Crime25 July, 20262 min read
North Korea Arrests Hackers Accused Of Laundering Stolen Bank Funds Through Cryptocurrency
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Arrests target former military hackers accused of stealing state funds. Hackers breached Central Bank and Foreign Trade Bank, diverted foreign currency and state funds.
Arrests in Pyongyang
North Korean authorities arrested former military hackers accused of stealing state funds from two banks and laundering the proceeds through cryptocurrency, according to a Daily NK report cited by CoinDesk. CoinDesk said the suspects were arrested at a Pyongyang safe house on July 12 after officials detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity.
The report, CoinDesk added, alleged the group breached the internal systems of the Central Bank of the DPRK and Foreign Trade Bank, diverted foreign currency and state trade funds, and moved the money into overseas crypto wallets. CoinDesk also said Chinese brokers then converted the assets into U.S. dollars and yuan, and contacts in the border cities of Sinuiju and Hyesan allegedly exchanged the crypto for cash in real time.
How the laundering worked
CoinDesk described a laundering route in which the group allegedly split transfers into small amounts to avoid detection and used encrypted messaging apps, unregistered phones and Chinese wireless equipment. CoinDesk also said the laundering route mirrors methods used by North Korean hacking groups to cash out stolen crypto, and it cited a sanctions-monitoring report saying Chinese over-the-counter traders and financial institutions play a central role in converting crypto stolen by Pyongyang-linked operators into fiat.
The LCX Exchange article, citing Daily NK and an anonymous source in Pyongyang, similarly said the group allegedly hacked the internal networks of North Korea’s central bank and the Foreign Trade Bank, converting stolen state funds into cryptocurrency before laundering them through China-based brokers. LCX Exchange added that Cointelegraph could not independently verify the report, and it framed the alleged arrests as a rare case of North Korean cyber operators being accused of stealing from their own government’s financial institutions.
Scale and implications
CoinDesk reported that North Korean hackers stole a record $2 billion in crypto last year, citing Chainalysis, and it said TRM Labs estimated they accounted for 76% of crypto hack and scam losses through April 202. CoinDesk also noted that markets repositioned since June, while Binance held share (~55% user funds, ~24% spot) and drew net inflows in early July as the tracked market saw outflows.
LCX Exchange said Pyongyang is widely accused of directing state-backed hacking groups to steal from crypto companies to generate revenue and circumvent international sanctions. Taken together, the CoinDesk and LCX Exchange accounts place the alleged July 12 arrests in Pyongyang alongside a broader pattern of crypto theft and laundering described through Chinese brokers and over-the-counter traders.