North Korea arrests military hackers for stealing state bank funds via crypto
In brief
- North Korea arrested former military hackers accused of stealing from two state banks
- Central Bank and Foreign Trade Bank breaches diverted foreign currency into overseas crypto wallets
- Chinese brokers converted stolen crypto to dollars and yuan via border-city exchanges
- Suspects used encrypted messaging and unregistered phones to evade detection
- North Korean hackers stole record $2 billion in crypto last year per Chainalysis
The breach and diversion
North Korea's National Intelligence Agency arrested the suspects at a Pyongyang safe house on July 12. Officials detected the scheme after noticing discrepancies in foreign-currency payment approvals and suspicious overseas IP activity. The hackers' access to banking systems allowed them to move stolen assets into cryptocurrency, a common tactic for converting state funds into liquid, portable value.
The laundering operation relied on a network spanning multiple jurisdictions. Chinese brokers then converted the assets into U.S. dollars and yuan, while contacts in the border cities of Sinuiju and Hyesan allegedly exchanged the crypto for cash in real time. The group split transfers into small amounts to avoid detection and used encrypted messaging apps, unregistered phones, and Chinese wireless equipment to obscure communications.
Pattern within a larger ecosystem
The laundering route mirrors methods used by North Korean hacking groups to cash out stolen crypto. Chinese over-the-counter traders and financial institutions play a central role in converting crypto stolen by Pyongyang-linked operators into fiat. This infrastructure has become critical to North Korea's ability to monetize digital theft.
The scale of North Korean crypto theft underscores the operational sophistication of these groups. North Korean hackers stole a record $2 billion in crypto last year, according to Chainalysis. TRM Labs estimated they accounted for 76% of crypto hack and scam losses through April. The arrest of this domestic cell, if confirmed, represents rare accountability within Pyongyang's hacking ecosystem.
The report could not be independently verified, and details rely on a single anonymous source inside North Korea. The opacity of the regime makes confirmation difficult.
