# Operation Lonestar Roundup: US Dismantles North Korean ‘Laptop Farm’ Network That Funnelled Over US$3 Million to Pyongyang
Federal authorities have arrested two Americans and seized more than 180 computers across Texas in a sweeping crackdown on an alleged North Korean remote IT work scheme that generated over US$3 million (RM12.25 million) for Pyongyang — underscoring the growing sophistication of state-sponsored illicit revenue operations exploiting legitimate US labour markets.
The Department of Justice announced the enforcement action as part of Operation Lonestar Roundup, targeting a network of so-called “laptop farms” that deceived American employers into hiring North Korean nationals posing as remote IT workers. The scale and geographic spread of the operation have drawn renewed attention to the vulnerability of the remote work economy to foreign state-linked infiltration.
—
## More Than 40 Sites Raided Across Texas as DOJ Targets North Korean IT Revenue Network
The Department of Justice confirmed that investigators searched more than 40 suspected laptop farm locations across the state of Texas, seizing in excess of 180 computers used to facilitate the scheme. According to federal prosecutors, the network collectively funnelled more than US$3 million to the North Korean government by placing covertly-employed North Korean IT workers inside American companies under false identities.
Laptop farms — facilities housing arrays of computers configured to simulate domestic US-based work environments — are the operational backbone of such schemes. They allow overseas workers to appear locally based to unsuspecting employers, circumventing both sanctions restrictions and standard hiring verification processes.
Two US nationals were arrested, one in Ohio and one in Pennsylvania, on charges including money laundering and identity theft. Prosecutors separately charged 14 additional individuals in connection with the operation, 10 of whom are believed to be located in China.
—
## 16 Individuals Charged as Operation Exposes Cross-Border Laundering and Identity Theft Infrastructure
In total, 16 individuals face federal charges stemming from Operation Lonestar Roundup, reflecting the transnational structure of the alleged scheme. The two Americans arrested domestically face money laundering and identity theft charges, while the majority of the remaining defendants — 10 of the 14 additionally charged — are based in China, indicating the network’s reliance on overseas coordinators to manage the flow of workers and funds.
Assistant Attorney General for National Security John A. Eisenberg stated directly: “North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the US or its allies.”
The charges mark the latest in a sustained series of law enforcement actions against US-based laptop farm operations linked to North Korea, reflecting an accelerating federal focus on this category of sanctions evasion.
—
## Prior Convictions Establish a Pattern: North Korean IT Schemes Have Generated Tens of Millions in Illicit Revenue
Operation Lonestar Roundup is not an isolated enforcement event. In April, two US nationals — Zhenxing Wang and Kejia Wang — were sentenced to 92 months and 108 months in federal prison, respectively, for operating a separate multi-year laptop farm scheme. That operation used the stolen identities of at least 80 US persons and generated more than US$5 million in illicit revenue directed to the North Korean government.
Taken together, these two schemes alone account for more than US$8 million in documented revenue flowing to Pyongyang through the exploitation of US remote work infrastructure — a figure that law enforcement officials suggest represents only a fraction of the total programme’s output.
The recurring pattern — stolen identities, US-based facilitators, China-based coordinators, and physical laptop farms masking overseas workers — points to a systematised, replicable model rather than opportunistic fraud.
—
## Weapons Financing Remains the Central National Security Concern Behind North Korean IT Worker Schemes
The DOJ’s framing of Operation Lonestar Roundup consistently emphasised the weapons development dimension of North Korea’s IT worker revenue programme. Assistant Attorney General Eisenberg’s statement explicitly linked the illicit earnings to the potential development of weapons “that could ultimately target the US or its allies,” elevating the enforcement action beyond financial crime into the domain of national security.
US authorities have repeatedly identified North Korea’s remote IT worker apparatus as one of Pyongyang’s primary mechanisms for generating hard currency under international sanctions. The programme reportedly deploys thousands of skilled IT workers globally, embedding them in companies across North America, Europe, and Asia under fabricated identities, with earnings repatriated to fund state priorities including weapons and missile programmes.
The Texas-based network dismantled in Operation Lonestar Roundup represents one node in what US officials describe as a far larger, globally distributed infrastructure — one that federal prosecutors have signalled they intend to continue aggressively targeting.
—
*Source: US Department of Justice / AFP*
About the Author
