U.S. Judge Imposes 9-Year Sentence on New Jersey Man in North Korea-Linked IT Fraud Case

Fritz spoke at a UN committee meeting on the North Korean fraud scheme in January.

The North Korean IT worker scheme, in which operatives get remote tech jobs at U.S. and European companies, is an important part of a broad campaign of malfeasance by the Democratic People’s Republic of Korea (DPRK) that has generated about $2.8 billion in the past two years to help fund the country’s nuclear weapon ambitions, according to the UN’s Multilateral Sanctions Monitoring Committee.

The committee, which tracks DPRK sanctions violations and evasion tactics, revealed in January that the scheme has now victimized 40 countries around the globe. A large portion of that total is the result of crypto theft, but the IT worker scheme reliably generates $250 million to $600 million per year in fraudulent salaries, the UN has found.

“North Koreans are taking American jobs, and they’re stealing cryptocurrency from American owners of said cryptocurrency,” stated Fritz. “A North Korean IT worker can live in Laos, steal the identity of a Ukrainian online, and then use that identity to defraud a U.S. company into hiring them—often for remote jobs with salaries in the hundreds of thousands of dollars range,” Fritz added.

AI converted a North Korean accent into a convincing American-sounding voice during live job interviews, according to Evan Gordenker of cybersecurity firm Palo Alto Networks. Gordenker described this tactic at the UN committee meeting in January. “Your citizens are competing against a mechanized system that has been honed over years of training to exploit how we hire,” Gordenker told delegates at the UN committee meeting in January.

Insider intelligence firm DTEX had 87 North Korean IT workers apply for jobs in recent years, according to Michael “Barni” Barnhart. Barnhart and other investigators set up an operation in 2024 to lure DPRK IT workers and American facilitators. A partner created a front company and posted job listings as part of the 2024 operation.

A candidate applied claiming to hail from Austin, Texas. Barnhart spoke during a DTEX panel in San Francisco in March. A young man named “David” walked into the facility in person, presented a real government-issued ID, signed the paperwork, and passed the screening.

David appeared to be a college student at the time, according to Barnhart. When Barnhart’s operation shipped a company laptop to David in Texas, David said he’d moved and asked that it be routed to Moorhead, Minnesota instead. A man named “Aaron” accepted the package under David’s name in Moorhead, Minnesota.

Aaron set up the laptop and arranged it so a North Korean IT worker could perform the job tasks. Barnhart’s team had digital forensics noting every step of the laptop setup. In June 2025, the FBI announced it had conducted 29 raids across 16 states and seized 21 fraudulent websites that were part of the scheme.

In winter 2026, an investigator colleague texted Barnhart a screenshot showing David and Aaron listed as board members of an American employment company for tech workers. Barnhart’s team has pinpointed a third identity floating around that also goes by “David” but with a different last name.

The person behind all three identities was tied to a single North Korean operative Barnhart and other investigators had been tracking for years.

“North Korean IT worker schemes would not be successful without U.S.-based facilitators,” stated Assistant Attorney General John Eisenberg. Eisenberg made this statement in an April sentencing memo. The facilitators “assist overseas remote IT workers by operating laptop farms, creating fictitious front companies and associated financial accounts, defrauding U.S. companies through the use of false and fake identification documents, and pocketing substantial sums of money for their roles,” according to Eisenberg.

David denied via LinkedIn messages that he ever accepted a laptop on behalf of anyone else and said he was unaware of any employment scheme. David said his identity was stolen and that he has discovered 10 jobs linked to his identity since 2021 when he was 19 years old. David checked his IRS transcripts and noticed tons of W2s dating back to when he was 19 that he never applied for or worked for.

David filled out form 14039 to report identity theft to the IRS and reported it to the FTC. Aaron denied any knowledge of a laptop or North Korean IT worker scheme in an email to Fortune. @FortuneMagazine reported these details, drawing from court records, UN committee findings, and interviews with investigators and participants.