DOJ arrests two men over North Korean remote-job scheme as FBI seizes 187 laptops in Texas

The US Department of Justice has arrested two American men accused of helping North Korean IT workers get remote jobs at more than 70 US companies using stolen or fake identities.

Prosecutors allege the scheme generated about $3 million in employment revenue, moved abroad through bank accounts and cryptocurrency. The charges are allegations and have not been proven in court.

IT fraud case reveals alleged $3 million employment scheme

According to the indictment filed in the Northern District of Ohio, the alleged operation relied on a network of overseas IT workers and U.S.-based facilitators. The workers reportedly obtained remote positions using identities belonging to other people or identities created with fraudulent information.

The alleged American facilitators helped make the arrangements appear legitimate. Their activities included receiving employer-issued computers at U.S. residences, configuring equipment for remote access and providing the addresses and financial accounts needed to support the operation.

This arrangement allowed overseas workers to perform assignments on computers physically located in the United States, creating the impression that they were working domestically.

The alleged facilitators also helped collect employment payments and move earnings to overseas recipients.

Prosecutors claim the operation affected more than 70 American employers and involved the misuse of identities belonging to over 25 U.S. individuals.

According to the indictment, the scheme also exposed companies to at least $3 million in additional costs, including legal expenses, network repairs and other losses.

The allegations illustrate how fraudulent remote hiring can create financial and operational exposure for businesses without requiring an immediate breach of their systems.

For crypto companies, where developers and contractors may have access to code repositories, internal platforms and sensitive infrastructure, the consequences could extend beyond payroll fraud.

The defendants have been charged, but the allegations have not been proven in court. Their guilt must be established through the judicial process.

Cryptocurrency transfers emerge as a key investigative lead

A central element of the IT fraud case is the alleged movement of employment earnings through bank accounts and cryptocurrency transactions.

This describes a conversation dated July 8, 2024, in which an alleged co-conspirator, Ohio resident Trey Michael Nolte, discussed using spreadsheets to manage transfers between bank accounts and virtual currencies before sending funds to another individual identified in the filing as Sun Sheng Ming.

Nolte is named as an alleged co-conspirator but was not charged in this particular indictment, according to the report.

The financial arrangements described by prosecutors suggest that investigators are examining how employment income was collected, converted and transferred through different payment channels.

Cryptocurrency’s relevance in the case does not mean that digital assets themselves were responsible for the alleged fraud.

The case also follows a separate U.S. forfeiture proceeding involving stablecoins allegedly connected to North Korean IT worker payments. In September 2026, a federal judge ordered the forfeiture of approximately $212,700 in USDC and USDT.

Prosecutors had sought control of more than $7.74 million in digital assets, but the court granted only part of the request after finding that the remaining property had not been adequately identified in the public notice.

Stablecoins may be designed to maintain a relatively stable value, but their use does not exempt transactions from anti-money-laundering rules or other legal requirements.

IT fraud case expands scrutiny of laptop farms

The DOJ announcement also described an FBI operation conducted between September 21 and September 25 at more than 40 residences in Texas. Authorities seized approximately 187 laptops and keyboard, video and mouse devices allegedly used to operate computers remotely.

The operation, called Operation Lonestar Roundup, targeted suspected laptop farms—locations where computers supplied by employers can be hosted and accessed remotely by people working elsewhere.

Such arrangements can help overseas workers conceal their actual locations while appearing to meet an employer’s domestic hiring requirements.

The investigation involved federal prosecutors in Texas and Ohio, alongside the FBI’s Dallas Field Office and Cyber Division.

U.S. Attorney David M. Toepfer stressed the implications for businesses, describing the charges as “an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”

The warning is particularly relevant to cryptocurrency businesses, which often recruit international software engineers, smart-contract developers and other technical specialists.

A worker hired under a false identity could potentially obtain access to proprietary systems, sensitive customer information or infrastructure used to manage digital assets.

However, companies must balance stronger screening procedures with safeguards against mistakenly excluding legitimate employees or people whose identities have been stolen.

The objective is to detect suspicious patterns through appropriate verification, not to treat every overseas applicant or remote worker as a threat.

The FBI has also warned that some suspected North Korean IT workers recruit Americans to help conceal their identities.

Reported tasks include participating in interviews, appearing on video calls, providing access to professional accounts and keeping employer-issued devices connected at home.

IT fraud case raises compliance questions for crypto investors

The investigation highlights several issues for the wider digital asset industry. First, employment verification is becoming part of cybersecurity risk management.

Where suspicious activity is identified, transaction records, payment instructions and counterparty checks may help establish whether funds are linked to unlawful activity.

The IT fraud case also demonstrates why legal enforcement can involve multiple stages. Investigators may identify payment flows and seize devices, while courts separately assess the evidence required to impose criminal liability or forfeit digital assets.

The DOJ said the defendants are presumed innocent unless and until proven guilty in court. That distinction remains important when assessing the implications of an ongoing investigation.

It also requires careful hiring practices, access controls, transparent payment procedures and effective monitoring of potentially suspicious transactions.

As authorities continue investigating alleged North Korean-linked revenue networks, crypto firms and investors will be watching how enforcement actions affect compliance expectations, the tracing of digital assets and the management of insider risk.