North Korea Arrests Hackers Accused of Laundering Stolen Bank Funds Through Crypto
Key Takeaways
- •Former military hackers were arrested for stealing state funds from the Central Bank of the DPRK and the Foreign Trade Bank, marking a rare case of Pyongyang-linked operators targeting domestic financial institutions.
- •The suspects laundered the stolen funds through cryptocurrency by using Chinese brokers and contacts in the border cities of Sinuiju and Hyesan to convert assets into U.S. dollars and yuan.
- •North Korea's National Intelligence Agency detained the group on July 12 after officials identified discrepancies in foreign-currency payment approvals and suspicious overseas IP activity.
- •The laundering methods described mirror techniques documented in multinational sanctions reports, which identify Chinese over-the-counter traders as key facilitators for converting stolen crypto into fiat.
- •North Korean hackers stole a record $2 billion in cryptocurrency last year and accounted for 76% of global crypto hack and scam losses through April 2026, according to Chainalysis and TRM Labs estimates.
North Korean authorities have arrested former military hackers accused of stealing state funds from two banks and laundering the proceeds through cryptocurrency, according to a Daily NK report citing an anonymous source in Pyongyang.
The case is unusual in that it involves North Korean operators targeting domestic financial institutions rather than the foreign crypto exchanges, DeFi protocols, and cross-border payment systems that Pyongyang-linked groups have historically attacked. The Central Bank of the DPRK and the Foreign Trade Bank both play central roles in managing the country's limited foreign currency reserves and facilitating state trade transactions.
The group allegedly breached the internal systems of the Central Bank of the DPRK and the Foreign Trade Bank, diverting foreign currency and state trade funds before transferring the money into overseas crypto wallets. The report could not be independently verified.
Chinese brokers subsequently converted the assets into U.S. dollars and yuan, Daily NK reported. Contacts in the border cities of Sinuiju and Hyesan allegedly exchanged crypto for cash in real time. Sinuiju sits across the Yalu River from the Chinese city of Dandong, a longstanding commercial gateway for DPRK-China trade, while Hyesan sits opposite Changbai in China's Jilin province. To avoid detection, the group split transfers into small amounts and relied on encrypted messaging apps, unregistered phones, and Chinese wireless equipment.
North Korea's National Intelligence Agency arrested the suspects at a Pyongyang safe house on July 12 after officials detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity, according to the report.
The laundering route described mirrors methods typically associated with North Korean hacking groups cashing out stolen crypto. A multinational sanctions-monitoring report found that Chinese over-the-counter traders and financial institutions play a central role in converting crypto stolen by Pyongyang-linked operators into fiat currency.
North Korean hackers stole a record $2 billion in crypto last year, according to Chainalysis. TRM Labs estimated that they accounted for 76% of crypto hack and scam losses through April 2026.
