North Korean authorities have reportedly arrested a group of former military hackers accused of stealing funds from two state-owned banks and laundering the proceeds through cryptocurrency. The claims, however, have not been independently verified, and no official confirmation has been provided by Pyongyang.
According to the report, officers from the National Intelligence Agency raided a safe house in Pyongyang on July 12, allegedly catching members of the group while they were laundering hundreds of millions of dollars through cryptocurrency transactions.
Authorities reportedly confiscated computers, disposable mobile phones, and other electronic equipment before sealing off the headquarters of the Foreign Trade Bank and the Chosun Central Bank, North Korea's central bank. Security forces also allegedly deployed specialized vehicles capable of tracking mobile phone signals across the capital as part of the investigation.
The report states that investigators became suspicious after discovering irregular approvals for foreign currency transfers and unusual foreign IP addresses linked to banking systems.
Former Military Hackers Allegedly Behind the Scheme
The individuals accused were reportedly former members of North Korea's Reconnaissance General Bureau, the country's military intelligence agency, where they had previously participated in overseas cyber operations.
After leaving military service, the alleged ringleaders are said to have recruited talented graduates from Kim Chaek University of Technology and Pyongyang University of Science to create a covert cyber network capable of diverting funds without the knowledge of state authorities.
According to the source cited in the report, personal financial gain-not political motives-was the driving force behind the operation, making the case highly unusual given North Korea's tightly controlled cyber apparatus.
One official quoted in the report claimed that the punishment would extend beyond those directly involved, warning that their families could also face severe consequences under North Korea's system of collective punishment.
Crypto Used to Move Stolen Funds Abroad
The alleged laundering operation reportedly mirrored techniques commonly associated with state-sponsored North Korean cyber groups. Investigators claim the network transferred foreign currency and funds belonging to state trading companies into cryptocurrency wallets located outside the country.
According to the report, the digital assets were then exchanged for Chinese yuan and U.S. dollars through cryptocurrency brokers operating in China. Physical cash was allegedly transported using intermediaries based in the border cities of Sinuiju and Hyesan.
To avoid detection, participants reportedly relied on encrypted messaging applications, unregistered mobile phones, and Chinese-made satellite communication devices throughout the operation.
An Unusual Twist in North Korea's Crypto Story
The alleged incident stands out because North Korea is typically associated with carrying out cryptocurrency theft rather than becoming its victim. According to TRM Labs, North Korean state-sponsored hacking groups accounted for approximately 76% of all cryptocurrency stolen globally through April 2026, representing around $577 million in digital assets.
The blockchain analytics firm estimates that North Korean-linked hackers have stolen more than $6 billion worth of cryptocurrency since 2017, while Chainalysis previously reported that the country was responsible for record-breaking crypto thefts during the past fiscal year.
International investigators have also repeatedly identified Chinese over-the-counter cryptocurrency brokers as playing a key role in helping convert stolen digital assets into traditional currency, a pattern that closely resembles the methods described in the latest report.
Although the claims surrounding the arrests remain unverified, they present a rare scenario in which North Korea's own cyber expertise may have been used against the country's financial institutions, highlighting the growing risks posed by insider threats even within highly controlled state systems.
