FBI Dismantles North Korean Laptop Farm in Texas, Arrests U.S. Nationals

The Federal Bureau of Investigation executed a coordinated raid in Texas this week, seizing close to 187 laptop computers that were part of a North Korean‑run IT operation and taking two American residents into custody. Federal prosecutors have also filed charges against 14 additional individuals alleged to have supported the scheme.

The laptops were linked to the group known as Famous Chollima, a cyber‑crime outfit reportedly tied to the Democratic People’s Republic of Korea. The organization has built a “remote‑worker” model in which computers are shipped to overseas participants, who then log in to perform low‑skill IT tasks for North Korean clients while the earnings are funneled back to the regime.

According to investigators, the seized machines were pre‑installed with custom software that allowed operators in Pyongyang to monitor activity, collect credentials and route payments through a web of cryptocurrency wallets and shell companies. The operation exploited the United States’ large pool of skilled labor, disguising illicit earnings as legitimate freelance income.

Charges filed by the Department of Justice allege conspiracy to commit wire fraud, money‑laundering and violations of sanctions against North Korea. The two arrested suspects face federal prison terms, while the remaining defendants are expected to appear before a Texas federal court in the coming weeks.

Law‑enforcement officials say the bust represents a significant disruption of a supply chain that has helped fund the DPRK’s cyber‑espionage and illicit‑financing activities for several years. By targeting the hardware and the financial pathways, authorities hope to deter similar “laptop farms” that have emerged in other jurisdictions.

In a statement, the DOJ highlighted the collaborative effort between the FBI, the United States Secret Service and international partners, emphasizing that the operation was part of a broader strategy to curtail state‑sponsored cyber threats. The agency also warned that individuals who unknowingly participate in such schemes could still face legal consequences.

Federal officials indicate that the investigation remains active, with additional arrests possible as they trace the network of recruiters, financiers and technical support staff. The case underscores the growing challenge of distinguishing legitimate remote work from covert cyber‑operations, a line that is becoming increasingly blurred in the digital age.