[Raids on 40 Texas Locations… North Korea’s Secret Money Trail Exposed]

It has come to light that ordinary residential homes in Texas were used as secret operational bases to generate funds for North Korea’s nuclear and missile development programs. As the Federal Bureau of Investigation (FBI) raided over 40 locations to uncover a illicit hiring ring of North Korean IT workers, details were revealed showing how salaries paid by American corporations flowed directly into the Kim regime. Even more alarming is that this operation represents an evolved form of the overseas illegal foreign-currency earning schemes North Korea has cultivated for decades. Despite stringent international sanctions, North Korea is infiltrating U.S. companies to earn capital and actively target proprietary corporate data.

Reuters reported that "the U.S. Department of Justice announced the results of a massive crackdown against a network that facilitated the illegal employment of North Korean IT workers at American firms." The report confirmed that "from September 21 to 25, the FBI searched over 40 residential sites in Texas and seized 187 electronic devices, including laptops and remote control hardware, under an operation named 'Operation Lonestar Roundup' after the state's nickname."

Reuters further detailed that "U.S. authorities arrested two American facilitators and disclosed indictments against 14 individuals in total, including 10 North Korean nationals," adding that "more than 70 U.S. companies were compromised by North Korean IT personnel operating under false identities."

In response, Brett Leatherman, Deputy Assistant Director of the FBI's Cyber Division, warned that "North Korea is sending thousands of state-controlled IT workers to infiltrate companies in the U.S. and allied nations." He emphasized that "every single job obtained through stolen American identities serves as a direct financial pipeline funding North Korea's nuclear and ballistic missile development."

[Posing as Americans to Gain Employment… Corporate Salaries Channeled to North Korea]

According to Reuters, North Korea’s tactics were highly sophisticated. First, workers stole personal identification details, including Social Security Numbers of U.S. citizens, to build fake personas. They then applied for remote software developer roles at American companies using AI-generated resumes and photographs. Upon being hired, they directed companies to ship work-issued laptops to the homes of American facilitators.

These facilitators installed remote access software and hardware devices known as KVMs (Keyboard, Video, and Mouse switches) onto the laptops. Using these setups, North Korean IT workers located overseas operated the laptops housed in American residential homes, effectively posing as employees living and working inside the United States.

Compounding the severity, the American accomplices provided far more than physical addresses; they supplied bank accounts and government-issued IDs, sometimes even standing in for job interviews and identity verification checks. In effect, they completely bypassed the hiring and security verification systems of U.S. enterprises.

Salaries paid by U.S. companies were funneled through the facilitators' bank accounts before being wired to offshore networks in locations such as China. U.S. prosecutors stated that the stolen identities of 25 American citizens were weaponized to place North Korean operatives into more than 70 corporate entities.

[Counterfeit Dollars, Narcotics, Weapon Exports… North Korea’s Foreign Currency Operations Have a Deep History]

North Korea’s illicit foreign currency operations are far from a recent phenomenon. For decades, the regime has leveraged overseas trading networks and diplomatic channels to bypass international sanctions and hard currency shortages. Dating back to the Cold War, North Korean diplomats and affiliated personnel have been caught smuggling narcotics in various countries. In the United States, North Korea’s connection to the distribution of "Supernotes"—highly sophisticated counterfeit $100 bills—was subject to extensive federal investigation. However, distinctions must be drawn regarding how directly the North Korean leadership was proven to command specific individual incidents.

Another major source of foreign capital for North Korea was weapons exportation. North Korea routinely supplied conventional armaments and military technology to countries in the Middle East and Africa, prompting the United Nations Security Council to enact strict embargos prohibiting North Korean arms trade. Additionally, North Korea dispatched overseas laborers to countries like China and Russia, seizing a vast majority of their earned wages. In response, the UN Security Council passed Resolution 2397 in 2017, demanding the repatriation of all North Korean workers abroad. Ultimately, North Korea has adapted its foreign currency strategies from currency counterfeiting, smuggling, arms sales, and overseas labor dispatching to state-sponsored cybercrime and remote IT employment fraud.

[North Korea’s Revenue Stream… Earning Capital Beyond Borders]

North Korea’s foreign currency earnings can be broadly categorized into formal trade, overseas worker remittances, arms transactions, and cyber operations. In formal trade, reliance on China is overwhelmingly dominant. According to data from the Korea Trade-Investment Promotion Agency (KOTRA), North Korea’s merchandise exports stood at approximately $360.44 million in 2024. Due to international sanctions and limited domestic industrial capacity, legitimate trade alone cannot generate adequate foreign reserves.

In cyberspace, however, the dynamic is vastly different. IT workers can receive salaries from U.S. corporations while residing in North Korea or third countries, while state hacking groups can siphon vast assets by targeting foreign cryptocurrency exchanges.

Military cooperation with Russia also serves as a key variable. While the exact compensation provided by Russia in exchange for North Korean weaponry and military personnel remains shrouded, energy supplies, materials, and advanced military technology represent major strategic returns for Pyongyang. Nonetheless, calculating the entirety of estimated arms deals solely as cash income would be inaccurate.

The crucial shift in this evolution is that North Korea can now secure substantial economic gains without physically moving goods across national borders. While the international community monitors ports and traditional financial institutions, North Korea has transformed the internet into a borderless engine for generating foreign capital.

[Over $2 Billion in Crypto Stolen in 2025… North Korea’s New Foreign Currency Industry]

The sheer scale of North Korea’s cyber revenue is evident in its cryptocurrency thefts. Blockchain analytics firm Chainalysis estimated that hackers affiliated with North Korea stole at least $2.02 billion in cryptocurrency in 2025—a 51% increase from the prior year and an all-time record. In particular, a major breach in February 2025 targeting the Dubai-based crypto exchange Bybit, resulting in the theft of roughly $1.5 billion, sent shockwaves through global financial markets.

More critically, North Korea’s remote IT hiring operations and cryptocurrency thefts are becoming interconnected. Chainalysis identified a growing threat vector where North Korean operatives gain employment inside cryptocurrency firms to secure high-level system access credentials, which are subsequently leveraged to execute massive cyber exploits. North Korea now earns corporate salaries from U.S. firms while simultaneously targeting internal intelligence and core administrative access. Fraudulent remote employment thus functions as both a steady revenue stream and an operational bridgehead for large-scale cyberattacks.

[Capturing Laptop Farms Won't End It… North Korea’s Persistent Overseas Networks]

The fundamental challenge is that dismantling laptop farms inside the United States does not destroy North Korea's broader overseas operational apparatus. Since 2025, the U.S. Department of Justice has pursued domestic facilitators assisting North Korean IT workers through a targeted enforcement initiative known as "DPRK RevGen." The recent Texas operation was a direct extension of this effort.

However, North Korean personnel operating out of third nations like China can repeatedly re-infiltrate systems by rotating stolen U.S. identities, banking routes, and remote access setups. Even when domestic accomplices inside the United States are apprehended, detaining the overseas organizers managing the network remains extraordinarily difficult.

Furthermore, the termination of the UN Security Council Sanctions Committee Panel of Experts on North Korea—caused by Russia’s veto in 2024—severely compromised international oversight mechanisms. Although 11 nations, including South Korea, the United States, and Japan, formed the Multilateral Sanctions Monitoring Team (MSMT) to maintain tracking, overall UN-level enforcement oversight has undeniably weakened. Historically, whenever international sanctions intensified, North Korea identified new circumvention routes. This latest breach highlights that these routes now extend directly into everyday American households and corporate recruitment platforms.

[Why Times Insight | The Invisible Financial Pipeline Sustaining Kim Jong-un’s Nuclear Program]

The most critical takeaway from this incident is that the fundamental methodology behind North Korea’s foreign currency acquisition has changed. Where Pyongyang once relied on shipping physical weapons and laborers abroad, it now targets American corporate payrolls and global cryptocurrency reserves over the internet.

System Exploitation: North Korea has evolved beyond merely evading international sanctions; it is actively exploiting the economic infrastructures of the very nations enforcing those sanctions. While the United States tightens financial and trade restrictions to curb North Korea's nuclear ambitions, North Korean operatives infiltrate U.S. companies, converting corporate salaries into funding for nuclear and missile development. It is a paradoxical dynamic where the host economy of the sanctioning nation unintentionally subsidizes the target regime.

Regime Longevity via Cyber: Cyber-based revenues have become an essential mechanism for the long-term survival of the Kim regime. Even as domestic living conditions deteriorate and standard trade remains crippled, the regime can independently harvest foreign currency through cyber operations. Given that a small cadre of skilled operatives can generate immense capital, cyber schemes represent a far more efficient apparatus than legacy labor exports or illicit arms trafficking.

Escalation to National Security Threats: North Korea’s illicit financial operations have crossed the line from economic crime to acute national security threats. When North Korean IT personnel breach internal corporate networks, they gain access to proprietary intellectual property and core infrastructure beyond simple salary payments. Blocking the funding channels for North Korea's nuclear program now requires a unified approach combining financial sanctions, international candidate verification, robust cybersecurity, and anti-money laundering enforcement.

Implications for Allied Markets: This case serves as a stark warning to South Korean corporations and society. The South Korean IT sector, where remote development roles have become standard, is equally vulnerable. The "identity-lending" accomplice model exposed in Texas operates on the same logic as domestic illegal proxy bank accounts and burner phones. For North Korean operatives fluent in Korean and familiar with domestic financial systems, the barrier to entry into the South Korean market may be even lower. Organizations must implement continuous identity verification frameworks that monitor post-hire access patterns and device geography alongside initial hiring checks.

Ultimately, the core issue extends far beyond the 187 laptops seized in Texas. While the international community attempts to tighten sanctions to halt North Korea’s nuclear escalation, the Kim regime is turning vulnerabilities in the global economic system into its newest financial engine for nuclear expansion.