How American Homes Funded North Korea’s NUKES

October 22, 2026

For sale sign in front of a suburban house — Photo: Andy Dean Photography / Shutterstock

A single Arizona woman, working from a modest home office stacked with company laptops, helped funnel more than seventeen million dollars toward a nuclear-armed state under active international sanction — and she did it by registering as the human face behind more than three hundred American employees who did not exist as she described them.

Key Points

Christina Marie Chapman pleaded guilty in February 2025 to running a “laptop farm” that let North Korean IT workers pose as U.S.-based employees at over 300 companies, and was later sentenced to 102 months in federal prison.
The scheme generated at least $17 million in fraudulently obtained wages, with federal prosecutors and Treasury officials tying the proceeds to North Korea’s weapons programs.
The Treasury Department estimates North Korean overseas IT labor generated between $450 million and $800 million in a single year, a revenue stream the regime depends on to evade sanctions.
The fraud defeats conventional hiring security because the employer’s own laptop physically sits inside the United States while a remote operator abroad controls it.
This is not an isolated case but a documented, expanding pattern — the DOJ, FBI, and Treasury have brought parallel actions against similar networks for years.

What the Chapman Case Actually Established

The Department of Justice’s case against Christina Marie Chapman is the clearest, most thoroughly adjudicated example of how this fraud operates in practice. Chapman pleaded guilty on February 11, 2025, in the U.S. District Court for the District of Columbia to conspiracy to commit wire fraud, aggravated identity theft, and conspiracy to launder monetary instruments. Prosecutors stated she assisted overseas IT workers “posing as U.S. citizens and residents” in securing remote positions at more than 300 American companies. She was sentenced to 102 months — just under nine years — in federal prison, with the DOJ crediting the scheme with illegally generating $17 million in revenue.

Chapman’s role was logistical rather than technical: she housed the laptops that companies shipped to what they believed were new domestic hires, kept the machines running and accessible, and helped route the resulting paychecks. One nuance worth noting — Chapman herself claimed she did not specifically know she was helping North Korea, telling prosecutors she had not intentionally tried to benefit the regime. That claim did not change the plea or the sentence, but it illustrates how facilitators inside these networks are sometimes recruited without full visibility into who, ultimately, is on the other end of the connection.

How the “Laptop Farm” Mechanism Defeats Normal Screening

The term “laptop farm” describes a physical location — often an ordinary residence — where company-issued devices are plugged in, kept powered, and remotely accessed by an operator located elsewhere, frequently overseas. Because the device’s IP address and physical location match wherever the farm sits, standard employer verification methods, which rely on geographic and network signals, see nothing unusual. A company believes it has hired a U.S.-based developer; in reality, a worker overseas is logging into that machine through remote-access software while a facilitator domestically maintains the cover. The Center for Strategic and International Studies notes this model dates to roughly 2017, when North Korean IT operators began “creating fraudulent profiles, forged identities, and fake resumes” to penetrate freelance and remote-hiring platforms at scale.

The sophistication has only grown. Legal advisories from firms including Skadden and Morgan Lewis now warn employers that networks combine stolen identities, AI-generated application materials, and coached interview scripts to pass behavioral screening that once reliably caught impostors. The FBI’s disruption of infrastructure tied to the North Korean threat group known as Famous Chollima — which maintained laptop farms across the United States to support fake remote workers — underscores that Chapman’s operation was one node in a considerably larger apparatus, not a one-off aberration.

Why Washington Treats This as a Sanctions and Proliferation Problem

What elevates this beyond ordinary employment fraud is where the money goes. The Treasury Department’s Office of Foreign Assets Control has stated plainly that North Korea “dispatches thousands of highly skilled IT workers around the world to generate revenue that contributes to its weapons of mass destruction and ballistic missile programs, in violation of U.S. and UN sanctions”. OFAC has sanctioned individuals and entities across multiple actions — including a 2024 round targeting six individuals and two entities for operating DPRK-orchestrated IT worker schemes that systematically defrauded U.S. businesses. A single worker can earn more than $300,000 a year under a false identity, and coordinated teams can collectively bring in over $3 million annually, according to OFAC’s own assessment. The regime reportedly withholds most of these wages for state use rather than paying the actual workers.

The scale is not trivial. A joint analysis cited by Japan’s Ministry of Foreign Affairs estimated that in 2025 alone, North Korean overseas laborers unlawfully generated between $450 million and $800 million for the government, with IT work forming a major share of that total. That places remote-work fraud alongside cybercrime and traditional sanctions evasion as a core pillar of how Pyongyang finances programs the international community has spent decades trying to choke off financially.

What This Means for Employers Going Forward

The practical lesson for any organization that hires remote technical talent is that identity verification can no longer stop at a résumé, a video interview, and a clean background check. The fraud is specifically engineered to survive those checkpoints. Security and employment-law advisories now recommend layered verification — cross-referencing shipping addresses for company hardware against claimed residences, watching for multiple employees requesting payroll direct-deposit changes to the same financial accounts, and treating unusual device-access patterns as a compliance flag rather than an IT nuisance. The Chapman prosecution, and the wave of related DOJ and Treasury actions that followed it, mark less an endpoint than a template: federal authorities have signaled that both the facilitators inside the U.S. and the networks directing them from abroad will continue to be a sustained enforcement priority.