North Korea Arrests Hackers Who Robbed Its Own Banks via Crypto

North Korea has arrested a group of former military hackers accused of robbing two of its own banks and laundering the proceeds through crypto. The account comes from a Daily NK report citing an anonymous source in Pyongyang, and it could not be independently verified. According to the report, the National Intelligence Agency detained the suspects at a Pyongyang safe house on July 12, after officials flagged discrepancies in foreign-currency payment approvals and suspicious overseas IP traffic.

Inside the laundering route

The group allegedly breached the internal systems of the Central Bank of the DPRK and the Foreign Trade Bank, then moved foreign currency and state trade funds into overseas crypto wallets. Chinese brokers converted the assets into U.S. dollars and yuan. Contacts in the border cities of Sinuiju and Hyesan swapped the crypto for cash in real time, splitting the money into small amounts as it went.

The tradecraft was deliberately low-tech where it counted. The suspects worked over encrypted messaging apps and unregistered phones, routed through Chinese wireless equipment to stay off North Korea's own radar. In the end it was the mismatched payment approvals and the foreign IP activity, not a blockchain trace, that exposed them.

A playbook turned inward

The route is the one Pyongyang runs against the rest of the world. North Korean hacking crews have long cashed out crypto stolen abroad through Chinese over-the-counter traders, a pattern a multinational sanctions-monitoring report has singled out as central to converting stolen coins into fiat. This time, according to Daily NK, that same machinery was aimed at the state's own accounts.

The theft abroad runs into the billions. North Korean hackers stole a record $2 billion in crypto last year, according to Chainalysis, and TRM Labs estimated Pyongyang-linked operators accounted for 76% of all crypto hack and scam losses through April. Those figures make Pyongyang one of the largest single forces in crypto crime.

How much this particular crew actually moved is not stated, and Daily NK's account remains unconfirmed. But the method described, the split transfers, the burner phones, the real-time swaps in Sinuiju and Hyesan, is the one North Korea built to rob everyone else. This time the target was at home.