Arizona Woman Sentenced to 102 Months for $17M North Korean IT Worker Remote Work Fraud

Christina M. Chapman, a 50-year-old Arizona resident, has been sentenced to 102 months in federal prison for her role in a fraudulent scheme that enabled North Korean IT workers to infiltrate U.S. companies, including Fortune 500 firms. The operation, described as a “laptop farm” from her Litchfield Park home, involved hosting company-issued computers to create the illusion that North Korean operatives were U.S.-based employees. Over $17 million in illicit funds were generated through the scheme, with proceeds funneled to the North Korean regime [1]. Chapman also facilitated the theft of 68 U.S. identities, which were used to secure positions at a major television network, a Silicon Valley technology firm, and other organizations. False tax returns and fraudulent documents were submitted to the IRS and Department of Homeland Security, affecting over 70 individuals [2].

The scheme exploited vulnerabilities in remote hiring processes, particularly in the cryptocurrency and tech sectors. Chapman laundered money through her U.S. bank accounts, routing salaries to foreign agents. She admitted in February 2025 to charges of wire fraud conspiracy, aggravated identity theft, and money laundering conspiracy, though prosecutors emphasized her deliberate assistance to North Korea [3]. FBI Assistant Director Roman Rozhavsky noted that North Korea’s tactics rely on complicit intermediaries like Chapman, who act as “willing coadjutors” to circumvent sanctions [4].

The case highlights the broader threat posed by North Korea’s IT workforce, which the U.S. government has previously flagged as a tool to fund weapons programs. A 2022 State Department advisory warned that North Korean operatives often disguise their nationalities, using proxies, VPNs, and deceptive hiring practices to obscure their origins. The United Nations estimates that up to 3,000 North Korean IT workers operate globally, generating up to $600 million annually for the regime [5]. Chapman’s operation, one of the largest of its kind, underscores the risks of remote work vulnerabilities in the crypto industry, where trust in digital credentials can be exploited.

U.S. Attorney Jeanine Pirro described the scheme as a direct threat to “Main Street,” emphasizing how stolen identities and fraudulent payroll checks undermine both businesses and individuals. The DOJ has intensified scrutiny of crypto firms and remote work platforms following North Korea’s 2024 theft of $1.34 billion in cryptocurrencies—a 21% annual increase [6]. Alongside her prison sentence, Chapman must forfeit $284,555 and pay $176,850 in restitution to victims. Three North Korean co-conspirators remain at large, illustrating the challenges in prosecuting transnational cybercrime networks [7].

The case has sparked renewed attention on the role of social media and professional networks in enabling such schemes. Chapman, who operated as a TikTok influencer under the moniker “Bitmama,” initially connected with North Korean operatives via LinkedIn. While platforms like TikTok have not been directly implicated, her case raises questions about the risks posed by individuals with access to corporate systems and large online followings.

---

Source: [1] [Decrypt] (https://decrypt.co/331771/arizona-tiktoker-sentenced-17m-north-korean-worker-scheme/) [2] [Yahoo News] (https://www.yahoo.com/news/articles/woman-learns-fate-doj-guilty-000519350.html) [3] [SecurityWeek] (https://www.securityweek.com/us-targets-north-koreas-illicit-funds-15m-rewards-offered-as-american-woman-jailed-in-it-worker-scam/) [4] [Cointelegraph] (https://cointelegraph.com/news/arizona-woman-north-korea-crypto-scheme) [5] [The Record] (https://therecord.media/arizona-woman-sentenced-north-korean-laptop-farm)