Investigation: North Korean operatives are evading US sanctions and earning millions by using fake identities on services like Github, Slack, and Paypal
Context & Ripple Effects
This WSJ investigation is the earliest documented instance in a pattern that would balloon over the following years: months earlier, Bloomberg had published a profile of a North Korean tech worker describing how his country's hacker army exists purely to earn money for the state. The 2018 reporting showed the scheme running through ordinary Western SaaS rails — fake identities on GitHub, Slack, and PayPal letting sanctioned operatives earn millions.
First-order effects
- GitHub, Slack, and PayPal are revealed as unwitting payment and collaboration channels for sanctioned actors, exposing a sanctions-enforcement gap that sits with platform identity checks rather than banks.
- North Korean operatives are directly earning millions through these accounts, meaning US sanctions are being circumvented at scale by individuals the platforms never verified.
Second-order effects
- US companies hiring remote developers face pressure to add identity verification to their interview and payroll processes — a burden that later crystallized when the FBI and DOJ charged thousands of DPRK IT workers who had sent wage money home.
- As US scrutiny tightened, the operators rerouted: Google researchers later documented the same workers fraudulently securing roles in Germany, Portugal, and the UK, per BleepingComputer's report on the push into European companies.
Third-order effects
- If the pattern holds, identity proofing becomes compliance infrastructure for every platform that pays out or hosts paid work — the same failure mode later surfaced when over a dozen crypto companies unknowingly hired DPRK operatives who passed interviews and background checks.
- Sanctions enforcement migrates from financial institutions to software platforms and employers, making HR vetting a de facto arm of national-security policy.
The trend: North Korea's state revenue generation is shifting from outright theft toward fraudulent remote employment, with Western collaboration and payment platforms serving as the unwitting rails.