An on-chain investigation by blockchain sleuth ZachXBT revealed that North Korean IT workers operating under false identities have earned nearly $17 million in 2025 by working for crypto startups and blockchain companies. These operatives, disguised as foreign developers, filled approximately 345–920 roles, receiving monthly salaries of $3,000–$8,000—totaling about $2.76 million per month—through USDC wallets, some directly funded from Circle accounts.

ZachXBT’s findings highlight worrying compliance shortfalls:

• USDC, issued by Circle, is being used extensively for payments linked to sanctioned DPRK actors.

• Some of these wallets were previously blacklisted by Tether, indicating laundering via stablecoin networks,

  
  

One quote from ZachXBT summarizes the issue clearly:

🚨 Broader Illicit Context

• The DOJ and FBI recently uncovered a vast North Korean remote-worker scheme employing thousands of cyber operatives, leading to seizures of laptops, bank accounts, and indictments in multiple U.S. states.

• Authorities have already seized about $7.7 million in crypto linked to these schemes and are pursuing civil forfeiture.

These operations are part of a larger DPRK illicit financing network. The U.S. has intensified its efforts to dismantle laptop farms and shell companies funneling money to…