14 charged in North Korea laptop farm scheme that placed fake IT workers at 70 US companies

Federal prosecutors have charged 14 people with running a scheme that allegedly placed North Korean IT workers in remote jobs at more than 70 US companies and sent about $3 million in revenue to sanctioned entities controlled by Pyongyang.

The US Attorney’s Office for the Northern District of Ohio unsealed a 58-page indictment returned by a federal grand jury on Oct. 1, 2026. The defendants are a mix of US citizens and Chinese nationals. They face charges of wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft.

How the “laptop farm” scheme allegedly worked

According to the indictment, US-based facilitators helped workers acting for the Democratic People’s Republic of Korea (DPRK) get hired as remote IT staff. The facilitators allegedly received laptops issued by the victim companies and hosted them at their own homes, so the workers appeared to be logging in from inside the United States. Investigators call these setups “laptop farms.”

Victims spanned health care, communications, cyber support, retail and manufacturing, across more than a dozen states and Washington, DC.

Who has been charged

Two defendants, Michael James Bostelle, 31, of Philadelphia, and Juan Cecilio Pena Carrillo, 37, of San Juan, Texas, were recently arrested. Both are expected to make initial court appearances in Ohio. The other named defendants, based mostly in China, remain at large, and two further defendants remain under seal.

“Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation’s economic strength,” US Attorney David M. Toepfer said in the announcement.

An indictment is only a charge, not evidence of guilt. The defendants are entitled to a fair trial.

The FBI’s warning to employers

Alongside the indictment, the FBI issued an alert to the business community. It says North Korean IT workers are increasingly recruiting American facilitators to get around improved private-sector detection and law enforcement action. In some cases, the workers are subcontracting entire jobs to third-party foreign nationals.

Why crypto and tech firms should pay attention

The indictment does not mention crypto. But the tactic of using fake identities and remote hiring to get inside companies sits alongside the North Korea-linked fake recruiter and deepfake video call campaigns The Bit Gazette has previously reported on: Lazarus fake recruiter story and deepfake video call story. Crypto firms hire remote developers at scale and hold high-value systems, which makes them an obvious target for any of these methods.

For hiring teams, the FBI’s alert is the practical takeaway: read the FBI alert.