US prosecutors said they have secured eight sentences in the last five months against people acting as US-based proxies for North Korea-based IT workers, shedding new light on how they have been able to infiltrate US companies.
Two men have been sentenced this month alone. The Justice Department said Wednesday that separate courts sentenced Nashville resident Matthew Issac Knoot and New York resident Erick Ntekereze Prince for helping North Koreans work remotely for US companies.
The US perpetrators, known as “laptop farmers,” acted as recipients for laptops that US companies would send to new employees. They installed remote desktop software on the devices, allowing North Korean IT workers to use them remotely while appearing to work from the US.
North Korea’s remote worker scheme generates revenue for the government and has targeted technical roles at crypto companies to gain access to internal systems, company assets and security infrastructure. Such access can help workers understand company infrastructure and identify systems that could later be exploited.
Source: FBI Cyber Division
Prosecutors said Knoot, who was sentenced on May 1, and Prince, sentenced on Wednesday, each received 18 months in prison.
Prince was ordered to forfeit $89,000, the amount the North Korean workers paid him for the scheme, while Knoot was ordered to pay $15,100 in restitution to the companies and to forfeit an additional $15,100, the amount he earned from the scheme.
Together, the Justice Department said the pair generated $1.2 million in revenue for North Korea, and the scheme affected nearly 70 US companies.
Related: North Korea tied to heists worth $578M in April after Kelp DAO exploit
Last month, New Jersey residents Kejia Wang and Zhenxing Wang were given nine years in prison and seven years, eight months in prison, respectively, for hosting laptop farms for North Korea.
Prosecutors in that case said the scheme lasted multiple years, used the stolen identities of 80 people in the US and made over $5 million for the North Korean government.
According to a report by CrowdStrike in August, the number of companies that hired North Korean workers over the previous 12 months jumped 220%, with workers infiltrating more than 320 companies over that period.
The report noted that North Korean workers were heavily using artificial intelligence to automate and optimize the process of applying for and working in remote jobs.
The US charged four North Koreans in June last year, accusing them of stealing more than $900,000 in crypto after using fake identities to gain remote employment at an Atlanta-based blockchain research and development company and a Serbian crypto company.
Magazine: Guide to the top and emerging global crypto hubs — Mid-2026
