North Korea is expanding a scheme that uses IT professionals in third countries to help its operatives obtain remote jobs at American and international technology companies. Workers in Nigeria, South Africa, Iran, India and Latin America have reportedly been recruited to act as interview proxies, often receiving about $500 a month in cryptocurrency to impersonate candidates during hiring calls. After contracts are secured, North Korean agents assume the work and route wages to Pyongyang. Intelligence estimates put annual proceeds from the remote-worker operation at $600 million to $800 million, while US intelligence estimates all cyber-related revenue at at least $1 billion a year. CrowdStrike reported that North Korean hacking groups stole more than $2 billion in cryptocurrency during 2025, up 51% from the previous year. A September 2026 NBC News investigation, cybersecurity research from Flare, Kudelski Security and DTEX, and a July advisory from the US State Department, Justice Department and international partners describe the campaign. Consensys has acknowledged inadvertently contracting development work to a North Korean operative, while Bank of Korea estimates put North Korea's 2025 economic growth at 3.5%.