North Korean Bank Hackers Arrested After Alleged Crypto Laundering Scheme

North Korean bank hackers have reportedly been arrested after allegedly breaching two state banks and laundering stolen funds through cryptocurrency.

According to Daily NK, the suspects were former cyber operatives connected to North Korea’s military intelligence apparatus. They allegedly accessed bank networks, divided stolen money into smaller transfers and used Chinese brokers to convert cryptocurrency into cash.

The claims have not been independently verified.

Former cyber operatives allegedly hacked state banks

The group reportedly targeted the Central Bank of Korea and the Foreign Trade Bank.

The Central Bank of Korea oversees currency issuance and manages state funds. Meanwhile, the Foreign Trade Bank handles foreign-currency transactions and international settlements.

Daily NK reported that the suspects infiltrated internal computer networks and payment systems at both institutions. Once inside, they allegedly moved the stolen money through many small transactions to make the activity harder to detect.

Cryptocurrency used to hide stolen funds

After the alleged bank breaches, the North Korean bank hackers reportedly converted the funds into cryptocurrency.

The group then allegedly worked with Chinese brokers who exchanged the digital assets for US dollars and Chinese yuan. Local associates in border areas, including Sinuiju in North Pyongan Province and Hyesan in Ryanggang Province, reportedly collected the cash.

The money was then allegedly smuggled across the border.

According to the report, the suspects used specialised Chinese wireless equipment and encrypted messaging services to avoid surveillance by North Korean authorities.

Investigation reportedly traced traffic to Pyongyang safe house

The suspects were reportedly former members of a cyber operations unit under the General Reconnaissance and Intelligence Bureau. The organisation is North Korea’s main military intelligence agency and was formerly known as the Reconnaissance General Bureau.

After leaving military service, the alleged operators reportedly recruited young IT specialists from state universities. Together, they are said to have built a cryptocurrency trading network designed to operate outside official oversight.

Authorities reportedly noticed accounting irregularities and suspicious records of overseas IP access. An internal investigation then traced encrypted cryptocurrency traffic to a house in central Pyongyang.

Authorities reportedly seized computers and burner phones

North Korean authorities allegedly raided the property on July 12.

Daily NK reported that officials seized computers, burner phones and other equipment linked to the alleged operation. The source claimed the State Intelligence Bureau, formerly the Ministry of State Security, dismantled the group.

If accurate, the case would be unusual because it involves North Korea taking action against former state-linked cyber personnel accused of targeting the country’s own financial institutions.