North Korea Arrests Its Own Hackers for Looting State Banks Through Crypto
North Korea reportedly arrested former state cyber operators accused of stealing from its central bank and Foreign Trade Bank, then laundering the funds through crypto and Chinese brokers.
In Brief
- North Korean authorities reportedly arrested former state cyber operators and IT specialists accused of hacking the country’s central bank and Foreign Trade Bank and laundering stolen funds through cryptocurrency
- According to Daily NK, the group converted stolen state funds into crypto, moved them to overseas wallets, and used Chinese brokers to cash out into US dollars and yuan while splitting transfers to avoid detection
- If confirmed, it would be a rare case of North Korean operators stealing from their own government—Pyongyang is widely accused of directing hackers to steal from crypto firms, taking a record $2 billion last year per Chainalysis
North Korean authorities have reportedly arrested a group of former state cyber operators and IT specialists accused of hacking two state banks and laundering the stolen funds through cryptocurrency, CoinDesk reported. The case, if confirmed, would mark a rare instance of Pyongyang-linked hackers turning on their own government’s financial institutions.
South Korean outlet Daily NK reported Thursday, citing an anonymous source in Pyongyang, that the group breached the internal networks of North Korea’s central bank and the Foreign Trade Bank, diverting foreign currency and state trade funds and moving the money into overseas crypto wallets. Cointelegraph noted it could not independently verify the report.
Chinese brokers then converted the assets into US dollars and yuan, according to Daily NK. Contacts in the border cities of Sinuiju and Hyesan allegedly exchanged the crypto for cash in real time, with the group splitting transfers into small amounts to avoid detection and using encrypted messaging apps, unregistered phones, and Chinese wireless equipment.
How the crypto laundering ring was caught
North Korea’s National Intelligence Agency arrested the suspects at a Pyongyang safe house on July 12, after officials detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity, according to the report. The laundering route mirrors methods used by North Korean hacking groups to cash out stolen crypto more broadly.
A multinational sanctions-monitoring report has said Chinese over-the-counter traders and financial institutions play a central role in converting crypto stolen by Pyongyang-linked operators into fiat currency. That infrastructure is what allegedly let this group move state money offshore and back into usable cash.
Daily NK is a Seoul-based specialist outlet that relies on a network of sources inside North Korea, and reporting from the country is difficult to verify independently because of its restrictions on access and information. Cointelegraph stressed it could not confirm the account.
A twist on a familiar playbook
Pyongyang is widely accused of directing state-backed hacking groups to steal from crypto companies to generate revenue and circumvent international sanctions. What makes this case unusual is the target: if confirmed, it would be a rare instance of North Korean cyber operators accused of stealing from their own government rather than foreign exchanges or firms.
The scale of North Korea’s broader crypto theft is enormous. North Korean hackers stole a record $2 billion in crypto last year, according to Chainalysis, and TRM Labs estimated they accounted for 76 percent of crypto hack and scam losses through April.
The arrests underscore how deeply cryptocurrency has become embedded in the regime’s financial operations — both as a target and as a laundering vehicle — and how the same tools built to evade international sanctions can be turned inward against the state itself.
FAQ
What are the arrested North Korean hackers accused of?
According to Daily NK, they are former state cyber operators and IT specialists accused of hacking North Korea’s central bank and Foreign Trade Bank, converting stolen state funds into cryptocurrency, and laundering them through China-based brokers.
How was the crypto laundering ring detected?
North Korea’s National Intelligence Agency arrested the suspects at a Pyongyang safe house on July 12 after officials detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity.
How much crypto do North Korean hackers steal overall?
North Korean hackers stole a record $2 billion in crypto last year, according to Chainalysis, and TRM Labs estimated they accounted for 76 percent of crypto hack and scam losses through April.
