North Korea Pays $500 Monthly to Foreign Workers for US Jobs

North Korea pays foreign IT workers $500 per month in cryptocurrency to secure contract positions at US firms. The scheme involves recruiting candidates from Iran and Lebanon to pass initial interviews. Once hired, North Korean operatives take over the roles. This tactic bypasses stricter screening processes at US companies.

A joint government alert issued on July 31, 2026, described the method. The document was signed by agencies from the US, Japan, South Korea, and the UK. It also included signatories from Australia, Canada, Germany, and France. The alert warned that North Korean workers use AI to hide identities. They expand their global reach through these digital tools.

Operatives Use Forged Documents and Proxies

North Korean IT workers forge identity documents to create accounts. They use third-party proxies on employment platforms. In some cases, they arrange in-person contact to build trust. Hiring managers may not realize the initial candidate is not the final operator.

Once employed, the operatives avoid direct deposit. They request payment through money transfer services or cryptocurrency. Funds are routed through third-party bank accounts. Earnings are then sent to North Korean agencies.

The alert flagged laptop farms operating inside the US. Company-provided devices are delivered to US addresses. Workers access these devices remotely from overseas. They hide their real locations using virtual private networks. They also use remote desktop software to maintain access.

Crypto Losses Reach Two Billion Dollars

Cybersecurity firm CrowdStrike attributed over $2 billion in crypto losses to North Korean actors in 2025. This figure represents a 51% increase compared to 2024. The data was cited by Cointelegraph in May 2026. These losses highlight the financial scale of the schemes.

Despite global sanctions, North Korea's GDP grew 3.5% in 2025. The Bank of Korea provided this estimate. The growth underscores the economic impact of these activities. The Financial Action Task Force lists North Korea as a high-risk jurisdiction.

Regulators Urge Stronger Verification Measures

UN Security Council Resolution 2397 requires member states to repatriate North Korean nationals. These individuals must be earning income in their jurisdictions. The July 2026 alert urged companies to strengthen identity verification. It recommended requiring in-person interviews where possible.

Employment platforms should flag accounts requesting cryptocurrency payments. They should also monitor frequent changes to registered information. Payment details that do not match the account holder's name are a red flag. GN markets/crypto (en-US) reported on the broader context of these digital threats. These measures aim to disrupt the flow of illicit funds.