DPRK IT Worker Laptop Farm Network (Operation Lonestar Roundup)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5hB78y…EStCSummary
Operation Lonestar Roundup is a coordinated U.S. law enforcement action, announced October 13-15 2026, dismantling a multi-year scheme in which North Korean IT workers used stolen and fabricated identities to obtain remote technology employment at more than 70 U.S. companies, generating approximately $3 million in revenue alleged to have been routed to DPRK-controlled entities in violation of international sanctions. The DOJ charged 14 individuals — two U.S. nationals arrested and ten Chinese nationals at large — for wire fraud, money laundering, and identity theft; the FBI separately dismantled over 40 residential laptop farms across Texas in raids conducted September 21-25 2026, seizing approximately 187 computers and KVM devices. The threat actor network has been designated 'Famous Chollima' by CrowdStrike and represents an active, ongoing infiltration risk particularly for crypto, Web3, and AI development teams.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(13 events)
1 January 2019
Alleged scheme begins: North Korean IT workers begin obtaining remote employment at U.S. companies using stolen and fabricated identities, with U.S.- and China-based facilitators operating residential laptop farms.
DOJ Office of Public Affairs1 December 2020
According to the Georgia indictment, Jong Pong Ju and Kim Kwang Jin are hired as remote developers at a blockchain research company and a Serbian virtual token company, respectively.
6abc Philadelphia1 February 2022
Jong Pong Ju allegedly modifies smart contract withdrawal logic and steals approximately $175,000 in cryptocurrency from employer token pool.
DOJ Office of Public Affairs — Nationwide Actions (July 2025)1 March 2022
Kim Kwang Jin allegedly modifies smart contract withdrawal rules and steals approximately $740,000 in cryptocurrency from employer funding pool.
DOJ Office of Public Affairs — Nationwide Actions (July 2025)1 May 2022
Joint State-Treasury-FBI advisory publicly warns of North Korean IT worker scheme for the first time, noting individual earnings of up to $300,000 per year.
DOJ Office of Public Affairs10 June 2025
FBI executes 29 search warrants across 16 states in a prior coordinated action, seizing 21 fraudulent websites, 29 financial accounts, and approximately 137 laptops in the Massachusetts-led investigation.
DOJ Office of Public Affairs — Nationwide Actions (July 2025)1 July 2025
DOJ unseals Georgia indictment charging Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il with wire fraud and money laundering; Massachusetts indictment against Zhenxing Wang and others announced concurrently; Kejia Wang enters guilty plea.
DOJ Office of Public Affairs — Nationwide Actions (July 2025)31 July 2025
Alleged scheme activity concludes, per the Lonestar Roundup indictment's stated operational period of 2019 through July 2025.
DOJ Office of Public Affairs2 August 2026
Eleven nations issue a joint advisory warning that North Korean IT workers are using real-time deepfake technology to defeat video-based hiring checks.
TechTimes21 September 2026
FBI begins Operation Lonestar Roundup: raids of over 40 residential laptop farms across Texas begin, spanning September 21-25 2026.
DOJ Northern District of Texas25 September 2026
Texas raids conclude; approximately 187 laptops and KVM devices seized from over 40 residences.
DOJ Office of Public Affairs13 October 2026
DOJ announces Operation Lonestar Roundup publicly; North Texas federal officials hold press conference announcing pending indictments.
CBS Texas14 October 2026
Federal grand jury indictment unsealed charging 14 individuals: Michael James Bostelle and Juan Cecilio Pena Carrillo arrested; 10 Chinese nationals and 2 sealed defendants charged but at large.
The Hacker NewsDecision Log
- slot 457814605 · hash Gj1wFGXuRP27zFqB3eK5tydK4EvznrdR5UD4fSwM9fkN
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 9 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/16/2026, 11:06:43 PM
last updated: 10/16/2026, 11:06:44 PM
avoid.net — verified advice for a post-truth world