• A state cut off from financial markets : under international sanctions, North Korea looks for other sources of foreign currency.
• The workaround : landing remote jobs in the United States using stolen identities.
• The outcome : more than $17.1 million in salaries obtained fraudulently.

Swipe through the visuals →

• Steps 1 and 2: fake identity and getting hired : profiles are built from real American identities, then used to get hired remotely by companies.
• Step 3: collecting the salaries : salaries are paid into accounts opened under the stolen identities; the laptop farm receives the computers shipped by employers and simulates activity from inside the United States.
• Step 4: moving the money to Pyongyang : transfers to accounts abroad, likely use of cryptocurrencies, and finally funds routed to North Korea.

Swipe through the visuals →

• Real identities: valid social security numbers and existing addresses.
• Salaries paid through legitimate US banking channels, by standard payroll transfers.
• A single worker can hold several jobs at once under different identities.
• The laptop farm creates the illusion of a physical presence on US soil.

This is not classic money laundering : it is sanctions evasion disguised as an ordinary employment relationship.

Swipe through the visuals →