The Justice Department says North Korea has hacked dozens of American companies

US officials warn that sanctioned hackers are increasingly targeting Americans to act as facilitators between breached US companies and Pyongyang.

Disrupt 2026 has officially begun. Get your pass now to be in the center of the startup hub. Register now

Disrupt the doors opening on October 13th. Get your card and bring someone with you with a 50% discount. Register now.

The US Department of Justice warns that hackers working for the North Korean regime are increasingly relying on Americans to facilitate the hacking of American companies.

In an announcement Tuesday, prosecutors said they had charged and arrested at least two people and searched dozens of suspected "laptop farms" in Texas. Apparently, the North Koreans used these computers to hack into American companies and steal sensitive information remotely.

Federal authorities have seized more than 180 computers that they believe were sent by American companies to newly hired employees without realizing that North Korean spies who used the stolen identities of American citizens to get jobs were sanctioned, according to the Justice Department. The U.S. Department of Justice said it has raided more than 40 laptop farms in Texas, the largest number of homes and locations used to facilitate North Korean hacking, with at least two American facilitators.

CrowdStrike, which helped the FBI investigate and disrupt North Korea's latest operation, said the laptop farms are "vital" to North Korea to help the country's hackers overcome the physical, financial and legal challenges of having a physical presence in the United States.

Prosecutors said at least 70 US-based companies were breached by the hackers, who are believed to have made off with about $3 million in stolen money. The Justice Department did not name the affected companies, but described them as being in the health care, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia.

"North Korea's IT workers are increasingly turning to American facilitators to counter enhanced private sector discovery and law enforcement efforts. These workers hire facilitators to perform a wider range of tasks, and in some cases outsource entire jobs to third-party foreign nationals," the Justice Department said.

Often, North Korean hackers use real email addresses, fake LinkedIn profiles, and extensive online and social media accounts as a cover for their activities.

In a separate public service announcement, the FBI said "thousands" of North Korean government-controlled IT employees working for Western companies "pose a domestic national security threat and intellectual property theft."

It is the latest in a wave of arrests, indictments and enforcement actions targeting North Korean activities in the United States in recent years. The separatist regime has used this "remote IT workers" scheme to allow North Koreans to get jobs at American and European companies, get paid, and then steal sensitive information and intellectual property while they are employees. The victim companies are then extorted to pay more to the hackers.

The remote IT worker scheme is one of several streams of illegal income that the North Korean regime plans to create, including hacking crypto exchanges and open-source developer projects, in order to finance its internationally sanctioned nuclear weapons program. The regime is believed to have stolen at least $2 billion in cryptocurrency in 2025 alone.

North Korean experts have stated that the number of companies hacked and the amount of cryptocurrencies stolen is much higher than reported.

Earlier this year, CrowdStrike said in a separate report that North Korean hackers were behind half of last year's documented "hands on keyboard" intrusions, referring to hacks carried out by humans rather than automated tools or artificial intelligence.

When you make a purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.

He can be reached via encrypted message at zackwhittaker.1337 on signal. You can also contact him by email, or to verify communication, at [email protected].

Get 50% off a second pass The Disrupt experience is meant to be shared. Get your pass and bring a colleague, partner or peer for 50% off. Cover more ground by building connections, building momentum, and discovering what's next in the startup ecosystem.

Elon Musk attacks Ambani over Jagmeet Singh's India Starlink launch delay

Batteries are already cheaper than natural gas turbines in many data centers, says Tim de Chant

Remember Orkut? Its founder wants to bring back Jagmeet Singh

The United States barred Microsoft, Adobe and major IT companies from the green card program for skilled foreign workers Ayesha Malik.

Elon Musk questions Ambani influence as Starlink India launches on Jagmeet Singh stands

The 19-year-old founder of Cal AI just raised $10 million for his new AI startup Julie Burt.