North Korean authorities have arrested a group of former military hackers suspected of stealing funds from two state banks and laundering the money through cryptocurrency channels. The suspects reportedly infiltrated the internal systems of the Central Bank of the DPRK and the Foreign Trade Bank, diverting foreign currency and trade funds into crypto wallets overseas.
According to a report by Daily NK, which cited an anonymous source in Pyongyang, the hackers converted the stolen assets into cryptocurrency and then relied on Chinese brokers to exchange those digital assets for cash in U.S. dollars and yuan. This conversion process took place in border cities like Sinuiju and Hyesan, where the group used encrypted messaging apps, unregistered phones, and Chinese wireless equipment to execute small transfers and avoid detection.
The North Korean National Intelligence Agency apprehended the suspects at a safe house in Pyongyang on July 12. The arrests followed the discovery of irregularities in foreign-currency payment approvals and suspicious overseas IP activity. This laundering method reflects tactics previously attributed to North Korean hacking groups, which involve breaking down large sums into small amounts and employing sophisticated communication tools to slip under the radar.
External reports have highlighted the key role played by Chinese over-the-counter traders and financial institutions in converting cryptocurrency stolen by operators linked to Pyongyang into traditional fiat currencies. Data from Chainalysis revealed that North Korean hackers managed to steal a record $2 billion in crypto assets last year. also TRM Labs estimated that these actors were responsible for about 76% of all crypto hack and scam losses through April 2026.
