North Korea Exploits Scam Networks to Launder Stolen Crypto Assets

North Korea has been using scam networks to launder stolen cryptocurrency assets, according to a report by the UK's Royal United Services Institute (RUSI). The researchers found that North Korean hackers are increasingly moving funds through existing criminal financial networks rather than isolated infrastructure.

The movement of funds involves over-the-counter (OTC) services, peer-to-peer traders, illegal exchanges, mixers, cross-chain bridges, and scam-related platforms. From January 2024 to September 2025, North Korea stole at least $2.8 billion in virtual assets, with the report stating that these funds directly support the country's weapons of mass destruction program.

After the initial movement of funds, North Korean operators may transfer cryptocurrency to third-party launderers. In one instance, the laundering process of Bybit funds after a $1.5 billion exchange hack in February 2025 involved a network of OTC and P2P traders, many of whom were Chinese citizens.

Researchers also highlighted the connection between North Korean funds and the crypto scam industry. Investigators found signs of mixing North Korean funds with proceeds from 'pig butchering' scams, investment schemes where fraudsters first establish trust with victims and then persuade them to invest in fake projects.