North Korea has stolen over $2.8 billion in cryptocurrency, increasingly using organized crime for laundering, complicating tracking efforts.
Summary
- A report from the Royal United Services Institute states North Korea has stolen over $2.8 billion in cryptocurrency from January 2024 to September 2025, increasingly using organized crime networks for laundering.
- Stolen assets are often sold at discounted prices or mixed with funds from fraudulent schemes.
- Money mules from regions like the Philippines and China are frequently used to cash out stolen funds.
A recent analysis by the Royal United Services Institute (RUSI) highlights North Korea's growing reliance on organized crime networks for laundering stolen cryptocurrency, complicating efforts to trace these funds. The regime is estimated to have pilfered at least $2.8 billion in digital assets between January 2024 and September 2025, with indications that the money supports its weapons program.
The authors, Allison Owen and Noémi També, note that rather than utilizing well-known decentralized services, the regime is converting stolen assets into cash. Ownership of these assets often shifts hands prior to conversion, with third parties purchasing them at reduced rates. One investigator pointed out that these transactions can be traced when the stolen funds are found mixed with proceeds from scams like "pig butchering" or linked to entities such as Cambodia's Huione Group, which faced actions from the Justice Department.
Following the Bybit hack in February 2025, an incident response team discovered that North Korea was leveraging a network of money launderers and brokers, predominantly involving Chinese nationals. The group behind the hack, known as TraderTraitor, has utilized these organized crime networks to facilitate fund movements.
This overlap between North Korea's illicit activities and criminal networks poses significant challenges for compliance teams, blurring the lines between financing for proliferation and ordinary money laundering.
Money Mules and Small Transactions
To cash out stolen funds, accounts are often opened by money mules, predominantly from the Philippines, Indonesia, and China. These individuals are typically unaware of the true nature of the operations they are involved in. Transactions are frequently conducted in small amounts, around $7,000 in stablecoins, on peer-to-peer platforms to evade scrutiny from banks. Larger sums are split into chunks of about $30,000 to minimize freezing risks.
Accessing Cash
The cash-out process rarely involves direct bank transfers. Instead, proceeds from over-the-counter brokers are typically funneled into accounts controlled by North Korea through UnionPay cards issued by Chinese banks. The report highlights 19 Chinese banks that have been previously identified as facilitating these transactions.
Of the $1.5 billion stolen from Bybit, 95% was processed through decentralized platforms, with all funds converted to fiat by September 2025. The authors recommend improved regulatory frameworks for exchanges, including standardized onboarding processes and secure intelligence-sharing channels, to better identify such transactions.
Victims of these crimes are starkly affected, as illustrated by Bybit's recent legal actions against North Korea, which successfully froze and recovered $48.4 million in identified assets, along with an additional $30.5 million, representing about 5% of the total stolen funds.
