Follow the Money · 09 — The Payroll: The Wage That Builds a Missile

Follow the Money — Case 09. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

Case 02 followed stolen crypto into North Korea's weapons program — a heist, converted into missiles. Case 09 follows money to the same terrible destination by the opposite route: not stolen, but earned. This is the DPRK IT-worker scheme, and it is the register's quietest and most unsettling case, because there is no break-in, no ransom, no victim who wakes to an empty account. There is a competent software developer, doing real work, collecting a fair salary — and funneling it home to help build a nuclear-armed state's ballistic missiles.

The mechanism is almost banal in its ordinariness. North Korea dispatches thousands of highly skilled IT workers abroad, mostly to Russia and China, where they use stolen or fabricated identities to pose as non-North-Korean freelance developers and get hired, remotely, by companies all over the world. They pass the interviews. They clear the background checks. They do the tickets, ship the features, join the standups. Their employers are, by many accounts, satisfied — a productive contractor, a good hire. And the wages, once paid, are routed back to Pyongyang to fund the weapons and missile programs that the entire international sanctions architecture exists to starve.

This is the letter about the wage that builds a missile. The disposition is CONVERTED — but it is a conversion unlike any other in the register, because nothing is taken. Value is genuinely created, genuinely paid for, and then redirected, step by step, from a payroll deposit into a warhead. It is insidious precisely because it wears the face of honest work, and it forces the register's hardest question about who, exactly, is the criminal at the keyboard.

1. The Scheme: a workforce, not a heist

Start with the authoritative record, because this is not speculation — it is documented by the US government and the United Nations in plain language. The US Treasury's 2024 Proliferation Financing Risk Assessment states that the DPRK developed an additional revenue stream by deploying IT workers: per May 2022 Treasury, State, and FBI guidance, North Korea has dispatched thousands of highly skilled IT workers around the world, located primarily in Russia and the PRC, to generate revenue that contributes to its weapons-of-mass-destruction and ballistic-missile programs, taking advantage of existing demand for skills like software and mobile-application development to obtain freelance work. Read that as an org chart, not a headline: the DPRK runs a labor-export business, and the product is code, and the profit funds proliferation.

The United Nations Panel of Experts on North Korea confirms both the scheme and the money's destination. In its 2024 reporting, the Panel documents IT workers used to defraud businesses, evade sanctions, and fund the development of the DPRK government's weapons program, with the workers funneling their income back home through online payment services and third-country bank accounts. The Panel references figures on the order of 3,000 IT workers and notes that a single worker often holds multiple longer-term full-time positions at once — one operative, several salaries, all flowing to the same state. This is not a handful of infiltrators. It is a program with scale, structure, and a stated purpose.

That framing is what makes Case 09 different from everything before it. Every prior case had a theft or a fraud at its origin — a ransom extorted, a heist executed, a victim deceived into paying. Here the origin is a job posting and an offer letter. The company wanted a developer; it got a developer; it paid the market rate for real output. The crime is not that the work was fake or the value imaginary. The crime is who the worker secretly was, and where the honestly-earned wage secretly went. The register has to follow money that was never stolen — only redirected — which is a harder trail to see precisely because it looks, at every ordinary step, completely legitimate.

2. The Two Frauds: a stolen name and a borrowed country

The scheme rests on two deceptions, and naming them precisely explains how a Pyongyang operative becomes a trusted remote hire in a company that would never knowingly employ one. The first fraud is identity. The second is location.

A North Korean passport is unhireable, so the worker cannot appear as themselves. The scheme's first act is therefore identity fraud: presenting as a non-North-Korean using stolen, borrowed, or fabricated identities — frequently the real personal details of actual Americans or Europeans, sometimes supplied by complicit or duped locals — to open accounts on freelance platforms, pass employment background checks, and clear onboarding. The developer who enters the hiring pipeline has a plausible name, a plausible history, and documents that survive a hurried review. Nothing about the code they will write is fraudulent. The fraud is the person; the identity is the disguise, and it is a good one, because it is often a real person's genuine identity worn by someone else.

The second fraud is geography, and it is solved by an ingenious and now well-documented piece of infrastructure: the laptop farm. The obvious tell in a remote-work fraud is the network — a company laptop that suddenly connects from an unexpected country. So the scheme enlists facilitators, some inside the United States, who receive the employer-issued laptops at a domestic address and keep them running, letting the overseas worker connect through them and appear to be working from within the country. DOJ prosecutions have targeted exactly these US-based facilitators, charging them for hosting the devices and enabling the fraud. The laptop farm is the physical bridge between a sanctioned operative in Russia or China and a plausibly local employee on a company's org chart — a rack of humming laptops in a suburban house, each one a North Korean developer wearing an American zip code. Defeat either fraud — the stolen identity or the borrowed location — and the scheme becomes far harder to run. Together, they make a hostile state's operative look exactly like the remote hire every company now employs by the dozen.

3. The Conversion: from payroll deposit to warhead

Follow the wage, because the funneling is the disposition. The salary starts as an entirely legitimate payment: a company pays a contractor for delivered work, through a freelance platform, a payroll processor, or a direct deposit. At that instant the money is clean, earned, and unremarkable — one of a million routine contractor payments. Then the conversion begins, and it uses precisely the channels the UN Panel names: online payment services and third-country bank accounts, and — given the DPRK's documented fluency with cryptocurrency — frequently crypto, which lets salary income leave the Western financial system without a correspondent bank that would balk at a North Korean beneficiary.

The worker keeps a controlled portion for living expenses in their host country; the bulk moves onward to the state. And the state's use of it is the reason the whole apparatus of international sanctions exists: the revenue contributes, in the explicit words of the US guidance, to the DPRK's WMD and ballistic-missile programs. So the full arc of the money is a payroll deposit in one country becoming, through a chain of payment services and crypto transfers and third-country accounts, a contribution to a warhead. That is the conversion this case is named for — the transformation of an honest day's pay into an instrument of proliferation.

Notice how this joins Case 02, and how it differs. In Case 02, the DPRK stole roughly $620 million in crypto and poured it into the same programs; the disposition there was SPENT, because the money bought the weapons directly. Here the money reaches the identical destination, but it was earned rather than stolen, and the register marks it CONVERTED to capture the transformation — legitimate labor income converted into sanctioned state revenue. The two cases are the same river seen at two different tributaries: one fed by theft, one fed by wages, both emptying into the same arsenal. And the wage tributary is, in a sense, the more disturbing, because it cannot be defended against by better security alone. You can patch the vulnerability a thief exploits. You cannot patch the fact that you paid a competent contractor who turned out to be someone else, working for someone else, sending the money somewhere else.

4. The Double Harm: funding a bomb, hosting a spy

The scheme injures its unwitting employer twice over, and both injuries are severe. The first is the one the sanctions regime cares about most: proliferation financing. A company that hires a DPRK IT worker becomes, without knowing it, a funding source for a nuclear-weapons and ballistic-missile program — a private firm, thinking it engaged a contractor, materially contributing to the exact threat that the international order has spent decades trying to contain. This is not a metaphor or an abstraction. Each salary is a small tributary into a weapons budget, and thousands of workers holding multiple jobs each make the aggregate a meaningful revenue stream for a heavily sanctioned state. The employer's harm is not just that it was defrauded; it is that its money did something monstrous with its unwitting help.

The second harm is a security catastrophe hiding inside a routine hire: the company has placed a hostile state's operative inside its own systems, with legitimate credentials. This developer has commit access to the codebase, visibility into infrastructure, knowledge of internal tools and data, and the standing trust of a coworker. That is a persistent espionage and sabotage risk — a foreign intelligence asset, salaried and badged, sitting in the source-control history. And the risk is not hypothetical: reporting has documented cases where DPRK IT workers, once discovered and terminated, retaliated by stealing proprietary data and extorting their former employers, threatening to leak it unless paid. The insider, cut off from the wage stream, turns to theft — which means the scheme's endgame can escalate from quiet revenue generation into the very ransom-and-extortion crimes the earlier cases documented, now launched from inside the building.

Put the two harms together and the scheme's danger comes into focus. It is simultaneously a financing operation and an infiltration operation, and the same hire accomplishes both. The company that fails to detect a DPRK IT worker has not merely made a bad contractor choice; it has funded a missile program and embedded a spy, in one transaction that looked, from the inside, exactly like hiring a good remote developer.

5. The Person at the Keyboard

The register owes this case a nuance the headlines usually flatten: the individual worker at the keyboard is not, in most cases, a free agent choosing to menace the world. They are a highly controlled instrument of the state, and locating the culpability correctly matters for both accuracy and justice.

Consider the conditions the reporting describes. The workers are dispatched abroad under close minding, monitored by the state apparatus that sent them. They are bound by revenue quotas they must meet. Their families remain in North Korea, effectively held as guarantors of their loyalty and return — the oldest coercion the regime knows. And they surrender most of what they earn to the state, keeping only a controlled allowance. This is not the profile of a criminal entrepreneur weighing risk and reward. It is closer to indentured, coerced labor performed under the threat that hangs over everyone the regime controls: comply, or your family answers for it. The worker does real, skilled work under duress, for a master who takes the proceeds and points them at a weapons program.

This does not soften the harm, and the register is careful not to let it. The employers are still defrauded, the missile program is still funded, the codebase still infiltrated, and the discovered-worker extortion is still a real crime with real victims. But it does locate the moral weight precisely: the culpable actor is the DPRK state that runs the program — that dispatches, coerces, and extracts — not, in the main, the individual pressed into service under threat to their family. This is the same forensic discipline the register applied to the trafficked scam-compound workers in Case 06: the person coerced into committing the crime and the party who profits from the coercion are not morally identical, and collapsing them lets the real perpetrator hide behind the human being they compelled. The person at the keyboard is doing genuine work under genuine duress; the regime behind them is committing the crime. The wage builds the missile, but the hand that aims it is the state's.

6. The counter-narrative, steelmanned

The strongest objections come from two sides, and both deserve a fair hearing.

The first says the register is too soft, again — that dwelling on the workers' coercion risks excusing skilled operatives who knowingly defraud companies, steal real people's identities, infiltrate sensitive systems, and, when caught, extort their victims. Coercion at home, the argument goes, does not license identity theft and espionage abroad; plenty of the workers are willing, well-compensated relative to their peers, and complicit in the harm, and painting them as pure victims insults both the defrauded employers and the actual North Koreans in prison camps. The second objection runs the other way and says the register overstates the threat: most of these workers just write ordinary code for ordinary salaries, the sums are trivial against a national weapons budget, and the 'spy in the codebase' framing is fearmongering that will get legitimate foreign developers discriminated against on suspicion of being North Korean.

The register grants what is true in each and holds its ground. Yes, the workers commit real fraud — identity theft, sanctions evasion, and in the extortion cases outright further crimes — and the register says so plainly; the coercion nuance locates culpability, it does not grant immunity, and the employers' harm is centered throughout. Naming the state as the principal perpetrator is not absolving the instrument; it is refusing to let the principal hide behind it. And yes, the harm framing must be proportionate — but the sources are not the register's invention: Treasury, State, the FBI, and the UN Panel independently document the scale, the weapons-program destination, and the funneling channels, and the discovered-worker extortion cases are matters of public record, not speculation. The risk of discriminating against legitimate foreign developers is real and worth naming — the answer is rigorous, identity-based verification, not nationality-based suspicion — but it is not a reason to pretend the scheme is small; a hostile state running thousands of infiltrators into the global software supply chain is a serious threat whether or not any single salary is large. Both objections push toward a comfortable simplification — either 'they're just villains' or 'it's no big deal.' The truth is the uncomfortable middle the register insists on: real work, real fraud, real coercion, real proliferation, all at once.

7. Disposition — CONVERTED

Case 09 followed money that no one stole. A company posted a job, hired a developer, and paid a fair wage for real code — and that wage, through a stolen identity and a laptop farm and a chain of payment services and crypto transfers, was funneled to Pyongyang and converted into a contribution to a nuclear-armed state's missiles. There was no break-in to detect, no ransom note, no emptied account. There was a productive contractor and a monthly deposit, and the deposit built a bomb.

The disposition — the money's fate — is CONVERTED. Not stolen and spent like Case 02's heist, but earned and redirected: legitimate labor income transformed, step by quiet step, into sanctioned state revenue for a weapons program. It is the register's most insidious conversion precisely because it counterfeits the one thing above suspicion — honest work. The employer created real value and paid for it fairly; the fraud lived entirely in who the worker was and where the money went. And the two frauds that made it possible — a stolen name and a borrowed country, welded together by a rack of laptops in a suburban house — turned a hostile state's operative into the remote hire every company now employs without a second thought.

Hold the two truths this case will not let you separate. The harm is grave and doubled: an unwitting company funds a missile program and hosts a foreign spy in its codebase, and when the wage is cut, the spy can turn to theft and extortion. And the person who typed the code is, in most cases, a coerced instrument — quota-bound, minded, their family held as collateral — whose culpability belongs mostly to the state that dispatched them. The honeypot beneath these words watches attackers force their way in; this case watches an attacker walk in through the front door with an offer letter, do good work, and mail the paycheck to a weapons program. The vectors do not lie: the wage was earned, the identity was stolen, the money reached Pyongyang, and the missiles are real. Judge the state that runs the payroll and aims its proceeds at the world. Then sit with the register's quietest and most disquieting finding — that the most dangerous money in this series was not stolen at all, but earned, one honest sprint at a time, by a developer who was someone else, working for a regime, building a missile with a salary you paid.

Follow the Money continues. Case 09 disposition: CONVERTED. Confidence: HIGH on the documented facts — the DPRK IT-worker scheme, its scale (thousands of workers, primarily in Russia and the PRC), its funneling channels (online payment services, third-country accounts), and its WMD/ballistic-missile-program destination are stated in the May 2022 Treasury/State/FBI guidance, the US Treasury 2024 Proliferation Financing Risk Assessment, and the 2024 UN Panel of Experts report. The laptop-farm facilitator infrastructure and the discovered-worker extortion cases are matters of public record via DOJ prosecutions and reporting, characterized as such. The coercion of individual workers is presented as analysis grounded in the documented control mechanisms; culpability is located with the state. No individuals are named or accused beyond public prosecutions. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the regime, the conversion, and the wage that builds a missile.