North Korean IT Workers Hit 70+ US Firms: Vet Your VAs

The Justice Department said Tuesday that North Korean IT workers used stolen identities to get hired at more than 70 U.S. companies, including retailers.

If you run a Shopify store with offshore assistants, freelance developers or outsourced support, you are the kind of employer this scheme works on. At Ecommerce Paradise we teach lean, remote-first stores, so this lands close to home. The DOJ lists retail among the victim sectors, and the Treasury Department has warned since 2022 that companies that hire or pay these workers face sanctions risk.

Below: what the DOJ announced, how the scheme got here, what I think it means for a store owner, and six things to do before your next payout. I’m not a lawyer, and this is reporting plus opinion, not legal advice.

Pay your team from a real company, not your personal account: form your LLC with Northwest Registered Agent, the best LLC formation service for ecommerce owners. Unlike cheap formation sites that upsell you at checkout, Northwest holds your renewal at the same price as year one. Form your LLC with Northwest →

DOJ Seizes 187 Laptops in Texas Tied to 70 US Companies

The Justice Department announced coordinated actions against North Korean remote IT worker schemes on Tuesday, Oct. 13, 2026. According to the release, the actions include an indictment in the Northern District of Ohio, two arrests, and searches in Texas under an operation called Lonestar Roundup.

Prosecutors say the Ohio indictment charges four counts of wire fraud, money laundering and identity theft. Two U.S. nationals were arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Ten China-based defendants are charged, and two more defendants are sealed. The release says the allegations are unproven and every defendant is presumed innocent.

Per the DOJ, the scheme ran from 2019 to about July 2025. North Korean workers used stolen or fabricated identities, VPNs and proxies to pass as U.S.-based hires. U.S. facilitators hosted company laptops at their homes, and the earnings went to accounts the North Korean government controlled.

The physical side came out of Texas. According to the U.S. Attorney’s Office for the Northern District of Texas, agents searched more than 40 residences from Sept. 21 to 25 and seized 187 laptops and keyboard, video and mouse (KVM) devices. About 100 of them came from North Texas.

The scale, per the DOJ: more than 70 U.S. employers and about $3 million in revenue. The victims worked in healthcare, communications, cyber support, retail and manufacturing across Ohio, 16 other states and Washington, D.C. TechCrunch reported that the DOJ did not name the companies.

R. Joseph Rothrock, the FBI Dallas Special Agent in Charge, said: “Each laptop seized potentially represents one company that has hired a DPRK IT worker.” David M. Toepfer, the U.S. Attorney for the Northern District of Ohio, called the charges “an urgent alert to all U.S. companies to remain vigilant in their hiring practices.”

The FBI published a same-day alert through its Internet Crime Complaint Center titled North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment. It says “thousands” of state-controlled workers are placed at Western companies, and that the North Korean government keeps an estimated 85 to 90 percent of the revenue. It also says teams are moving to more laptop farms with fewer laptops at each, which makes them harder to find.

The DOJ adds that facilitators now handle a wider range of tasks and sometimes subcontract entire jobs to foreign nationals. The FBI’s red flags include remote access tools such as AnyDesk, TeamViewer and RustDesk on work devices, KVM-over-IP hardware, and frequent changes to bank accounts, home addresses or social media accounts. The FBI says no single indicator is reliable on its own.

The DOJ release also lists 11 email accounts tied to the scheme and asks employers to add them to their hiring-fraud indicator lists.

North Korean IT Worker Scheme Timeline: 2019 to the Oct. 13 Raids

None of this is new. The Treasury Department’s Office of Foreign Assets Control published a fact sheet on North Korean IT workers on May 16, 2022, aimed at companies, freelance platforms and payment platforms. It warned that the workers pose as foreign or U.S.-based freelancers and that employers face intellectual property theft, loss of funds, reputational damage and legal consequences, including sanctions.

The OFAC red flags read like a description of a normal remote contractor gone slightly wrong. Several logins to one account from different IP addresses in a short time. Frequent payments to bank accounts in China. Requests to be paid in crypto. Mismatched names, locations or work history across profiles and payment accounts. Trouble working during required hours or answering instant messages.

The DOJ says Tuesday’s actions are part of its DPRK RevGen: Domestic Enabler Initiative, with earlier steps in June 2025, November 2025, April 2026 and May 2026. So this is the fifth round in about sixteen months. TechCrunch adds that CrowdStrike, which calls the group Famous Chollima and helped the FBI investigate, describes laptop farms as “vital” to North Korea’s hackers.

The scheme is one of several revenue streams for a sanctioned regime. TechCrunch notes North Korea is thought to have stolen at least $2 billion in crypto in 2025. Remote jobs are the quieter channel: get hired, collect wages, take sensitive data, and in some cases extort the employer afterward.

There is a counterpoint worth stating plainly. The DOJ release names no ecommerce victims, and nothing in it says a Shopify store was hit. The listed sectors are broad, and the scheme targets IT roles. The FBI also cautions against blunt filtering. It says employers should not rely only on ban lists or name-based screening, which can block qualified applicants and harm people whose identities were stolen. And TechCrunch says experts on North Korea believe the real number of hacked companies is much higher than what the DOJ reported.

I covered a neighboring risk when the ASOS breach hit its customer messaging platforms: the attack surface for a store is rarely the storefront. It is the people and tools with access behind it.

What North Korean Hires Mean for Shopify Store Owners With Remote Teams

My read is that a small high-ticket store has lower exposure than a software company, but not zero. The scheme is built to land developer and IT jobs, and those jobs come with admin logins. Store owners hand out the same kind of access every week: a freelance developer in your Shopify theme code, an ad manager in Google Ads and Merchant Center, a support rep in your helpdesk, a VA with a staff account.

High-ticket stores carry a particular risk. Your customer list holds names, addresses and phone numbers tied to orders of $2,000 and up. That is a better data set to steal or ransom than a list of $20 impulse buyers. If someone with a stolen identity has an export button, you have a problem even if the payroll side looks clean.

Here is the money side, using hypothetical numbers. Say you pay two contractors $2,500 a month each. That is $60,000 a year flowing to accounts you never matched to a verified identity. The DOJ’s own figures work out to roughly $43,000 per victim company if you divide the $3 million by 70, though that is my division of the DOJ’s round numbers, not a reported average. A year of paying the wrong person is in that range, and it is a payment you would have a hard time explaining to a bank or regulator.

Which brings me to banks. Also on Oct. 13, Treasury, the OCC and OFAC fined Bank of America more than $1.21 billion over anti-money-laundering failures, as I covered in my post on the penalty. It is a different case. My read is that the direction is the same: regulators are pressing banks on where money goes, and compliance teams will ask harder questions about payments to unusual accounts.

The practical fix on payments is boring. Pay a named person, in the country they say they live in, from a channel that records who got the money. Wise is one option for paying overseas contractors in local currency, because the recipient details are tied to a named bank account. Payoneer is another route many freelancers already use.

My comparison of Wise versus PayPal for store owners covers fees and holds if you are choosing.

On hiring channels, I can’t tell you any platform is safer than another. The DOJ release names none. If you recruit VAs through OnlineJobs.ph, my walkthrough on how to hire on OnlineJobs.ph shows the posting and interview flow, and the vetting steps below apply on top of any platform.

Laptop farms need your laptop. Most store owners never ship hardware, which already keeps you out of the center of this scheme. Keep it that way. If you do issue a device, ship it only to an address you verified on a live video call, and treat remote access software you did not install as a reason to look closer.

Cost matters here too. A vetting step that takes 15 minutes per contractor is cheap next to a clawed-back year of payments, an extortion demand, or a data breach notice to customers. The same logic applies to the rest of your remote stack, as I laid out in my e-commerce business continuity plan post.

If you would rather not own hiring at all, that is the point of the turnkey done-for-you service, where my team builds and runs a high-ticket store for you.

Remote help is how stores scale, and vetting it is part of the job. Want my team to scale the store you already have? See the scaling service →

Vet Remote Freelancers: 6 Steps to Take This Week

Six things to do before your next payout, in order of how fast they pay off:

List everyone you pay each month: VAs, developers, support reps, designers and ad managers. Next to each name, write the name on their payment account and the country they say they live in. Any mismatch gets a call before the next payment.
Hold a live video call with camera on for every remote hire you have never seen. Live video makes it harder to fake who you are talking to. Ask them to show a government ID on camera and check that it matches the profile and the payment account.
Stop paying in crypto and stop paying third-party accounts. Route payouts to an account in the contractor’s own name through Wise, and keep the receipts. For US contractors, Gusto handles contractor payments and tax forms in one place.
Cut access to what the job needs. Open your Shopify staff permissions and remove admin from anyone who does not need it. Do the same in Klaviyo and your helpdesk, and turn off customer-list export for anyone who does not run campaigns.
Track hours and work output. A tool like Hubstaff shows when someone actually works, which matters because OFAC lists trouble working required hours as a red flag. My Hubstaff review for managing remote VAs covers the setup.
Run background checks on US-based hires with Checkr, and call two references for everyone else. If something looks wrong, stop paying, keep records, and report it at ic3.gov as the FBI asks.

If you want a second set of eyes on your team structure, book a call through my discovery page and we will walk through who has access to what.

Frequently Asked Questions

Does this apply to a small Shopify store that only uses VAs?
Probably less than it applies to a software company, but the access you hand out is the same kind. The DOJ lists retail among the victim sectors, so run the six steps above before your next payout.

Should I stop hiring remote freelancers?
No. The FBI warns against relying only on ban lists or name-based filtering, because that can block qualified people. Add verification friction instead, such as live video, ID checks and payments to accounts in the contractor’s own name. My comparison of sites for remote jobs shows where to find talent.

What if I already paid someone I now doubt?
Stop further payments, save the messages, invoices and payment records, and file a report at ic3.gov. Talk to a lawyer about sanctions exposure, because I’m not one and this is not legal advice.

What are the main red flags?
Per OFAC and the FBI: logins from several IP addresses in a short time, payments to bank accounts in China, crypto payment requests, details that do not match across profiles and payment accounts, and trouble working agreed hours. Remote access tools or KVM devices on a work laptop are also on the FBI’s list. The FBI says no single sign is proof.

Should my LLC pay contractors instead of me personally?
Yes, in most cases it is cleaner, because a business account gives you a record of every payment. Northwest is where I would start when forming your LLC.

Can I check the 11 email accounts the DOJ listed?
Yes. The DOJ release lists them and asks employers to add them to hiring-fraud indicator lists. Search your applicant inbox and contractor records for matches, and see my chargeback prevention guide for high-ticket stores for the broader fraud checklist.

I’m still planning my store. What should I read first?
Start with my beginner guide, then read what high-ticket dropshipping is.

Want 1-on-1 coaching to build a remote team you can trust and a store that runs without you? Get the coaching details →

The takeaway for me is simple: verify first, then pay. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.