Authorities in North Korea have apprehended a group of former military hackers who are suspected of stealing funds from two state banks and laundering the money through cryptocurrency transactions.
According to a report from Daily NK, which cites an anonymous source in Pyongyang, the hackers allegedly infiltrated the systems of the Central Bank of the Democratic People's Republic of Korea and the Foreign Trade Bank. They reportedly diverted foreign currency and state trade funds into overseas cryptocurrency wallets.
This report has not been independently verified.
The hackers then used Chinese brokers to convert the cryptocurrency into U.S. dollars and yuan. Sources in the border cities of Sinuiju and Hyesan reportedly facilitated real-time cash exchanges for the cryptocurrency, employing strategies such as breaking up transactions into smaller amounts to evade detection. They communicated using encrypted messaging apps, unregistered mobile devices, and Chinese telecommunications equipment.
The suspects were arrested by North Korea’s National Intelligence Agency on July 12, following the discovery of irregularities in foreign currency payment approvals and unusual overseas IP activity, as per the report.
The laundering techniques used are consistent with methods previously identified in North Korean hacking operations aimed at converting stolen cryptocurrency into cash.
A multinational report on sanctions indicated that Chinese over-the-counter traders and financial institutions play a crucial role in the conversion of cryptocurrency stolen by North Korean-linked operators into fiat currency.
In 2025, North Korean hackers were reported to have stolen an unprecedented $2 billion in cryptocurrency, as noted by Chainalysis. Furthermore, TRM Labs estimated that they accounted for approximately 76% of the total losses from crypto hacks and scams through April 2026.