North Korea Arrests Hackers in Bank Crypto Laundering
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- North Korea's National Intelligence Agency arrested the former military hackers at a Pyongyang safe house on July 12 after officials detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity, per a Daily NK report citing an anonymous Pyongyang source.
- The hacker group allegedly breached internal systems at the Central Bank of the DPRK and Foreign Trade Bank, diverting foreign currency and state trade funds into overseas crypto wallets.
- Chinese brokers converted the stolen crypto into U.S. dollars and yuan, with contacts in the border cities of Sinuiju and Hyesan exchanging crypto for cash in real time, Daily NK reported.
- The suspects allegedly split transfers into small amounts to avoid detection and used encrypted messaging apps, unregistered phones, and Chinese wireless equipment.
- North Korean hackers stole a record $2 billion in crypto last year according to Chainalysis, with TRM Labs estimating they accounted for 76% of crypto hack and scam losses through April.
- A multinational sanctions-monitoring report cited in the article said Chinese over-the-counter traders and financial institutions play a central role in converting crypto stolen by Pyongyang-linked operators into fiat currency.
- Daily NK noted the report could not be independently verified.
Why it matters: The laundering route mirrors the cash-out playbook used by North Korean state-linked hackers abroad, meaning Pyongyang is now policing the same domestic pipeline its external operatives rely on. With North Korean-linked actors responsible for an estimated 76% of crypto hack and scam losses through April, even an unverified domestic crackdown signals internal pressure on a financial channel that anchors both regime revenue and global crypto theft.
