Multiple US citizens plead guilty to helping North Korean IT workers earn $2 million

The Justice Division introduced 5 responsible pleas on Friday associated to North Korea’s long-running IT employee rip-off. Along with the convictions, the DOJ mentioned it was capable of seize greater than $15 million obtained by North Korean facilitators by means of cryptocurrency thefts in 2023. 

In whole, the IT employee schemes affected about 136 U.S. corporations and allowed North Korea to earn $2.2 million, the division mentioned. Greater than 18 U.S. residents had their identities stolen and used as a part of the rip-off.

In three circumstances, U.S. nationals gave North Koreans entry to their very own identities. The opposite two circumstances concerned stolen identities.

Direct assist

U.S. nationals Audricus Phagnasay, 24, Jason Salazar, 30, and Alexander Paul Travis, 34, pleaded responsible to wire fraud conspiracy after offering their identities to North Korean employees and permitting them for use to acquire jobs at U.S. corporations. 

From roughly September 2019 by means of November 2022, the three additionally hosted firm laptops at their properties, put in distant entry instruments and allowed the IT employees to make it seem like they had been working throughout the U.S.  

The DOJ famous that the three did a number of different issues to assist get the North Koreans by means of firm vetting processes. Travis and Salazar even went as far as to take drug exams on behalf of the North Korean employees as a part of the employment course of. 

Travis was an active-duty member of the U.S. Military on the time of the scheme and was paid $51,397 for his function. Phagnasay and Salazar earned at the least $3,450 and $4,500, respectively. 

The North Korean employees used the three identities to earn $1.28 million in salaries, the Justice Division mentioned. 

Stealing and laundering 

Ukrainian nationwide Oleksandr Didenko pleaded responsible to wire fraud and id theft expenses, the division mentioned, after prosecutors accused him of stealing a number of U.S. citizen identities and promoting them to North Korean facilitators. 

The identities had been used to acquire jobs at 40 U.S. corporations. As a part of the plea deal, Didenko forfeited $1.4 million he earned from the scheme. Didenko was arrested in Poland final 12 months and was extradited in December 2024. 

The DOJ beforehand mentioned it additionally raided 4 U.S. residences managed by Didenko the place he ran laptop computer farms. He was charged final 12 months alongside ​​U.S. nationwide named Christina Chapman — who was given an 8.5-year sentence for operating a laptop computer farm in Arizona that facilitated the North Korean scheme. 

One other U.S. nationwide, Erick Ntekereze Prince, additionally pleaded responsible to wire fraud conspiracy after utilizing his firm to launder the identities of a number of North Korean employees. 

From June 2020 to August 2024, Prince’s Taggcar Inc. was used as an IT contractor, hiring out employees to U.S. corporations. The North Koreans working for the corporate used stolen or pretend identities.

Prince additionally ran a laptop computer farm in Florida the place he maintained company-provided laptops and allowed the North Korean IT employees to work remotely. He earned about $89,000 from the scheme. 

Prince was charged in January alongside one other U.S. nationwide, Emanuel Ashtor, and Mexican nationwide Pedro Ernesto Alonso de los Reyes. 

In whole, the three helped North Korean IT employees achieve employment at 64 U.S. corporations and earn almost $1 million in wage funds. Ashtor is awaiting trial and de los Reyes is in custody in The Netherlands awaiting extradition.

$15 million forfeited

The plea offers had been introduced alongside forfeiture complaints for greater than $15 million in stolen funds. 

The Justice Division mentioned the FBI seized cryptocurrency managed by the North Korean authorities’s APT38 hacking group — identified by many researchers as Lazarus or TraderTraitor.

The complaints say elements of the seized cryptocurrency was traced again to 4 separate incidents:

A July 2023 theft of $37 million from Estonia-based cryptoplatform CoinsPaid.A $100 million theft from an unidentified Panama-based crypto supplier in July 2023.A November 2023 theft of $138 million from a Panama-based digital forex alternate.A November 2023 incident involving $107 million in stolen crypto from a Seychelles-based alternate.

The FBI attributed a number of high-profile cryptocurrency thefts to North Korea in 2023, together with a $100 million hack of Atomic Pockets on June 2, a June 22 assault during which cybercriminals stole $60 million from Alphapo and the $100 million hack of Concord’s Horizon bridge.

The DOJ mentioned it’s nonetheless working to hint and seize the stolen cryptocurrency however famous that North Korea has continued to launder the funds by means of a number of exchanges, mixers and different instruments. 

“FBI investigations proceed to reveal the North Korean authorities’s relentless marketing campaign to evade U.S. sanctions and generate hundreds of thousands of {dollars} to fund its authoritarian regime and weapons packages,” mentioned Roman Rozhavsky, assistant director of the FBI’s Counterintelligence Division.

Be taught extra.