Image Credit: Unsplash
Key Takeaways
- North Korea’s intelligence agency reportedly arrested hackers accused of breaching the Central Bank and Foreign Trade Bank and moving stolen funds into crypto.
- The group allegedly used Chinese brokers and border-city contacts to convert crypto into cash, a pattern seen in past North Korean laundering schemes.
- The report rests on a single anonymous source relayed by Daily NK and remains unverified, with no comment from North Korean state media.
North Korea’s National Intelligence Agency arrested a group of former military hackers on July 12, accused of breaching two state banks and converting stolen funds into cryptocurrency, according to an anonymous source cited by Daily NK. The report could not be independently verified.
What the Source Alleges
A source in Pyongyang told Daily NK that the group breached internal systems at the Central Bank of the DPRK and the Foreign Trade Bank, diverting state trade funds and foreign currency into overseas crypto wallets. The Central Bank oversees North Korea’s currency issuance and state funds, while the Foreign Trade Bank handles the country’s external payments and foreign-currency transactions.
According to the source, the group’s leaders were military veterans of North Korea’s Reconnaissance General Bureau cyber units, who recruited IT students from Kim Chaek University of Technology and Pyongyang University of Science after leaving military service. The group allegedly used Chinese wireless equipment and encrypted messaging apps to avoid detection.
Once inside the banks’ systems, the group allegedly split stolen funds into small amounts to avoid triggering alerts and moved them to overseas crypto wallets. The group then allegedly used Chinese brokers to convert the assets into U.S. dollars and Chinese yuan. Contacts in the border cities of Sinuiju and Hyesan then allegedly exchanged the funds for cash in real time, the source said.
How the Group Was Reportedly Caught
North Korean authorities detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity in Pyongyang, according to the source. Investigators traced encrypted crypto-transaction traffic to a safe house in the city and raided it on the night of July 12, arresting the suspects and seizing computer equipment and unregistered phones, the source said.
Authorities reportedly deployed armed personnel around the Foreign Trade Bank’s headquarters and the Central Bank’s data center after the raid and blocked outside access to both sites. Mobile signal-detection vehicles were also deployed across Pyongyang to track the group’s wireless frequencies, according to the source.
Part of a Broader Pattern of Crypto-Linked Cash-Outs
The laundering method described in the report resembles techniques North Korean hacking groups have used to convert stolen crypto into cash in past incidents. A multinational sanctions-monitoring report has said Chinese over-the-counter traders and financial institutions play a central role in converting crypto tied to Pyongyang-linked hacking operations into fiat currency.
North Korean-linked hackers stole a record $2 billion in crypto in 2025, according to blockchain analytics firm Chainalysis. TRM Labs estimated North Korean hackers accounted for 76% of global crypto hack and scam losses through April 2026.
Because the arrests rest on a single anonymous account relayed through Daily NK, key details, including the identities of those arrested and any formal charges, remain unconfirmed. North Korean state media has not commented on the report.
