Laptop-Farm Operators Land in Prison as the US Cracks Down on North Korea's Remote IT Workers

The American enablers of North Korea's remote-worker fraud are now going to prison with some regularity. In early May 2026, two US nationals were each sentenced to 18 months for running so-called laptop farms, bringing the count to eight convictions of US-based facilitators in roughly five months.

The scheme, briefly

North Korean IT workers apply for remote jobs at Western firms using stolen or borrowed identities. A company hires what looks like a US-based contractor and ships a laptop to an American address. The laptop sits in a home, with remote-desktop software installed, and the real worker logs in from abroad. Salaries flow back to Pyongyang; in some cases the access is also used for data theft or extortion. The facilitator, the so-called laptop farmer, supplies the domestic address, the physical device and often the paperwork.

The two May defendants fit that pattern. Prosecutors said Matthew Issac Knoot of Nashville ran a laptop farm from his residences between July 2022 and August 2023, enabling workers in China to appear US-based. The scheme brought in more than $250,000 from at least four companies and cost victims more than $500,000 in auditing and remediation. He was ordered to pay $15,100 in restitution and forfeit the same amount. Erick Ntekereze Prince of New York pleaded guilty to wire fraud conspiracy; between June 2020 and August 2024 his company, Taggcar, helped at least three workers get jobs, and victim companies paid more than $943,000 in salaries, mostly sent overseas. He forfeited $89,000.

A growing docket

The May sentences were not isolated. Help Net Security counted them as the seventh and eighth convictions of US-based laptop farmers in five months. In April 2026 two New Jersey men were sentenced for helping workers obtain jobs at more than 100 American companies, generating roughly $5 million for Pyongyang. In November 2025, five defendants, including Ukrainian national Oleksandr Didenko, pleaded guilty to helping North Koreans infiltrate US companies; coverage put the affected total at about 136 firms, and Didenko received five years in February 2026. In January 2026 Zhenxing Wang pleaded guilty and was later sentenced to 92 months. The earlier benchmark was Christina Chapman, sentenced in July 2025 to 102 months for a farm tied to 309 companies.

Why it matters

These prosecutions target the part of the scheme that sits on US soil and is easiest to reach. FBI Cyber Division Assistant Director Brett Leatherman warned that hosting laptops for North Korean IT workers is a federal crime, and the US Attorney in the Southern District of Florida stressed that such acts are deliberate, not paperwork violations. The deterrent message matters because the scheme is not only about wages. Chainalysis has noted that placing operatives inside crypto firms gives later access for theft, so a fake employee can be the first step in a bigger heist.

For companies, the cost is not only the salary paid to a fraudulent worker. Knoot's scheme alone caused more than $500,000 in auditing and remediation costs against roughly $250,000 in wages, because once a firm discovers that a contractor was never who they claimed, it must work out what that person could reach: source code, customer data, internal chat, cloud consoles. Security teams increasingly treat a suspicious hire as a possible insider-threat incident and review access logs accordingly. Practical steps include verifying identity on camera at several stages of the hiring process, checking that the shipping address matches the worker's stated location, flagging unauthorised remote-desktop software on company laptops, and confirming that payroll accounts belong to the named employee.

What to watch

• More guilty pleas and sentences, and whether courts hand down longer terms as cases grow.
• Employer hardening: stronger identity proofing, live video verification, and controls on remote-access tools on corporate laptops.
• Cases that move up the chain to the overseas organisers, including sanctions and indictments of North Korean firms.

Sources

1. Helping North Korean IT remote workers is becoming a fast track to prison — Help Net Security
2. Americans sentenced for running laptop farms for North Korea — BleepingComputer
3. Two US citizens get combined 18 years in prison for running North Korean laptop farms — Tom's Hardware
4. North Korea IT worker scheme laptop farm facilitators sentenced — CyberScoop