Ukrainian sentenced to 5 years in prison for aiding North Korean IT scheme

 

Ukrainian sentenced to 5 years in prison for aiding North Korean IT scheme

A Ukrainian national has been sentenced to five years in prison for providing stolen identities to North Korean IT workers who used them to infiltrate dozens of US companies.

Oleksandr Didenko, 39, of Kyiv, Ukraine, pleaded guilty in November 2025 to aggravated identity theft and conspiracy to commit wire fraud. He was arrested in Poland in May 2024 and later extradited to the United States.

A federal judge sentenced Didenko to 60 months in prison, followed by 12 months of supervised release. He also agreed to forfeit more than $1.4 million in cash and cryptocurrency seized from him and his accomplices.

According to court documents, Didenko stole the identities of US citizens and sold them to overseas IT workers through the UpWorkSell online platform, which has since been seized by the US Justice Department. The North Korean workers allegedly used the stolen identities to fraudulently obtain remote IT jobs with at least 40 US companies, including firms based in California and Pennsylvania.

Prosecutors said Didenko provided at least 871 proxy identities and related accounts across three freelance IT hiring platforms. He also helped establish and operate at least eight so-called “laptop farms” in Virginia, Tennessee, California, Florida, Ecuador, Poland, and Ukraine. The farms allowed North Koreans to fake their location and appear to be working from the United States while actually operating remotely from abroad.

One such set up was operated by Christina Marie Chapman, 50, of Arizona, who ran the scheme out of her home between October 2020 and October 2023. Chapman was charged in May 2024 and pleaded guilty in July 2025. She was later sentenced to 102 months in prison.

The case is part of a broader crackdown on North Korean IT worker schemes. In July 2024, U.S. authorities sanctioned, charged, or indicted 20 individuals and eight companies in three coordinated enforcement waves. A fourth round of sanctions followed in August 2025, targeting companies linked to similar operations allegedly run by Russian and Chinese nationals.


Back to the list