DOJ Announces Two Arrests in North Korean ‘Laptop Farm’ Crackdown

The Justice Department announced the arrests of two Americans and the seizure of approximately 187 computer devices on Oct. 13 in a coordinated crackdown on schemes allegedly placing North Korean IT workers inside U.S. companies under false identities.

The department said Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested under an indictment in the Northern District of Ohio. Prosecutors allege the scheme affected more than 70 U.S. employers and generated approximately $3 million in revenue for overseas IT workers.

Both men face charges of conspiracy to commit wire and mail fraud, money laundering conspiracy, and conspiracy to commit identity theft. Pena also faces an aggravated identity theft count. The charges are allegations, and the defendants are presumed innocent unless proven guilty.

The device seizures came during Operation Lonestar Roundup, coordinated by federal authorities in the Northern District of Texas. Between Sept. 21 and Sept. 25, the FBI conducted searches and other enforcement actions at more than 40 Texas residences known or suspected to be hosting “laptop farms,” DOJ said. The approximately 187 devices included laptops and keyboard-video-mouse equipment used for remote access.

According to the Ohio indictment, U.S.-based facilitators received employer-issued laptops at their homes and enabled overseas workers to control them through remote-access software or hardware. That arrangement made the workers appear to be in the United States while giving them access to company systems. Facilitators also received wages and forwarded money abroad, prosecutors allege.

Crypto Transfers in the Alleged Scheme

The indictment describes cryptocurrency as one route for moving funds overseas. It alleges that Trey Michael Nolte, an Ohio resident named as a co-conspirator but not charged in this indictment, described using spreadsheets to manage transfers between bank accounts and virtual currencies, and then send the funds to defendant Sun Sheng Ming. Prosecutors date that conversation to July 8, 2024.

In another alleged conversation, on Sept. 24, 2024, defendant Jin Long told Nolte that everyone receiving his overseas money transfers or cryptocurrency transfers worked for Sun, according to the indictment.

The indictment leaves victim employers unnamed and does not identify a crypto company among them. It also does not specify the cryptocurrencies, wallet addresses or amounts transferred in crypto. The alleged payment channel therefore does not establish that the affected employers paid wages in digital assets.

The hiring threat has previously drawn attention in DeFi. As The Defiant reported in April, security researcher Taylor Monahan warned about North Korean workers inside protocols. “Lots of DPRK IT Workers built the protocols you know and love,” she wrote.

In a new advisory issued Oct. 13, the FBI said North Korean workers have shifted toward more laptop farms with fewer machines at each to avoid single points of failure. It urged companies to combine identity verification and access controls throughout employment, warning that no single indicator reliably identifies these workers.