verilymerrily
Right now, your biggest problem is not losing your job, but your fear of losing your job. The attacker has weaponized this against you. You say you are in a bad situation financially, but you also mentioned you could do a non-dev job as a stop gap. That implies to me that losing the job would be a set back, but not a catastrophic set-back. You could find another dev job eventually.
Then the first thing to do is reassure yourself that the fear of losing your job is almost surely disproportionately large relative to how bad it would actually be.
Secondly, you remove the weapon. Either tell you company that this happened, following the useful advice in the comments on how to do that. Alternatively, take a note from Trump and Shaggy -- commit to outright denial no matter what. Even if you sent photos that include your face and your company badge, deny-deny-deny!
Either way, make a commitment to accept whatever comes next.
The weapon is your primary obstacle, because you've given money. Now the scammer will try to bleed you even if you switch jobs.
Countries don't just spring up and start offering passports. A country isn't a country unless other countries recognize it as such. That's why calling Taiwan a country or a part of China is such a big deal. If doing so would undermine their own sovereignty and monopoly on power, why would they do this?
If something like this happens, it won't be island counties trying to attract digital nomads. It will be big tech companies who want to create little city-states of tech workers without having to worry about laws and immigration restrictions.