Investigation: North Korean operatives are evading US sanctions and earning millions by using fake identities on services like Github, Slack, and Paypal
Hiding behind social-media fake profiles, a group linked to Pyongyang solicited technology work to send hard currency back home
Context & Ripple Effects
This WSJ investigation is the earliest public mapping of what later became a documented state revenue program: North Korean operatives using fabricated Western identities to solicit freelance tech work and route the proceeds home through mainstream payment rails like PayPal. A Bloomberg profile months earlier had already sketched the worker-for-hire model inside Pyongyang's hacker army; this report showed how ordinary collaboration tools — GitHub, Slack — were the cover.
The playbook aged well. By 2022 the same fake-remote-worker method had moved into crypto firms, with the UN crediting Pyongyang with billions stolen from exchanges (spies posing as remote workers at US crypto firms), and by 2023 the FBI and DOJ put official numbers on the IT-worker pipeline (thousands of workers sending wage money back to North Korea).
First-order effects
- GitHub, Slack, and PayPal are named as unwitting infrastructure: each faces immediate pressure to detect sanctioned-state users hiding behind synthetic profiles, since their platforms are the identity layer the scheme depends on.
- US companies soliciting freelance tech work learn they may have been paying sanctioned actors directly, exposing them to sanctions liability they did not know they carried.
Second-order effects
- Hiring and payments platforms are pushed toward stricter identity verification for remote contractors — the gap this investigation exposed is exactly where later cases show the same operatives passing interviews and checks at crypto firms (over a dozen unknowing crypto employers) and expanding into Europe once US scrutiny tightened (fraudulent roles in Germany, Portugal, and the UK).
- Sanctions enforcement shifts from blocking bank transfers to policing labor marketplaces and developer platforms, forcing those firms into compliance roles they never designed for.
Third-order effects
- If the pattern holds, remote work's identity problem becomes a national-security compliance problem: employer-side verification, payment-rail monitoring, and platform KYC harden into standard practice across the global tech labor market.
- State revenue generation via dispersed IT workers proves durable enough to outlast individual crackdowns — each enforcement action pushes the network to new sectors and geographies rather than shutting it down.
The trend: North Korea's sanctions evasion has evolved from freelance-platform schemes like this one into an industrialized remote-work infiltration spanning crypto, mainstream tech, and multiple continents.