- A report claims North Korea detained former military hackers accused of stealing state funds and laundering them through cryptocurrency.
- The allegations describe a laundering network involving overseas crypto wallets and Chinese over-the-counter brokers.
- The reported methods resemble techniques previously linked to Pyongyang-backed cybercrime by blockchain investigators.
Investigation Centers on State Banking System
Citing an anonymous source in Pyongyang, Daily NK reported that the suspects infiltrated the internal systems of the Central Bank of the DPRK and the Foreign Trade Bank, diverting foreign-currency reserves and state trade funds into cryptocurrency wallets controlled outside North Korea.
The report said the country’s National Intelligence Agency detained the group at a safe house in Pyongyang on July 12 after investigators identified irregularities in foreign-currency payment approvals and suspicious overseas internet activity.
Neither North Korean authorities nor the institutions named in the report have publicly commented on the allegations.
Report Describes Cross-Border Laundering Network
According to Daily NK, the stolen assets were transferred into overseas cryptocurrency wallets before being converted into U.S. dollars and Chinese yuan through brokers operating in China.
The report alleged that intermediaries in the border cities of Sinuiju and Hyesan facilitated cash conversions while the suspects fragmented transactions into smaller transfers to reduce detection. It also claimed the network relied on encrypted messaging platforms, unregistered mobile phones and Chinese wireless equipment to coordinate the movement of funds.
The reported laundering process closely resembles methods previously documented by blockchain intelligence firms investigating North Korean cyber operations.
Crypto Investigators Have Documented Similar Techniques
Although the latest allegations remain unverified, cybersecurity researchers have repeatedly linked North Korean state-sponsored hacking groups to sophisticated cryptocurrency laundering networks.
Investigations by firms including TRM Labs have found that stolen digital assets are frequently routed through decentralized cross-chain protocols before being converted into fiat currency by Chinese over-the-counter brokers. Those intermediaries have become a recurring focus of international enforcement efforts aimed at disrupting North Korea’s access to the global financial system.
U.S. authorities have also sanctioned individuals and entities accused of helping Pyongyang-linked operators move cryptocurrency into traditional financial networks.
Crypto Theft Remains a Major Revenue Source
North Korea has become one of the world’s most active state-sponsored cryptocurrency hacking actors.
According to Chainalysis, North Korean groups stole a record $2 billion in digital assets last year. Separate estimates from TRM Labs found that operators linked to Pyongyang were responsible for 76% of global cryptocurrency losses from hacks and scams through April 2026, underscoring the country’s continued reliance on cyber operations to generate foreign currency despite international sanctions.
The reported arrests, if confirmed, would be unusual because they involve North Korean authorities targeting individuals accused of diverting funds intended for the state rather than conducting cyber operations against foreign organizations.
