---
title: "OnlyFake Sold 10,000 AI Fake IDs at $15 Each, Then the UN Came Looking for North Koreans"
description: "A $15 AI fake-ID generator built by one Ukrainian coder fed North Korea’s remote-worker fraud, and keeps reappearing after each takedown."
author: "Luis Goa"
published: 2026-11-05T14:16:07Z
modified: 2026-11-05T15:39:24Z
url: https://rews.cc/a/onlyfake-sold-10-000-ai-fake-ids-at-15-each-then-the-un-came-704eaa
language: en
tags: ["ai", "fraud", "cybersecurity", "identity", "north-korea", "tech"]
publisher: "Rews (https://rews.cc)"
---

# OnlyFake Sold 10,000 AI Fake IDs at $15 Each, Then the UN Came Looking for North Koreans

*A $15 AI fake-ID generator built by one Ukrainian coder fed North Korea’s remote-worker fraud, and keeps reappearing after each takedown.*

By Luis Goa · November 5, 2026 · https://rews.cc/a/onlyfake-sold-10-000-ai-fake-ids-at-15-each-then-the-un-came-704eaa

## In brief

- OnlyFake sold 10,000+ AI-generated fake IDs at ~$15 each, taking in $1.2 million in crypto, 2021-2024
- UN’s North Korea sanctions panel asked creator Yuriy Nazarenko for a list of DPRK IT workers using the site
- Nazarenko was extradited from Romania in September 2025, pleaded guilty, and was sentenced in June 2026 to time served
- After sentencing he spent two more months in ICE detention before deportation to Ukraine in August 2026
- Despite the prosecution, the service reportedly kept running and rebranded twice, to MacDoc then Verif2Go

From 2021 to 2024, a site called OnlyFake sold more than 10,000 fake identity documents at roughly $15 apiece, and took in $1.2 million in cryptocurrency doing it, according to the U.S. Department of Justice’s announcement of the guilty plea of its creator, Yuriy Nazarenko. The documents covered all 50 U.S. states and 56 countries. The business problem OnlyFake solved was simple: identity verification, or KYC (“know your customer”), mostly runs on a photo of a government ID plus some automated checks on that photo. Beat the photo, and you beat the check. OnlyFake automated beating the photo.

Nazarenko, now 28 and living in Asia after a year split between prison and immigration detention, told [404 Media’s Joseph Cox](https://404media.co/the-confessions-of-an-ai-fraud-kingpin-onlyfake-owner-nazarenko/) — the reporter who first exposed the site in 2024 — how he built it, who ended up using it, and what happened once the U.S. government and the United Nations both came looking.

## From Photoshop to a template engine

Nazarenko started by hand-editing scanned passports in his grandfather’s apartment outside Odesa: the MRZ (machine-readable zone, the line of fixed-width characters at the bottom of a passport page) had to match the document’s issuing country and check digits; the portrait had to sit inside the document’s security pattern; the layout had to match that country’s specific template. A single high-quality fake could take a week. That doesn’t scale, so he built software to do it: a customer enters a name and other personal data, uploads a face, and the software auto-populates a template pulled from a library of real ID scans Nazarenko had been buying piecemeal over Telegram. He added two AI components once off-the-shelf generative models got good enough: a bank of synthetic faces, and synthetic desk, carpet and sofa backgrounds, so the final output looked like a phone photo of a physical card rather than a Photoshop render.

[![What Is OnlyFake? It's An AI Fake ID Generator | Techmeme Ride Home Podcast](https://i.ytimg.com/vi/mltPaUp7IOg/hqdefault.jpg)](https://www.youtube.com/watch?v=mltPaUp7IOg)

404 Media’s own explainer on how OnlyFake generated its AI fake IDs. Video: Tech Brew Ride Home Podcast · YouTube

**How OnlyFake turned a photo into a bypassed ID check** The generation pipeline, per Nazarenko's account and the DOJ's description of the service

| From | To | How |
| --- | --- | --- |
| Customer *(name, photo, crypto payment)* | Template engine *(fills MRZ, ID numbers, layout)* | data + photo |
| Scan library *(real ID scans bought via Telegram, 56 countries + 50 US states)* | Template engine *(fills MRZ, ID numbers, layout)* | template |
| AI generator *(synthetic faces and backgrounds)* | Template engine *(fills MRZ, ID numbers, layout)* | face/background |
| Template engine *(fills MRZ, ID numbers, layout)* | Fake ID photo *(mimics a phone snapshot)* | renders |
| Fake ID photo *(mimics a phone snapshot)* | KYC check *(bank or exchange account opening)* | opens account |

Based on [404 Media reporting on OnlyFake](https://404media.co/the-confessions-of-an-ai-fraud-kingpin-onlyfake-owner-nazarenko/)

The result removed the forger as a middleman. Nazarenko’s framing: other criminals were selling fish, he was selling the fishing rod. Pricing matched that framing, scaling from one-off purchases to a bulk tier aimed at operators who needed many identities at once.

**What OnlyFake charged** Pricing tiers as described to 404 Media

| Tier | Price | Included |
| --- | --- | --- |
| Single generation | $15 | One fake ID image |
| Light | $99/month | 10 generations |
| Ultimate | $1,500/month | Bulk spreadsheet upload, dedicated Telegram support rep |

Source: [404 Media reporting on OnlyFake](https://404media.co/the-confessions-of-an-ai-fraud-kingpin-onlyfake-owner-nazarenko/)

> OnlyFake was the first time I saw how quickly a small internet project could turn into something global. Unfortunately, it also taught me, in a very painful way, what can happen when the scale of something grows faster than your understanding of its consequences.

## The UN wanted a client list

On February 26, 2024, an email arrived at OnlyFake’s listed contact address on UN letterhead. It came from the Panel of Experts monitoring sanctions on North Korea, and it stated plainly that the Panel had received information that DPRK IT workers had used the service. The letter asked Nazarenko to hand over a list of North Korean users, copies of every document OnlyFake had generated for them, and whatever steps, if any, OnlyFake had taken to block them. Nazarenko did not comply. He told Cox the letter was the moment he first understood the operation had outgrown his grip on its consequences; his lawyer later showed the same letter to the FBI as evidence of who the platform’s clientele actually was.

The UN’s interest tracks a pattern documented elsewhere: North Korea runs thousands of IT workers abroad under false identities, instructing them to remit most of their wages to the state, which U.S. prosecutors say helps fund its weapons programs. A [38 North analysis](https://www.38north.org/2025/10/the-global-threat-of-dprk-it-workers/) of the scheme puts its annual revenue between $250 million and $600 million, spread across operatives in more than 40 countries — a figure built from sanctions-monitoring and intelligence reporting, not from any single company’s books, and so a wide range rather than a precise count. Getting past a freelance platform’s or payment processor’s identity check is a prerequisite for that whole scheme, which is presumably what the DPRK workers wanted OnlyFake for. North Korea’s state-linked operators have also moved far larger sums through cruder means: [rews reported](https://rews.cc/a/binance-s-6-34-billion-hack-ran-on-a-pectra-feature-and-a-fa-eb4fc3) on the $6.34 billion taken from Binance via a fake job offer, and on a [separate $387 million theft from Bitget](https://rews.cc/a/chainalysis-says-north-korea-took-bitget-for-387m-and-its-ai-fd3fb2). Fake IDs and stolen crypto are different lines of the same ledger.

The UN letter also named a second site, PassportCloud, which sold Photoshop templates for fake IDs and utility bills under the same “John Wick” branding Nazarenko used — the letter said North Korean workers used it to fabricate bank statements and credit cards. Cox had found PassportCloud before OnlyFake and asked Nazarenko directly, more than once, whether he ran it too. Nazarenko never confirmed or denied it.

## A $1.2 million forfeiture, a 15-year ceiling, a year served

Nazarenko’s own habit of cashing out Bitcoin under his real identity made him traceable. Undercover FBI agents also simply bought fake IDs from the site, which took only cryptocurrency. He was detained at a Bucharest border crossing on June 13, 2025, after a border officer flagged a U.S. warrant, spent three months in Romanian custody, and was extradited in September 2025. The [Southern District of New York’s announcement](https://www.justice.gov/usao-sdny/pr/creator-onlyfake-charged-and-pleads-guilty-selling-more-10000-digital-fake) of his charge and guilty plea lists conspiracy to commit fraud in connection with identification documents and authentication features — a charge carrying a maximum of 15 years — and records his agreement to forfeit the $1.2 million in proceeds.

![Gray handcuffs linked by a short chain overlap a cream identification card with a silhouette portrait against a bright blue background.](https://rews.cc/img/f062f15f8ab323b2ddf9b4aae89b18bccb465af5.webp)

He was sentenced on June 26, 2026, to time served: about 12 months, counting the Romanian jail and New York’s Metropolitan Detention Center, where he says he was assaulted by other detainees and moved within the facility. Twelve months against a 15-year ceiling is a wide gap, and the likely reason is one of attribution rather than leniency: prosecutors could establish that OnlyFake made and sold fake documents, but not that any specific victim lost money because of a specific document, which is the kind of harm federal sentencing guidelines weigh heavily. Nazarenko’s lawyer says prosecutors declined his offer to cooperate.

Sentencing didn’t end his detention. Expecting to self-deport, he was instead held by ICE for roughly two more months, in conditions he describes as worse than prison — sleeping on the floor, and a detainee death at the facility he was held in. He was deported on August 17, 2026, on a charter flight to Poland, then moved overland into Ukraine. He says he was drafted at a military enlistment office shortly after, escaped, and left Ukraine on foot before flying to Thailand.

> It was much, MUCH worse than prison.

## The product outlived the founder’s freedom

The FBI’s case cost OnlyFake its founder, but not its market. Cox’s original February 2024 report — [the one that first exposed the site](https://www.404media.co/inside-the-underground-site-where-ai-neural-networks-churns-out-fake-ids-onlyfake/) — drove the original domain offline within days. By Nazarenko’s lawyer’s account, though, the site kept running for much of his client’s year in custody regardless. The identity-verification firm Resistant AI later traced the same forum accounts, the same advertising copy — edited after the fact to swap names — and the same technical fingerprints (correct MRZ strings, jurisdiction-accurate ID numbering, fake phone-camera metadata stamped on each output image) to a rebrand called [MacDoc](https://resistant.ai/blog/onlyfake-macdoc). Within three months of that report, Resistant AI found the operation had rebranded again, to [Verif2Go](https://resistant.ai/blog/onlyfake-macdoc-verif2go), and suggested its own reporting may have forced the move by wrecking MacDoc’s search visibility.

Two rebrands in under a year, each apparently cheap enough to not interrupt sales, says something about where the actual value sits in this business: not in a domain name or a company structure, which are disposable, but in the years of accumulated ID scans, the rule-based template engine, and the forum reputation built under names like John Wick. A $1.2 million forfeiture and a founder’s conviction removed one operator. It left the template library, the rendering code and the demand from North Korea’s IT-worker pipeline untouched. The number worth watching next is whether any federal indictment reaches the operators actually running Verif2Go — or whatever it calls itself when this is read.