North Korea Routs Stolen Crypto Through Crime Networks

North Korea's cryptocurrency laundering operations have become increasingly sophisticated, according to a new paper from the Royal United Services Institute. The regime has pushed at least $2.8 billion in stolen virtual assets between January 2024 and September 2025, with researchers focusing on the moment those assets convert into cash.

The findings show how North Korea's reliance on overlapping crime networks complicates efforts to identify proliferation finance, especially as crypto laundering operations blend with ordinary illicit flows.

Researchers found that ownership of stolen coins often changes hands before conversion, sometimes through discounted bulk purchases. This can be inferred when stolen funds appear mixed with proceeds from pig butchering scams or at addresses tied to entities like Cambodia's Huione Group.

The paper highlights the use of small conversions, mule accounts, and fragmented cash-outs by North Korean launderers. Conversion usually happens in small slices, with actors selling about $7,000 in stablecoins at a time on peer-to-peer marketplaces to stay below bank review thresholds.