"Speed is everything," says a crypto compliance officer tracking DPRK-linked hacks. The latest wave of North Korean crypto thefts has become a blur of rapid chain hopping and intricate swaps, making it nearly impossible to freeze stolen funds early on. This evolution means stolen assets move from exploit to cash-out points in a matter of minutes, leaving defenders just moments to react.
The laundering process unfolds in clear stages. First, hackers exploit vulnerabilities like bridge bugs or compromised keys to siphon funds into fresh wallets. Then the real scramble begins: assets go through multiple cross-chain bridges to obscure their origins. These bridge hops break the usual on-chain tracking heuristics by spreading funds across various blockchains, followed by swaps through no-KYC platforms and decentralized exchanges that convert tokens into stablecoins in fragmented transactions. Splitting the amounts into smaller packets and shuffling them through layered wallets helps avoid detection while strengthening obfuscation.
Once the cryptocurrency gets consolidated into liquid stablecoins, the final phase involves off-chain cash-out mechanisms. According to reports cited by CoinDesk, DPRK groups rely heavily on OTC brokers willing to accept stablecoins in return for dollars or yuan, often breaking down transfers into tiny sums to evade regulatory scrutiny. These brokers operate mostly outside stringent KYC requirements, acting as the linchpin for converting crypto proceeds into fiat outside the banking system. This method helped North Korea dominate crypto-related losses in the first half of 2026: April alone saw nearly $577 million stolen during the Drift and KelpDAO incidents, constituting around two-thirds of all losses tracked by TRM Labs.
What complicates defenses is timing. The gap between breach and bridge move is razor-thin sometimes just minutes so proactive measures demand rapid intelligence sharing and escalation plans ready at a moment’s notice. The reliance on liquid stablecoins and fragmented transfers means that once funds hit a bridge and perform a couple swaps, freezing those assets becomes a race against time. This fast-paced laundering model contrasts sharply with traditional money laundering where slower, more manual processes prevail, underscoring the need for cutting-edge analytics and timely action.
