North Korean authorities have detained a group of former military hackers allegedly responsible for stealing state funds from two national banks and laundering them through cryptocurrency platforms.
Alleged breaches of central bank networks
Reports from Daily NK, citing an anonymous source in Pyongyang, indicate that the group infiltrated internal systems at the Central Bank of the Democratic People’s Republic of Korea (DPRK) and the Foreign Trade Bank.
The hackers reportedly diverted foreign currency and state trade reserves into cryptocurrency wallets overseas. The group then used a network of Chinese brokers to convert the digital assets into both US dollars and yuan.
Sources claim that partners based in the border cities of Sinuiju and Hyesan exchanged this cryptocurrency for physical cash using real-time transactions. To prevent detection, the group allegedly split transfers into small increments and relied on encrypted messaging apps, unregistered mobile phones, and Chinese wireless devices.
After detecting discrepancies in foreign currency payment approvals and tracing irregular foreign IP access, North Korea’s National Intelligence Agency apprehended the suspects at a safe house in Pyongyang on July 12.
The laundering methods described closely resemble tactics previously linked to state-backed North Korean hacking teams, which have focused on extracting and converting stolen crypto funds.
Chinese brokers and international money laundering
A multinational sanctions-monitoring task force reported that Chinese over-the-counter (OTC) brokers and financial institutions remain essential for Pyongyang’s operators to exchange cryptocurrency for fiat money. This dependence on cross-border facilitators has complicated international efforts to disrupt illicit crypto flows.
Chainalysis estimated that North Korean hackers stole a record $2 billion in cryptocurrency last year. TRM Labs reported that, through April 2026, these actors were linked to 76% of global crypto hack and scam losses.
Mini dictionary: Chainalysis is a blockchain data platform specializing in cryptocurrency transaction analysis to detect illicit activity including hacks, scams, and money laundering.
Despite ongoing enforcement actions worldwide, North Korean hacker groups continue to play a leading role in targeting digital assets on a global scale.
Comparison of crypto hack losses
| Year | Amount stolen by North Korea | Share of total hack/scam losses |
|---|---|---|
| 2025 | $2 billion | 76% |
The international spotlight remains fixed on North Korea’s advanced hacking operations and their use of cryptocurrency to circumvent sanctions and fund state priorities.
North Korean hacker groups accounted for a significant majority of all global digital asset hack and scam losses through the first months of 2026.
