10 Nations Warn on North Korea IT Scheme Funding Nukes
Get the Geopolitics newsletter
Daily geopolitics — wars, elections, sanctions, the diplomatic moves that move markets. Free.
- Global Affairs Canada and counterparts from Japan, the U.S., the U.K., France, Germany, Italy, South Korea, the Netherlands, and New Zealand released a joint advisory on Friday detailing how North Korea deploys remote IT workers who impersonate foreign nationals to obtain employment and remit earnings to Pyongyang.
- The Financial Action Task Force (FATF) has placed North Korea on its "black list" as a high-risk jurisdiction, calling on all countries to terminate relationships with North Korean banks and limit business with its nationals.
- The U.S. Treasury Department estimated that North Korean IT worker schemes defrauded American businesses and generated $800 million US in 2024 alone.
- In April, two Americans were sentenced to prison for operating a "laptop farm" that let North Korean workers use at least 80 stolen U.S. identities to obtain jobs at more than 100 American companies, generating $5 million.
- North Korean IT workers typically operate from North Korea, China, Russia, and parts of Southeast Asia and Africa, using VPNs, third-country proxies, and — increasingly — agents who participate in job interviews in person to build false trust with hiring managers.
- UN Security Council Resolution 2397 (2017) requires all member states to repatriate North Korean nationals earning income within their borders, with few exceptions, and the joint alert says allied governments are "actively monitoring and countering" the threat.
- Kim Jong-un in March promised to expand the regime's nuclear arsenal, and his sister Kim Yo-jong said last month North Korea will never abandon its nuclear-armed status, underscoring the destination of the fraud proceeds.
Why it matters: The coordinated 10-nation alert, paired with the U.S. Treasury's $800 million annual loss figure, signals that the scheme has grown large enough that allied governments are treating remote-IT hiring as a proliferation-finance vector rather than a routine fraud case. Companies that hire contractors without video verification or who pay in cryptocurrency now face explicit guidance from nine governments to flag and report suspicious applicants.
