North Korea Arrests Hackers Who Stole From State Banks and Laundered Funds Through Crypto

TLDR

• North Korean authorities arrested former military hackers accused of stealing from two state banks
• The group allegedly hacked the Central Bank of the DPRK and the Foreign Trade Bank
• Stolen funds were converted to crypto and laundered through China-based brokers
• Small transfers and encrypted messaging apps were used to avoid detection
• Arrests were made on July 12 at a Pyongyang safe house after suspicious activity was flagged

---

North Korea has reportedly arrested a group of former military hackers and IT specialists accused of stealing state funds from two of its own banks and laundering the money through cryptocurrency.

🇰🇵JUST IN: North Korea reportedly arrests its own hackers for stealing state funds and laundering them through crypto, per CoinDesk.

The group allegedly breached the Central Bank of the DPRK and Foreign Trade Bank, moved funds into overseas crypto wallets, and used Chinese… pic.twitter.com/i0haiwNsHb

— Coin Bureau (@coinbureau) July 25, 2026

South Korean outlet Daily NK reported the story on Thursday, citing an anonymous source in Pyongyang. Cointelegraph and other outlets could not independently verify the claims.

According to the report, the group breached the internal systems of the Central Bank of the DPRK and the Foreign Trade Bank. They diverted foreign currency and state trade funds into overseas crypto wallets.

The alleged scheme relied on a network of contacts in Chinese border cities. Brokers in Sinuiju and Hyesan reportedly converted the cryptocurrency into U.S. dollars and Chinese yuan in real time.

To avoid detection, the group split transfers into small amounts. They also used encrypted messaging apps, unregistered phones, and Chinese wireless equipment.

How the Arrests Happened

North Korea’s National Intelligence Agency arrested the suspects on July 12 at a safe house in Pyongyang. Officials said they noticed discrepancies in foreign-currency payment approvals and flagged suspicious overseas IP activity.

If confirmed, the arrests would be a rare case of North Korean cyber operators stealing from their own government rather than foreign targets.

Pyongyang is widely known for directing state-backed hacking groups to steal from foreign crypto companies. The funds are used to generate revenue and get around international sanctions.

North Korea’s Crypto Hacking Record

The laundering methods described in the Daily NK report mirror those used by known North Korean hacking groups operating abroad.

A multinational sanctions-monitoring report has previously identified Chinese over-the-counter traders as playing a central role in converting stolen crypto into fiat currency for Pyongyang-linked operators.

North Korean hackers stole a record $2 billion in cryptocurrency in 2025, according to blockchain analytics firm Chainalysis.

TRM Labs estimated that North Korea-linked actors were responsible for 76% of all crypto hack and scam losses through April 2026.

Daily NK is a Seoul-based outlet that uses a network of sources inside North Korea. Reporting from the country is difficult to verify independently due to strict restrictions on access and information flow.

The report has not been confirmed by any official government or international body as of publication.