North Korean IT fraud case cites crypto transfers in alleged $3m scheme

The U.S. Department of Justice has announced the arrests of two Americans accused of helping North Korean IT workers obtain jobs at more than 70 U.S. companies in a scheme that generated approximately $3 million.

The U.S. Department of Justice announced on Oct. 13 that authorities arrested Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas under an indictment in the Northern District of Ohio.

Under the filing, both men face charges of conspiracy to commit wire and mail fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft. Pena also faces an aggravated identity theft charge.

Alongside the arrests, the department disclosed searches at more than 40 Texas residences and the seizure of approximately 187 computer devices in an operation targeting suspected North Korean “laptop farms.”

DOJ indictment describes jobs obtained through false identities

According to the Ohio indictment, overseas workers secured remote IT positions by presenting stolen or fabricated identities while domestic facilitators supplied the equipment, addresses and financial accounts needed to support the deception.

Receiving employer-issued laptops at American homes, the alleged facilitators configured the computers for remote access so workers abroad could use company systems while appearing to work inside the United States.

Through remote-access software and other equipment, prosecutors allege, the overseas workers performed assignments on computers physically located at U.S. residences. Domestic participants then helped receive employment payments and transfer earnings overseas, according to the filing.

The indictment alleges that the operation compromised the identities of more than 25 U.S. people and caused false information to reach the Department of Homeland Security, Internal Revenue Service and Social Security Administration.

Beyond the approximately $3 million in worker revenue, the filing alleges that affected companies incurred at least $3 million in legal expenses, computer network repair costs and other losses.

Within the alleged network, prosecutors identify Ohio resident Trey Michael Nolte as a co-conspirator who is named but not charged in this indictment. The filing alleges that Nolte recruited, trained, and managed U.S.-based facilitators, including Bostelle, who received a share of the proceeds.

The department said all defendants remain presumed innocent unless proven guilty in court.

Crypto transfers feature in the alleged payment network

In its account of the money movements, the indictment identifies cryptocurrency as one method participants used to transfer funds overseas.

Describing a July 8, 2024 conversation, the filing alleges that Nolte discussed using spreadsheets to manage transfers between bank accounts and virtual currencies before sending funds to defendant Sun Sheng Ming.

As crypto.news previously reported in September, a separate federal case resulted in the forfeiture of approximately $212,700 in stablecoins connected to North Korean IT worker payments.

In that case, U.S. District Judge Rudolph Contreras issued a Sept. 3 ruling covering funds in a wallet beginning with “0x81c4,” according to the report. Prosecutors traced approximately 158,123 USDC to at least 10 worker payment addresses and another 54,574 USDT to at least four such addresses.

The report said the ruling granted only part of a Justice Department request involving more than $7.74 million in digital assets. Contreras declined to grant forfeiture of the remaining property because the government had not adequately identified it in its public notice, leaving prosecutors able to submit another request.

Texas laptop farm searches seize 187 devices

Between Sep. 21 and Sep. 25, the FBI carried out searches and other enforcement actions at more than 40 Texas residences known or suspected to house laptop farms, according to the department.

Under “Operation Lonestar Roundup,” investigators seized approximately 187 laptops and keyboard, video, and mouse devices used to control computers remotely, the announcement said.

The department said the Northern District of Texas U.S. Attorney’s Office, FBI Dallas Field Office and FBI Cyber Division coordinated the operation, with assistance from federal prosecutors in Ohio.

For American businesses, U.S. Attorney David M. Toepfer described the charges as “an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”

Earlier enforcement also produced prison terms for domestic facilitators. In its May 8 coverage of two laptop farm sentences, the outlet reported that Matthew Issac Knoot of Nashville and Erick Ntekereze Prince of New York each received 18 months in prison.

According to the Justice Department’s findings cited in that report, their separate schemes generated more than $1.2 million for North Korea and affected nearly 70 American companies.

In Knoot’s case, prosecutors said employers paid more than $250,000 to workers associated with his laptop farm and incurred more than $500,000 in audit and system repair costs. Prince was ordered to forfeit $89,000 paid to him by North Korean IT workers, the report said.

FBI warning details how Americans are recruited

In an Oct. 13 warning, the FBI said North Korean IT workers increasingly recruit Americans facing financial pressure to help conceal fraudulent employment.

According to the bureau, paid tasks can include attending interviews, appearing on camera during meetings, verifying false identities, providing access to professional accounts, and keeping employer-issued computers connected at home.

The advisory said workers have also begun spreading equipment across more residences, with fewer laptops at each location, to reduce disruption when one site is discovered.

For employers, the FBI recommended checking combinations of suspicious behavior throughout employment rather than relying on one name, document, or technical signal. The bureau cautioned that poorly calibrated checks could harm legitimate remote employees and people whose identities had been stolen.

The FBI also reported that some North Korean workers obtain jobs at Western companies and subcontract assignments to freelancers in Pakistan, India, Nigeria, and neighboring countries, paying them a fraction of the salary received from the employer.