- North Korea reportedly arrested former military hackers for stealing from two state-owned banks and laundering the funds via crypto, though the claims remain unverified.
- The alleged laundering network used crypto wallets, Chinese OTC brokers, and border cash couriers, mirroring tactics seen in past DPRK-linked operations.
- North Korean hackers have stolen over $6 billion in crypto since 2017, making this a rare case where the regime is allegedly the victim rather than the perpetrator.
North Korea has arrested a ring of former military hackers accused of breaking into two of the country’s own state banks and washing the stolen money through cryptocurrency. However, the claim could not be independently verified.
The arrests occurred on the night of July 12, when National Intelligence Agency officers raided a safe house in the capital and, according to the source, caught the plotters at their computers in the midst of laundering hundreds of millions of dollars. The agents confiscated disposable cellphones and other equipment worth hundreds of thousands of dollars.
After that, armed officers isolated the Foreign Trade Bank’s headquarters and the computer center of the Chosun Central Bank, the Korean state bank issuing the local currency, preventing any access to them from the outside world. The source added that vehicles equipped to track down mobile phone signals scoured Pyongyang for the rogue radio waves.
The report linked the arrests to the discovery of discrepancies in the approvals of foreign-currency transfers and strange foreign IP addresses.
Rogue cyber veterans turned on North Korea
What upset officials, the source said, was that the ringleaders were discharged personnel from a cyber unit of the Reconnaissance and Intelligence General Bureau, the military intelligence agency of North Korea, who had been involved in operations overseas. After being discharged, they recruited young technical specialists from Kim Chaek University of Technology and Pyongyang University of Science and formed a clandestine network to siphon off funds without the knowledge of the state security apparatus.
The reason for the crime, according to the source, was personal gain rather than political or ideological beliefs. This also makes the incident unique, since it involves Pyongyang’s own cyber tools being used against the system. One of the officials said that in addition to standard disciplinary measures, the families of those involved would have to live in perpetual fear since the punishment “will be hard for the entire family line to survive.”
The modus operandi was similar to how state-sponsored hackers usually launder cryptocurrency proceeds in China. The hackers’ networks transferred foreign currency and state trading company funds in small batches from internal bank accounts to cryptocurrency wallets abroad.
There, the digital assets were exchanged for Chinese yuan and US dollars through crypto-exchange brokers in China. Transfers of physical cash were made through local intermediaries in the border cities of Sinuiju, in North Pyongan province, and Hyesan in Ryanggang province. Encrypted messengers, unregistered mobile phones, and Chinese-made satellite communication devices were used to conceal the identities of the participants in the scheme.
North Korea is the buyer and the victim this time
The significance of the latest incident lies in the fact that North Korea is typically on the opposite side in such schemes. According to TRM Labs data, state-sponsored hackers are behind 76% of all value stolen in crypto heists through April 2026, or roughly $577 million, most of it from just two operations. A $285 million exploit on April 1 and a $292 million exploit of KelpDAO on April 18.
TRM puts the regime’s cumulative crypto theft at above $6 billion, which was withdrawn from the compromised Drift Protocol smart contract, and about 6 billion in total since 2017. According to blockchain intelligence company Chainalysis, North Korean hackers stole a record 2 billion in crypto during the past fiscal year.
A multinational coalition of monitors of sanctions against North Korea concluded that Chinese over-the-counter currency dealers played a crucial role in facilitating the conversion of crypto proceeds from North Korean hackers into cash, as this criminal scheme also suggests.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
Who arrested the hackers and when?
North Korea's National Intelligence Agency, formerly the Ministry of State Security, arrested the suspects at a Pyongyang safe house on the night of July 12, according to Daily NK.
How did the group launder the stolen money?
They moved foreign currency and state funds from the banks into overseas crypto wallets in small increments, then used Chinese brokers and contacts in the border cities of Sinuiju and Hyesan to convert the coins into U.S. dollars and Chinese yuan.
How much crypto have North Korean hackers stolen overall?
TRM Labs puts North Korea's cumulative crypto theft above $6 billion since 2017, including about $577 million in 2026 through April, while Chainalysis estimated the regime stole a record $2 billion last year.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Ashish Kumar
Ashish Kumar is a crypto and financial journalist with eight years of newsroom experience. He covers what’s happening with crypto markets, regulation, DeFi, and exchange ecosystems. He has worked with Coingape, Todayq, and Newsroompost. Ashish holds a PGDP in English Journalism from the IIMC. He has also interviewed industry figures including Arthur Hayes, Yat Siu, Austin Federa, and more.
