Federal authorities in North Texas say they've busted laptop farms tied to a scheme that allegedly funneled American wages into North Korea's weapons programs, seizing more than 100 laptops and signaling that indictments are on the way. The U.S. Attorney's Office for the Northern District of Texas held a Tuesday morning press conference to announce the operation, which officials say connects to a broader pipeline funding Pyongyang's nuclear and ballistic missile development.
Laptops Seized, Charges Promised
According to CBS News Texas, federal authorities in North Texas said indictments are coming after seizing more than 100 laptops allegedly connected to an operation supporting the North Korean government. U.S. Attorney Ryan Raybould said the DPRK uses information technology workers to earn wages from American companies, with those workers funneling the money back to the North Korean government. Raybould said the funneled cash funds the regime's nuclear and ballistic weapons programs, per the same report.
The scheme described in North Texas mirrors a tactic federal investigators have documented nationwide for years: so-called laptop farms, where domestic facilitators host corporate laptops shipped to remote workers who are actually operating overseas. A joint federal advisory from the FBI, the Department of the Treasury, and the Department of State found that individual North Korean IT workers can earn up to $300,000 a year, with the scheme collectively generating hundreds of millions of dollars annually for the regime's prohibited weapons programs, according to the U.S. Department of Justice.
A Pattern Stretching Across the Country
The North Texas case follows a string of similar federal actions. In June 2025, federal law enforcement executed searches across 21 premises in 14 states as part of a multi-district North Korean IT worker investigation involving the U.S. Attorney's Office for the Northern District of Texas, seizing approximately 137 laptops, the Justice Department has said. That same month, a separate nationwide enforcement action targeted 29 known or suspected laptop farms across 16 states, seizing 29 financial accounts and 21 fraudulent websites used by North Korean operatives who had fraudulently secured remote employment at more than 100 U.S. companies.
Cybersecurity researchers have detailed how these operations stay hidden. Risk intelligence firm Nisos found that North Korean laptop farm operations use PiKVM hardware and Tailscale mesh VPNs, letting overseas operators control physical corporate laptops before they even boot up, bypassing corporate security controls, according to Infosecurity Magazine. The setup allows foreign workers to appear as ordinary local remote employees while the actual laptop sits in someone else's house or apartment, often hundreds or thousands of miles from where the work is really being done.
Domestic Facilitators Face Years in Prison
Courts have handed down increasingly stiff sentences to the Americans who host these machines. In April 2026, two U.S. nationals were sentenced to 108 months and 92 months in prison for operating laptop farms that used stolen identities of more than 80 U.S. citizens to place North Korean IT workers in over 100 domestic companies, generating $5 million for foreign operatives, the Justice Department reported. The following month, two U.S. citizens in Tennessee and New York received 18-month federal prison sentences for hosting company laptops and installing remote desktop software at their homes to make overseas workers appear local.
The deception tactics have gone beyond hardware. In November 2025, five individuals — including an active-duty U.S. Army soldier — pleaded guilty to federal fraud charges for helping North Korean IT workers land corporate jobs, a scheme that included hosting laptops at home and even taking employee drug tests on behalf of foreign operatives, according to CyberScoop's reporting. One of the earliest landmark cases involved Arizona resident Christina Marie Chapman, charged in May 2024 with running a domestic laptop farm using stolen identities of over 60 U.S. residents to place North Korean workers into remote roles across more than 300 companies, including major defense contractors and media networks, per JURIST. Hoodline previously covered Chapman's $17M sentencing.
Money Laundering Charges Add to the Picture
The financial side of the pipeline has also drawn federal scrutiny far from Texas. Federal prosecutors in Miami charged a civil engineer in July 2026 with laundering over $550,000 in illicit tech wages for North Korean remote IT workers through corporate accounts, in exchange for a 3% commission fee, Hoodline reported at the time.
Behind the North Texas case is a federal office that's grown substantially in recent months. U.S. Attorney Ryan Raybould oversaw a rapid expansion of the U.S. Attorney's Office for the Northern District of Texas in late 2025, adding 40 Assistant U.S. Attorneys in 10 months to reach a record workforce of over 100 federal prosecutors across the Dallas-Fort Worth region, according to the Department of Justice. That buildup gives the office more capacity to pursue national security and cybercrime cases like the laptop farm bust announced this week. No indictments have been filed yet in the North Texas case, but officials say they are forthcoming.
