Four U.S. citizens and one Ukrainian national have pleaded guilty in federal court to participating in a covert scheme that helped North Korean workers illegally secure remote IT jobs with American companies, the U.S. Department of Justice announced Friday. The pleas came alongside two sweeping forfeiture complaints targeting over $15 million in stolen virtual currency from Pyongyang-backed cyber operations, including funds seized by the FBI earlier this year.

According to prosecutors, the operation functioned like a shadow pipeline—North Korean workers masqueraded as U.S.-based tech professionals using stolen identities, while the illicit earnings helped bankroll the regime’s weapons programs in defiance of international sanctions.

“These actions demonstrate the department’s comprehensive approach to disrupting North Korean efforts to finance their weapons program on the backs of Americans,” Assistant Attorney General John A. Eisenberg said.

How the Fraud Worked

Stolen Identities, Hosted Laptops, and Faked Locations

Court filings show that the U.S.- and Ukraine-based facilitators provided their own identities—or those stolen from innocent Americans—to North Korean operatives applying for remote jobs. They also hosted company-issued laptops at their homes across the United States, creating the illusion that the IT workers were operating domestically.

The DOJ says the scheme targeted 136 U.S. companies, generated roughly $2.2 million for the DPRK, and compromised the identities of more than 18 U.S. individuals.

A 2022 advisory from the FBI, Treasury, and State Department previously warned that North Korean IT workers can earn up to $300,000 annually, collectively funneling hundreds of millions into programs run by the DPRK Ministry of Defense.

Guilty Pleas Across Multiple Districts

Georgia Defendants Faked Drug Tests, Hosted Equipment

In the Southern District of Georgia, Audricus Phagnasay, 24; Jason Salazar, 30; and Alexander Paul Travis, 34, pleaded guilty Thursday to conspiracy to commit wire fraud. Between 2019 and 2022, the trio supplied their American identities to overseas IT workers, hosted corporate laptops, and installed unauthorized remote-access tools.

Travis—then an active-duty U.S. Army member—and Salazar even appeared for drug tests on behalf of the North Korean workers. Travis earned over $51,000, while Phagnasay and Salazar made $3,450 and $4,500, respectively.

Florida Defendant Ran Fake IT Staffing Firm

In Florida, Erick Ntekereze Prince, 30, also pleaded guilty to wire fraud conspiracy. Through his company Taggcar Inc., Prince claimed to supply “certified” IT professionals to U.S. clients, but prosecutors say he instead funneled work to foreign North Korean IT operatives using stolen identities. Prince earned nearly $89,000 from the scheme.

Ukrainian Defendant Helped Dozens of Workers

In Washington, D.C., Ukrainian national Oleksandr Didenko pleaded guilty to wire fraud conspiracy and aggravated identity theft. The DOJ said 40 U.S. companies paid his clients “hundreds of thousands of dollars” under false pretenses. Didenko agreed to forfeit more than $1.4 million, including over $570,000 in seized fiat and cryptocurrency.

Polish authorities arrested Didenko in May 2024. He was extradited to the U.S. that December.

APT38 and the Cryptocurrency Heists

U.S. Seizes Millions Tied to Military Hackers

The DOJ’s forfeiture complaints target funds stolen by APT38, a notorious North Korean military hacking unit accused of multimillion-dollar cyberthefts in 2023 from virtual currency platforms worldwide.

The heists include:

• $37M from an Estonia-based payment processor

• $100M from a Panama-based processor

• $138M from another Panama-based exchange

• $107M from a Seychelles-based exchange

The U.S. government has frozen and seized over $15 million linked to these heists and now seeks forfeiture of USDT, a stablecoin pegged to the U.S. dollar.

The Prosecution Teams

Federal prosecutors from Georgia, Florida, and the District of Columbia—alongside the DOJ’s National Security Cyber Section—are coordinating the sprawling case. Multiple DOJ divisions, including the Criminal Division’s Computer Crime and Intellectual Property Section, are pursuing the forfeiture actions.