Federal authorities searched more than 40 suspected “laptop farms” in Texas and seized over 180 computers in an investigation into North Koreans posing as U.S.-based remote workers. Prosecutors announced on Tuesday that at least two people had been arrested and indicted. They also said hackers had breached at least 70 companies based in the United States.
According to the Justice Department, American companies sent the computers to new hires, unaware that the employees were sanctioned North Korean spies using stolen identities of U.S. citizens to secure jobs. The North Koreans allegedly used the machines to access U.S. companies remotely and steal sensitive data.
The DOJ said the searches covered the largest disclosed number of homes and residences used to support North Korean hacking. At least two American facilitators owned the laptop farms, which let companies’ computers remain in the United States while workers used them from elsewhere.
The Justice Department did not identify the affected companies. It said they worked in healthcare, cyber support, retail, communications, and manufacturing, and were located in Ohio and 16 other states, including the District of Columbia. Prosecutors estimate the hackers obtained around $3 million in stolen funds.
“Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals,” the Justice Department said.
North Korean hackers commonly rely on convincing email addresses, fake LinkedIn profiles, and large collections of online and social media accounts to maintain cover identities. In a separate public service announcement, the FBI said “thousands” of North Korean-state-controlled IT workers are employed by Western companies, creating what it called “a significant national security and intellectual property theft insider threat.”
The arrests, indictments, and searches add to enforcement actions against North Korean activity in the United States in recent years. Through the remote-worker scheme, North Koreans obtain jobs and wages at U.S. and European companies, then steal sensitive information and intellectual property while employed. The companies they target are subsequently extorted for additional payments.
The scheme is among the North Korean regime’s illicit revenue sources, which are intended to fund its internationally sanctioned nuclear weapons program. Other efforts include hacking cryptocurrency exchanges and open-source developer projects. The regime is believed to have stolen at least $2 billion in cryptocurrency during 2025 alone.
Experts on North Korea believe the number of companies hacked and the amount of cryptocurrency taken are probably far greater than reported. In a separate report earlier this year, CrowdStrike said North Korean hackers carried out around half of all documented “hands-on-keyboard” intrusions over the past year. The term describes attacks conducted by people, rather than automated tools or AI.
