proceeds. Working as a co-located team in the United Arab Emirates, two of them were hired by the Atlanta blockchain company and a Serbian virtual token company and, in February and March 2022, stole about $175,000 and about $740,000 in virtual currency, laundering the funds through the mixer Tornado Cash. The four remain at large.
Between June 10 and 17, 2025, the FBI also searched 21 premises across 14 states hosting laptop farms, seizing approximately 137 laptops. “These schemes target and steal from U.S. companies and are designed to evade sanctions and fund the North Korean regime’s illicit programs, including its weapons programs,” said Assistant Attorney General John A. Eisenberg of the National Security Division. The State Department has offered rewards of up to $5 million for information helping disrupt North Korea’s illicit financial activities. The Department said the actions are part of its DPRK RevGen: Domestic Enabler Initiative. The charges are merely allegations, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.
(Source: U.S. Department of Justice)
Source: U.S. Department of Justice
Published by GSM · USA (original Chinese edition)
Photo: 图：位于华盛顿的联邦调查局总部 J. Edgar Hoover Building 南侧外景，联邦调查局是本轮全国协同行动的主要执行机构之一。Tim Evanson 摄，CC BY-SA 2.0，经 Wikimedia Commons。 / Photo: The south side of the J. Edgar Hoover Building in Washington, headquarters of the FBI, one of the lead agencies in the nationwide actions. Photo by Tim Evanson, CC BY-SA 2.0, via Wikimedia Commons.
