A group of IT specialists has been arrested in Pyongyang for hacking into the internal systems of two North Korean state banks and siphoning off stolen assets through cryptocurrency, according to a report by Daily NK, citing a source in the capital.
Details of the Arrest
The source revealed that the operation was led by retired military personnel from the cyber units of the country’s Main Intelligence Directorate. After their service, they recruited graduates from Kim Il Sung University and Pyongyang University of Natural Sciences.
The group managed to gain access to the internal networks of the Central Bank of North Korea and the Foreign Trade Bank, as well as the international payment system. The Central Bank is responsible for issuing and managing state funds, while the Foreign Trade Bank handles foreign currency transactions. To evade detection, the hackers reportedly used Chinese wireless equipment and encrypted messaging apps.
Funds were transferred in small amounts to overseas cryptocurrency wallets. The assets were converted to cryptocurrency through Chinese brokers before being funneled to the border areas of Sinuiju and Hyesan, where they were exchanged for cash in dollars and yuan.
How the Group Was Discovered
Authorities became suspicious due to discrepancies in the amounts during foreign currency payment reconciliations in Pyongyang. Simultaneously, there were recorded attempts to access the system from foreign IP addresses. The state information bureau launched an internal investigation.
The bureau traced the encrypted traffic of the cryptocurrency transactions back to a hideout in Pyongyang. According to the source, the location was raided on the night of July 12, and all members were apprehended on-site. Authorities seized computer equipment worth hundreds of thousands of dollars and phones registered under false identities.
Following the arrests, armed guards were deployed outside both banks, and radio interception vehicles were dispatched throughout the city. The source mentioned that harsh sentences are expected for those involved.
"They were taught technologies to protect the country, yet they plundered the state treasury," he stated.
It is noteworthy that in the first half of 2026, North Korean-linked groups accounted for approximately 66% of all funds stolen in the cryptocurrency sector, totaling around $643 million, as reported by TRM Labs.