The U.S. Department of Justice has issued a stark warning that North Korean hackers are increasingly relying on American facilitators to infiltrate U.S. companies. Prosecutors have indicted and arrested at least two people and conducted searches across 40 suspected “laptop farms” in Texas, seizing over 180 computers believed to belong to sanctioned North Korean spies operating under stolen identities.

According to the DOJ, at least 70 U.S.-based companies have been infiltrated, with the hackers generating around $3 million in stolen funds. The affected sectors include healthcare, cyber support, retail, communications, and manufacturing in 16 states, including the District of Columbia.

The remote IT workers scheme, which allows North Koreans to gain employment and steal sensitive information, has become a critical source of illicit revenue for the North Korean regime. This includes hacking cryptocurrency exchanges and open-source developer projects, with estimates suggesting the regime may have stolen at least $2 billion in crypto alone.

Experts believe the number of hacked companies and the amount of stolen crypto are likely much higher than reported. In a separate report, CrowdStrike stated that North Korean hackers were behind around half of all documented ‘hands-on-keyboard’ intrusions over the past year.