Pyongyang Turns on Its Own Cyber Operatives Amid Staggering Crypto Heists

North Korea's government has arrested several of its own elite IT specialists and former state cyber operators for allegedly hacking into two of the country's banks, laundering the stolen funds through cryptocurrency wallets overseas. The operatives, reportedly former members of North Korea's military intelligence cyber units, are accused of siphoning state trade funds in small increments before converting the crypto proceeds into US dollars and Chinese yuan.

The scheme involved routing stolen funds through crypto wallets based overseas, a technique that mirrors the playbook used by North Korean hackers against foreign exchanges and DeFi protocols for years. The authorities tracked encrypted transaction traffic back to a safe house in Pyongyang, where computers and burner phones were seized during the operation.

This development has significant implications for the regime, as operatives with this level of technical sophistication represent both an asset and a liability. They know the state's methods, its infrastructure, and its vulnerabilities, which could potentially lead to internal rot, external consequences, or even defection, leaking intelligence, or selling their skills to the highest bidder.

The Lazarus Group, a state-backed hacking collective responsible for some of the largest crypto heists in history, has been linked to approximately $577 million stolen in two major incidents in 2026 alone, representing a staggering 76% of tracked global crypto hack losses during that period.