Chainalysis describes how DPRK IT workers infiltrate global technology companies to earn cryptocurrency that can support North Korea’s weapons programs. The workers use facilitators such as Chinyong, VPNs, fraudulent or stolen identity documents, and AI voice or face tools to conceal their location and identity while seeking remote roles. Once paid, often in stablecoins, the funds are moved through chain-hopping, token swaps, decentralized exchanges, bridges, mainstream exchanges, and intermediaries including sanctioned figures such as Sim Hyon Sop and Lu Huaying. The report links this activity to recent OFAC, MOFA, and DOJ actions and explains how blockchain analytics can identify salary-like payment flows, consolidation, layering, and off-ramp patterns. It matters because the same indicators help employers, exchanges, and investigators disrupt revenue pipelines used for sanctions evasion.