North Korea appears to be expanding its use of remote IT workers in third countries as part of an increasingly targeted strategy to infiltrate U.S. companies and channel funds toward its weapons programs. NBC News reported on Friday that the scheme involves foreign-based job seekers—often recruited through mainstream platforms—who are then positioned to move contracts and access before being replaced by North Korean operatives.

The details come after a July warning issued by the U.S. government and multiple foreign agencies. The alert said North Korean IT workers actively look for contracts with the intention of remitting salaries back to their parent agencies. It also highlighted their potential as insider threats, citing participation in data exfiltration, cryptocurrency theft, and theft of sensitive information.

Key takeaways

• U.S. and allied agencies have warned that North Korean IT workers seek contracts to funnel pay back to DPRK-linked agencies while posing insider and data-risk threats.
• NBC reports North Korean efforts increasingly rely on third-country remote workers to pass job interviews, then hand over roles to DPRK operatives.
• Recruitment tactics described by NBC include scouting on platforms like LinkedIn and offering cryptocurrency compensation for “interview associate” work.
• Related reporting from earlier this year tied North Korea-linked hacking activity to large crypto losses, suggesting the operational model may be bearing fruit.
• With economic pressure continuing, the scheme underscores why organizations should tighten identity, access, and payment controls for remote hiring.

From direct recruitment to third-country remote access

According to NBC’s report, North Korea’s approach has shifted toward leveraging remote workers outside the DPRK to gain entry into companies that may not otherwise connect the threat to North Korea. Instead of relying solely on traditional infiltration channels, the scheme centers on obtaining legitimate work contracts after successfully navigating hiring processes.

The reported workflow is straightforward but high-risk for employers: third-country IT workers are brought in to secure contracts and, after roles are established, are “usually” replaced by North Korean operatives. The operational logic is clear—create an initial foothold that looks normal from an outside hiring perspective, then transition to the underlying actors with access to systems, credentials, or internal knowledge.

NBC also said some foreign workers were recruited after being scouted on LinkedIn. In other cases, applicants were allegedly offered cryptocurrency payments to perform part-time “interview associate” tasks—work that can help them appear credible in recruitment pipelines while potentially aligning them with a longer-term operational goal.

The July alert and what it implies for corporate defenses

The July alert referenced by NBC is significant because it frames the threat not just as external hacking, but as a multi-stage infiltration risk that includes insider behavior. In that advisory, U.S. government and partner agencies described North Korean IT workers as contract-seekers who intend to remit earnings to DPRK agencies.

Just as importantly, the alert connects the labor recruitment angle to cyber outcomes. It described how these workers can function as insider threats to companies, while also being implicated in data exfiltration and cryptocurrency theft, along with theft of sensitive information. Even without additional details about each case in NBC’s report, the combined message is that the threat model includes both access and monetization.

For companies processing remote hires, this means that hiring risk is inseparable from security risk. Organizations that rely on remote onboarding, contractor access, or permissive internal tooling could be inadvertently enabling a pathway for identity compromise, unauthorized code and data handling, and lateral movement once the “handover” occurs.

Why cryptocurrency appears in the recruitment workflow

NBC’s reporting that some candidates were offered cryptocurrency as part of “interview associate” arrangements matters for two reasons. First, it signals that the recruitment pipeline may be designed to blend into existing work structures while still using mechanisms that are harder to trace than conventional payroll.

Second, it aligns with earlier warnings and reporting that tie North Korea-linked actors to crypto-enabled theft and financial diversion. In May, Cointelegraph reported—citing cybersecurity firm CrowdStrike—that North Korea state-affiliated hackers and threat actors were responsible for more than $2 billion in cryptocurrency losses in 2025, representing a 51% year-on-year increase. While that figure reflects cyber theft broadly rather than the specific “interview associate” step described by NBC, the throughline is consistent: crypto is both a tool and an outcome for DPRK-linked operations.

Sanctions pressure, economic indicators, and persistence

The recruitment strategy also fits a broader pattern of persistent activity despite sanctions. The report notes that the Bank of Korea estimated North Korea’s GDP increased 3.5% in 2025 even with global restrictions in place. That kind of resilience can be read as a reminder that threat actors do not need normalization of trade to sustain operations—alternative channels, including cybercrime and illicit financial routing, can help fill gaps.

For investors and builders in crypto and broader tech ecosystems, the implications extend beyond national security. North Korea-linked tactics reportedly combine labor infiltration with cyber operations and monetization. That combination increases the likelihood that compromised systems, stolen credentials, and exfiltrated data can feed downstream fraud and theft—potentially involving crypto at multiple stages.

As governments and companies tighten controls around known malware and exchange-related abuse, schemes that begin at recruitment and onboarding may become more attractive because they can bypass purely technical perimeter defenses.

What to watch next is whether more enforcement and advisories provide granular indicators—such as specific behaviors during remote hiring, payment patterns, or contract-approval structures—that organizations can use for earlier screening. In the meantime, the core concern is clear: if role handovers from third-country contractors to DPRK operatives are a recurring tactic, security teams should assume that “legitimate” employment pathways can conceal hostile intent.

North Korea (DPRK) is now using remote workers from third countries, including Iran and Lebanon, to aid its efforts to infiltrate US companies and obtain money to fund its weapons programs, NBC reported on Friday.

An alert issued in July by the US government and several foreign agencies said North Korean IT workers “seek out contracts with the intent of remitting their salaries to their parent North Korean agencies. They also pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.”

As the US and other governments have moved to counter North Korea’s efforts, the DPRK has turned increasingly to third-country IT workers to pass job interviews, the report said. After work contracts are obtained, the positions are usually taken over by North Korean operatives.

NBC reported that foreign IT workers had been scouted on LinkedIn, with some offered $500 monthly in cryptocurrency to work part-time as “interview associates.”

Related: Consensys unknowingly outsourced developer work to North Korean

The DPRK’s increasingly sophisticated tactics may be meeting with some success.

Cointelegraph reported in May, citing cybersecurity company CrowdStrike, that North Korean state-affiliated hackers and threat actors were responsible for more than $2 billion in crypto losses in 2025, a 51% year-on-year increase.

The Bank of Korea estimates North Korea’s GDP increased 3.5% in 2025 in spite of global sanctions.

Magazine: Bitcoin adoption metrics say one thing, price action says another

Anthropic is reportedly in early-stage discussions with Nvidia over a potentially massive funding round that could rival the largest IPOs in history, according to Reuters. The talks include the possibility of Nvidia investing about $10 billion, Reuters said on Saturday, citing people familiar with the matter.

Reuters also reported that Anthropic may be aiming to raise up to $100 billion in the offering, a figure that—if realized—could place the company’s valuation around $2 trillion. Negotiations are still ongoing and could change, the people said, with both sides remaining tight-lipped as talks remain confidential.

Key takeaways

• Reuters reports Anthropic is discussing a deal with Nvidia that could include a roughly $10 billion investment.
• The potential IPO fundraising target discussed by Reuters could reach as much as $100 billion, implying a valuation near $2 trillion.
• If structured as an early backer arrangement, Nvidia’s involvement would both support the offering and deepen its relationship with an important customer.
• Broader AI competition is increasingly spanning chips, model ecosystems, and developer tooling—areas where Nvidia is already expanding.

Why Nvidia’s potential role matters

While IPO participation can be purely financial, Nvidia’s reported interest would likely carry strategic weight. Reuters said Nvidia could act as an early strategic backer—an approach that often helps issuers secure stronger investor confidence, potentially smoothing the path for a large-scale listing.

From Nvidia’s perspective, Anthropic is a high-profile AI customer. Reuters’ reporting suggests the discussions could be a way for Nvidia to both support a major capital raise and strengthen commercial ties with a company viewed as central to frontier AI development.

A fundraising goal that would reshape the IPO landscape

Reuters described the potential size of the offering as extraordinary: up to $100 billion, with a possible valuation of about $2 trillion for Anthropic. Whether that scale is achievable depends on market conditions and the final structure of the deal, including investor demand and how much of the funding is actually raised through new shares versus other components of the transaction.

Still, the reported numbers highlight how quickly the market is adjusting to “mega-round” expectations around leading AI firms. Anthropic—positioned as a major player in frontier models—would be entering a public market environment where investor appetite for AI-related exposure is already shaped by years of capital inflows and competition for computing resources.

Context: Nvidia’s push across the AI stack

The Nvidia-Anthropic story arrives after Nvidia moved to broaden its influence beyond hardware. Earlier this month, Cointelegraph reported that Nvidia agreed to acquire Hugging Face for $12.9 billion, a deal intended to expand Nvidia’s reach into AI software and the tools developers use to build and deploy models.

Cointelegraph noted that Hugging Face serves more than 18 million developers and hosts over three million models, quoting Nvidia CEO Jensen Huang’s remarks. The acquisition, Cointelegraph reported, would give Nvidia control of a major platform for AI models as companies increasingly compete across chips, software, and developer ecosystems.

That background matters because a potential Nvidia backer role in Anthropic could be seen as another step in the same broader strategy: linking foundational compute (chips), model development and deployment infrastructure (model and developer platforms), and high-impact frontier model providers.

Deals around compute capacity underscore the demand

Nvidia’s potential involvement with Anthropic also fits into a larger pattern of AI-related infrastructure contracting. Cointelegraph previously reported that Bitcoin miner Riot Platforms secured a 20-year agreement to supply 191 megawatts of capacity from its Rockdale, Texas, campus to a “leading frontier AI” company.

Cointelegraph said the customer was Anthropic, and cited Bloomberg’s reporting that the deal was valued at about $9 billion, again referencing people familiar with the matter. Agreements like this reflect how aggressively AI builders and compute providers are trying to lock in long-duration supply as demand for processing power continues to rise.

In that context, a potential IPO of Anthropic at a valuation near $2 trillion would not just be a financial event—it would be one of the clearest public signals yet about how much capital the market believes frontier AI companies need and how seriously investors are pricing them.

For now, the key unknown is how these negotiations resolve: Reuters’ reporting leaves open both the final fundraising amount and whether Nvidia’s role materializes in the way described. Investors and observers will want to watch for confirmation from the companies, more detailed deal terms, and how market appetite for large AI IPOs evolves as discussions move from talks to filings.