CoinDesk
North Korean authorities arrested former military hackers on July 12 for stealing state funds from two banks and laundering the proceeds through cryptocurrency, according to a Daily NK report citing an anonymous source in Pyongyang. The group allegedly breached internal systems at the Central Bank of the DPRK and the Foreign Trade Bank, diverted foreign currency and state trade funds, and moved the money into overseas crypto wallets.
The laundering route mirrors the methods Pyongyang-linked groups use globally. Chinese over-the-counter brokers in the border cities of Sinuiju and Hyesan allegedly converted the assets into U.S. dollars and yuan in real time, with the group splitting transfers into small amounts to avoid detection and communicating over encrypted messaging apps, unregistered phones, and Chinese wireless equipment. The arrests at a Pyongyang safe house followed detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity, according to the report, which could not be independently verified.
Why it matters
The case is unusual because it is an insider crackdown inside a regime that exports the same playbook abroad. Chainalysis estimates North Korean hackers stole a record $2 billion in crypto last year, and TRM Labs put their share of global crypto hack and scam losses at 76% through April 2026. A multinational sanctions-monitoring report has named Chinese OTC traders and financial institutions as the central off-ramp for those stolen funds, a layer that sits outside the hackers themselves.
Market impact
For crypto markets the direct read is limited: the funds were state assets, not exchange or protocol deposits, so there is no insolvency pressure on any venue. The story matters more for sanctions architecture than for price action. It confirms the role Chinese border brokers play in converting Pyongyang-linked crypto to fiat, and it raises the question of whether Beijing faces renewed pressure to throttle those desks after a year of record North Korean theft.
Frequently asked questions
-
Why did North Korea arrest its own hackers?
According to a Daily NK report, the National Intelligence Agency detained former military hackers on July 12 after detecting discrepancies in foreign-currency payment approvals and suspicious overseas IP activity linked to thefts from the Central Bank of the DPRK and the Foreign Trade Bank.
-
How much crypto have North Korean hackers stolen?
Chainalysis estimated North Korean hackers stole a record $2 billion in crypto last year, and TRM Labs put their share of global crypto hack and scam losses at 76% through April 2026.
-
How did the group allegedly launder the funds?
Chinese over-the-counter brokers in the border cities of Sinuiju and Hyesan allegedly converted the crypto into U.S. dollars and yuan in real time, with the group splitting transfers into small amounts and using encrypted messaging apps, unregistered phones, and Chinese wireless equipment.
-
Is the Daily NK report verified?
Daily NK itself noted the report could not be independently verified. It cited a single anonymous source in Pyongyang for the arrests and the laundering details.
-
Does this affect crypto markets directly?
No. The stolen assets were state funds, not exchange or protocol deposits, so there is no insolvency pressure on any venue. The story is more relevant to sanctions enforcement, particularly on Chinese border OTC desks used as the off-ramp.
CryptoSlate
Crypto News
WatcherGuru
CoinTelegraph
TheBlock