North Korea Cracks Down on State Bank Hackers Who Laundered Crypto Through China
North Korea has arrested a group of former military hackers accused of stealing state funds from two of its own banks and laundering them through cryptocurrency. The alleged hacking incident occurred at the Central Bank of the DPRK and the Foreign Trade Bank, where the group diverted foreign currency and state trade funds into overseas crypto wallets.
The scheme relied on a network of contacts in Chinese border cities, who converted the cryptocurrency into U.S. dollars and Chinese yuan in real time. To avoid detection, the group split transfers into small amounts and used encrypted messaging apps, unregistered phones, and Chinese wireless equipment.
The arrests were made by North Korea's National Intelligence Agency on July 12 at a safe house in Pyongyang, after officials noticed discrepancies in foreign-currency payment approvals and flagged suspicious overseas IP activity. The incident marks a rare case of North Korean cyber operators stealing from their own government rather than foreign targets.