Rogue developer wants to extort our startup. What would you do?

An obvious question: why do you openly identify your company? It doesn't seem in your best interest, as you are coming out as reckless and/or naive: how can hiring an Iranian casual contractor be considered a good idea for any USA-based company? Do you need a lawyer to advise against it? Whom else are you sharing source code with? Are you equally cavalier with customer data?

Posting the name of this person might turn out to be another bad move: your hypothetical NDA is completely ineffectual magical thinking, his potential lawsuit for breach of contract, defamation etc. could bite.