A group of IT experts in North Korea has been arrested for embezzling state funds through hacking and cryptocurrency.
In Pyongyang, authorities have arrested a group of IT specialists connected to a scheme that involved hacking two state banks to embezzle funds via cryptocurrency. This operation was reportedly conducted by former military personnel from the cyber divisions of North Korea's Main Intelligence Directorate, who collaborated with university graduates.
Operation Details
The group successfully infiltrated the Central Bank of North Korea and the Foreign Trade Bank, gaining access to sensitive networks and international payment systems. To avoid detection, they utilized encrypted messaging apps and Chinese wireless devices.
Stolen funds were discreetly transferred to overseas cryptocurrency wallets and converted through intermediaries in China. The illicit assets were then moved to border regions like Sinuiju and Hyesan for cash exchanges in dollars and yuan.
Investigation and Arrests
Authorities became alerted when discrepancies were discovered during foreign currency reconciliations. Additionally, unusual access attempts from foreign IP addresses raised suspicions. The state information bureau initiated an investigation that traced encrypted cryptocurrency transactions to a specific location in Pyongyang.
On July 12, security forces raided the identified hideout, apprehending all suspects and confiscating computer equipment valued at hundreds of thousands of dollars, along with devices registered under fake names. Following the arrests, increased security measures were implemented at both banks, and the city was monitored by interception vehicles.
"They were taught technologies to protect the country, yet they plundered the state treasury," a source commented.
Notably, in the first half of 2026, North Korean cyber groups were responsible for around 66% of total funds stolen in the cryptocurrency sector, amounting to approximately $643 million, according to TRM Labs.
