North Korea Widens IT Worker Fraud Scheme, Pays Proxies in Crypto
TREE NEWS reports: North Korea is increasingly recruiting IT personnel from Iran, Lebanon, and other third countries to help its operatives land remote jobs at US companies, with some recruits receiving payment in cryptocurrency. The pattern: overseas proxies pass the interview and secure a contract, then hand the position over to North Korean personnel who perform the work — and collect the salary — from abroad. LinkedIn has emerged as a primary recruitment channel for the scheme.
Why Crypto Is the Payment Rail of Choice
The use of digital assets is not incidental. Crypto allows the network to move value across borders without touching correspondent banking, where sanctions screening and know-your-customer checks are most likely to flag North Korean-linked beneficiaries. Stablecoins in particular offer dollar-denominated settlement with near-instant finality, while privacy coins and chain-hopping through mixers or bridges can obscure the audit trail. For a state that has been repeatedly cut off from SWIFT and dollar clearing, this is a functional workaround, not a novelty.
This also fits a broader pattern. North Korea’s Lazarus Group and affiliated units have financed operations through exchange hacks, ransomware, and now what amounts to payroll fraud — a lower-risk, recurring revenue stream that scales with the number of placements rather than requiring a single high-value exploit.
Implications for Employers and Compliance Teams
- Identity verification is the weak link. Video interviews, take-home tests, and reference checks can all be passed by a competent proxy. Firms hiring remote engineers should assume that a passed interview does not verify the person who will actually do the work.
- Payment monitoring matters. Salary disbursements routed to third-country accounts, or converted to crypto shortly after receipt, are a detectable signal that most payroll systems do not currently look for.
- Regulatory exposure is growing. US sanctions rules prohibit providing services to North Korean nationals, even unknowingly in some contexts, exposing employers to civil and criminal liability.
What to Watch
Expect tighter screening requirements for remote hiring at defense, crypto, and critical-infrastructure firms, plus more aggressive Treasury enforcement against the exchanges and payment processors that touch these flows. The deeper issue is structural: as remote work normalizes and crypto rails mature, the cost of running a deniable, cross-border payroll operation keeps falling. Companies that treat identity verification as a one-time onboarding step rather than a continuous process will remain the easiest targets.
