FBI probes North Korean IT worker hired by US federal agency

The FBI is reportedly investigating how a North Korean was hired to work for a U.S. federal government agency. News of the investigation was first reported by Federal News Network, which cited a senior FBI official speaking at a Washington, D.C. conference on July 28. The official confirmed the FBI is investigating a North Korean working for an unnamed federal agency.

It’s unclear how the North Korean was hired, but the regime is known for coordinated, long-running campaigns aimed at fraudulently obtaining employment at private organizations and multinationals. The case marks a rare confirmed instance of a sanctioned North Korean working for a government agency. Thousands of North Korean IT workers are thought to have gained employment with U.S. and European organizations in recent years by exploiting weaknesses in the hiring process, using fraudulent identities to secure remote positions and earn wages that get funneled back to the regime — all while stealing intellectual property and other data, then using it to extort the companies once they are caught.

Strict vetting and security-clearance practices have largely kept the regime’s hackers out of government, though not without incident: the Justice Department brought charges in 2024 against a Maryland man who helped a North Korean hacker pose as an American to get a remote contractor job at the Federal Aviation Administration.

The FBI declined to comment when contacted by TechCrunch. It’s not known which federal agency was affected, or whether any data or funds were stolen during the incident.

The U.S. has long warned about the risks posed by North Korean IT-worker schemes, taking enforcement actions and sanctions against networks operating from Pyongyang and neighboring Russia and China, as well as American facilitators who set up fleets of laptops letting North Koreans work remotely as if based in the United States. North Korea operates more like a transnational criminal gang than a government, relying on hacks — including cryptocurrency theft — to fund its globally sanctioned nuclear weapons program; the Kim Jong Un regime is reportedly responsible for 76% of cryptocurrency thefts, according to blockchain forensic firms, netting it at least $2 billion during 2025 despite being banned from the global financial system.

Why it matters

A confirmed North Korean hire inside a federal agency shows that even security-cleared government hiring isn’t immune to a scheme that has already infiltrated thousands of private-sector employers.