North Korean authorities have reportedly arrested a group of former state cyber operators and IT specialists accused of hacking two state-run banks and laundering stolen funds through cryptocurrency.

According to South Korean outlet Daily NK, which reported the arrests on Thursday citing an anonymous source in Pyongyang, the group allegedly breached the internal networks of North Korea's central bank and the Foreign Trade Bank. The suspects are said to have converted stolen state funds into cryptocurrency before laundering them through China-based brokers—a route that UN investigators and cybersecurity firms have previously documented as a common channel for moving illicit North Korean crypto proceeds.

Cointelegraph, which first reported the story in English, noted that it could not independently verify the account.

If confirmed, the arrests would represent an unusual case in which North Korean cyber operatives have been accused of targeting their own government's financial institutions. North Korea's central bank, formally known as the Central Bank of the Democratic People's Republic of Korea, serves as the country's primary monetary authority, issuing currency and managing state accounts within a largely cash-based, centrally planned economy. The Foreign Trade Bank functions as North Korea's principal institution for handling foreign currency transactions and international trade settlements. The U.S. Treasury Department sanctioned the Foreign Trade Bank in 2013 for its role in supporting North Korea's weapons of mass destruction programs, effectively cutting it off from the U.S. financial system.

Pyongyang is widely accused by international governments and cybersecurity firms of directing state-backed hacking groups—commonly linked to the Lazarus Group and other units associated with the Reconnaissance General Bureau—to steal from cryptocurrency companies and financial institutions worldwide. These operations are alleged to generate hard currency revenue for the sanctions-constrained regime. In 2024, the United Nations Panel of Experts reported that North Korean cyber actors had stolen an estimated $3 billion in cryptocurrency over preceding years through attacks on exchanges, bridges, and decentralized finance platforms. The reported arrests, if accurate, would mean that individuals trained within that same cyber apparatus directed their capabilities inward against state financial infrastructure rather than at foreign targets.

The U.S. Federal Bureau of Investigation and the Treasury Department have sanctioned multiple North Korean hacking entities for their roles in crypto theft and money laundering activities.

Daily NK is a Seoul-based specialist news organization that reports on developments inside North Korea using a network of sources within the country. Independent verification of reporting from North Korea remains extremely difficult due to the government's strict controls on foreign access, communications, and information flow.

Related coverage from Cointelegraph: Consensys unknowingly outsourced developer work to North Korean personnel, and losses from DPRK-linked hacks rose 51% year over year.