A Maryland man was sentenced to prison this week for helping IT workers linked to North Korea infiltrate US companies.
This incident fits into a wider pattern in 2025, where insider access and rising crypto theft are becoming key features of North Korea’s cyber strategy.
US Jobs Opened to North Koreans
The Justice Department announced on Thursday the sentencing of Minh Phuong Ngoc Vong, an American citizen convicted of conspiracy to commit wire fraud. Prosecutors proved that Vong used false credentials to secure remote software development jobs for North Korean nationals at 13 American companies.
According to public documents, Vong allowed a foreign operator to use his logins, devices, and identity documents to perform the work remotely. The man, who operated from China, is believed to be from North Korea.
One job created a particular risk when a Virginia technology firm hired Vong for work on a Federal Aviation Administration contract in 2023.
The role required US citizenship and granted him a government-issued personal identity verification card. Vong installed remote-access tools on the company laptop. The move allowed the North Korean man to complete the work from abroad inconspicuously.
The company paid Vong more than $28,000, and he sent part of those earnings to his overseas partners. Court filings show he collected over $970,000 across all companies, with most of the work performed by North Korean-linked operatives. Several firms also subcontracted with him for US government agencies, further expanding the exposure.
Vong was sentenced to 15 months in federal prison, followed by three years of supervised release.
The case comes as North Korea intensifies its global cyber operations.
Record Year for North Korean Hacks
In October, blockchain analytics firm Elliptic reported that North Korea-linked hackers had stolen over $2 billion in cryptocurrency in 2025. This figure represents the highest annual total ever recorded.
The overall amount attributed to the regime now surpasses $6 billion. These proceeds are widely believed to support nuclear and missile development.
This year’s surge stemmed from several major incidents, including the $1.46 billion Bybit breach, as well as attacks on LND.fi, WOO X, and Seedify. Analysts have also connected more than 30 other hacks to North Korean groups.
Most breaches in 2025 began with social engineering rather than technical flaws. Hackers relied on impersonation, phishing, and fabricated support outreach to gain wallet access. The trend highlights a growing focus on human weaknesses over code vulnerabilities.
Taken together, these trends suggest a coordinated approach, with North Korea combining insider infiltration with advanced cryptocurrency theft to expand both its income and operational footprint.
