The U.S. Department of Justice (DOJ) has announced arrests in connection with an alleged $3 million scheme tied to North Korean information technology (IT) workers. [1]
Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested under an indictment filed in the Northern District of Ohio, the department stated. Both men face charges of conspiracy to commit wire and mail fraud, conspiracy to commit money laundering and conspiracy to commit identity theft, according to the filing. [1]
Federal prosecutors say the defendants allegedly helped overseas IT workers obtain remote positions at U.S. companies using stolen identities, then moved the resulting wages through cryptocurrency channels. Within the alleged network, prosecutors identify Ohio resident Trey Michael Nolte as a co-conspirator who is named but not charged in this indictment.
Indictment Alleges Stolen Identities, Remote-Access Jobs
The scheme fits a pattern documented in earlier federal prosecutions. In a July 2, 2025 Natural News report, authorities described how North Korea infiltrated more than 100 U.S. companies using fake identities, siphoning millions to fund weapons programs through remote IT jobs [2]. A separate October 2025 report from Natural News detailed how North Korean IT workers infiltrated U.S. firms using fake identities while hackers stole billions in cryptocurrency through major digital heists, exploiting corporate trust and remote hiring vulnerabilities [3].
The scale of the operation has drawn scrutiny from multiple federal agencies. Google's Threat Intelligence Group has reported that operatives have shifted focus to Europe, using fake identities to infiltrate blockchain firms and funnel profits to Pyongyang's nuclear program, according to Natural News [4]. The U.S. Department of the Treasury announced sweeping new sanctions against eight individuals and two entities accused of laundering millions in stolen cryptocurrency to finance North Korea's nuclear and missile programs [5].
The recruitment tactics have evolved as well. According to a Natural News report, foreign actors now use AI deepfakes to fraudulently obtain U.S. remote jobs, stealing wages for overseas weapons programs, and have infiltrated defense contractors, Fortune 500 companies, and media networks [6].
Crypto Transfers Cited in Alleged Payment Network
Prosecutors also cited cryptocurrency transfers as part of the alleged payment network used to move funds tied to the scheme. U.S. District Judge Rudolph Contreras issued a Sept. 3 ruling covering funds in a wallet beginning with "0x81c4," according to the report.
The broader pattern of cryptocurrency-linked enforcement extends beyond this case. In a separate action, U.S. Attorney Jeanine Pirro said federal authorities have frozen and seized more than $580 million in cryptocurrency tied to Southeast Asian scam networks, marking a major escalation in the government's campaign against cross-border crypto fraud [7].
Texas Searches Seize Devices; FBI Issues Warning
Meanwhile, ,the Northern District of Texas U.S. Attorney's Office announced that searches in Texas resulted in the seizure of devices tied to the investigation. U.S. Attorney David M. Prater said the seizures were part of the broader effort to disrupt the alleged network. The FBI has also issued a warning to employers about the tactics used by North Korean IT workers.
Case Pending; Earlier Prosecutions Cited
The case remains pending in the Northern District of Ohio. Earlier enforcement actions produced prison terms for domestic facilitators. Two individuals, Matthew Issac Knoot of Nashville and Erick Ntekereze Prince of New York, were each sentenced to 18 months behind bars.
The two were accused of providing infrastructure for the fraudulent scheme, particularly for running or managing so-called "laptop farms" inside the United States. In Knoot's case, employers paid more than $250,000 to workers associated with his laptop farm and incurred more than $500,000 in audit and system repair costs, prosecutors said.
More recent prosecutions have produced longer sentences. The pattern of enforcement underscores what independent journalists have long documented: North Korea's use of information technology workers as a revenue source for its weapons programs.
The FBI's warning to employers remains in effect. The bureau advised companies to verify employee identities through multiple channels and to watch for signs that a remote worker may be using a laptop farm, including reluctance to appear on video, inconsistent work hours, and the use of multiple identities across different employers.
References
- North Korean IT fraud case cites crypto transfers in alleged $3m scheme. https://crypto.news/north-korean-it-fraud-case-cites-crypto-transfers-3m/
- North Korean IT workers infiltrate US firms funnel millions into weapons programs in massive fraud scheme - NaturalNews.com, July 02, 2025.
- North Korea steals billions via crypto hacks and fake IT jobs to fund nuclear weapons report reveals - NaturalNews.com, October 24, 2025.
- Fake IT workers from North Korea target UK crypto projects in global espionage scheme - NaturalNews.com, April 02, 2025.
- US sanctions target North Korean cybercrime networks funding nuclear weapons - NaturalNews.com, November 05, 2025.
- Fake job seekers using AI deepfakes infiltrate US companies fueling national security threat - NaturalNews.com, April 16, 2025.
- US Government Seizes Over $580 Million In Crypto Linked To Southeast Asian Scams. https://www.zerohedge.com/markets/us-government-seizes-over-580-million-crypto-linked-southeast-asian-scams
Explainer Infographic
Please contact us for more information.