North Korea is increasingly using criminal networks to launder stolen cryptocurrency, complicating tracking efforts and supporting its weapons programs.
According to the Royal United Services Institute (RUSI), North Korea is increasingly leveraging established criminal financial networks to launder stolen cryptocurrencies, instead of relying on isolated infrastructures.
The report identifies various methods for transferring these funds, including over-the-counter (OTC) services, peer-to-peer (P2P) trading, illicit exchanges, mixers, cross-chain bridges, and scam-related platforms.
From January 2024 to September 2025, North Korea is projected to have stolen at least $2.8 billion in digital assets, which reportedly support the nation's weapons of mass destruction initiatives. The researchers emphasize that the transformation of these funds into fiat currency is less transparent than on-chain laundering methods.
Criminal Intermediaries in Action
Once the funds are initially transferred, North Korean operatives can pass on the cryptocurrency to external money launderers. For instance, following a $1.5 billion breach of the Bybit exchange in February 2025, a network of OTC and P2P traders—many of whom were Chinese nationals—was involved in laundering the funds. This network operated continuously to convert the stolen cryptocurrency into fiat and cash. By September 2025, reports indicated that all funds from the Bybit hack had been successfully cashed out, as noted by the international monitoring group MSMT.
During the laundering process, the cryptocurrency often traverses numerous addresses and multiple blockchains, complicating ownership tracking. Researchers have observed that changes in transaction behavior can sometimes reveal the flow of funds from North Korean operators to their external laundering partners.
Connections to Crypto Scams
RUSI has highlighted the links between North Korean funds and the crypto scam sector. Investigations have uncovered evidence of North Korean assets being mixed with proceeds from "pig butchering" scams, which involve scammers building trust with victims before persuading them to invest in fraudulent projects.
Underground platforms, primarily operating in Chinese on Telegram, play a significant role in these laundering activities. These so-called guarantee marketplaces offer money-laundering services and tools for conducting illegal transactions. Elliptic has documented instances where funds from North Korean hacks were funneled through these platforms, such as transactions involving the WazirX breach, where funds were consolidated and sent to linked addresses.
Breaking Down Transactions
To further facilitate the laundering process, large sums are often broken down into smaller transactions. For example, North Korean operatives might sell stablecoins in batches of approximately $7,000 on P2P marketplaces, thereby reducing the risk of detection under anti-money laundering (AML) regulations. ZeroShadow has noted that transaction sizes may be lowered to around $30,000 to minimize the impact of any potential freezing of funds.
Pre-prepared wallets are utilized to automatically distribute assets to designated addresses, with identified endpoints including P2P marketplaces in South Asia and unregulated exchanges in Latin America. After several stages of processing, North Korean funds become nearly indistinguishable from other criminal cryptocurrencies, creating significant challenges for exchanges and crypto companies trying to trace the origins of the funds.
RUSI experts assert that the strength of North Korea's laundering strategy lies not in a singular secret channel, but in its ability to integrate stolen cryptocurrency into existing networks of illegal exchanges, P2P systems, and crypto scams. This integration allows the regime to exploit external infrastructures and complicates the efforts to block funds at the final stages of conversion into cash.
In May, analysts from CertiK indicated that North Korean hacker groups have evolved their cryptocurrency theft operations into a state-sponsored initiative, complete with a sophisticated money laundering framework and a network of IT professionals.
