North Korean authorities have reportedly arrested a criminal organization of former state cyber operators and IT specialists accused of hacking two state banks and laundering stolen funds through digital assets.
Last week, South Korean outlet Daily NK reported that the group in question allegedly hacked the internal networks of North Korea’s central bank and the Foreign Trade Bank—the institution responsible for North Korea’s currency issuance and state fund management and the core bank responsible for foreign settlements and foreign currency transactions, respectively—converting stolen state funds into digital asset before laundering them through China-based brokers.
Citing an anonymous “Pyongyang city source,” the report said these two institutions, which together make up the heart of North Korean finance, were breached by “internal IT personnel,” the ringleaders of whom were state-trained veterans of the cyber operations unit of the Reconnaissance General Bureau—North Korea’s intelligence agency.
“A criminal organization that hacked into the internal computer networks of the Central Bank of Korea and the Foreign Trade Bank, which oversee national trade funds, converted the stolen funds into cryptocurrency (coin), and trafficked foreign currency on a large scale in border areas,” the source reportedly told Daily NK on April 23. “On the 12th, the National Intelligence Service (formerly the National Security Ministry) dismantled the criminal organization.”
According to the report, the group used specialized Chinese wireless equipment and encrypted messengers to avoid being monitored by North Korean authorities. After accessing the internal network of the banks, the attackers broke up foreign currency assets in the national trade funds and ghost accounts into smaller pieces so that authorities wouldn’t notice, siphoned them into overseas digital asset wallets, and then switched them back to digital currencies that were easier to cash out through Chinese brokers. These laundered coins were then exchanged and smuggled in real time for U.S. dollars and Chinese yuan.
It is not possible to verify the report, as revealing the source would likely put them in danger with the authorities, but assuming it is true, it stands as a monumental irony that the North Korean state—perpetrator of the majority of global digital asset hacks in 2026 and 2025—fell victim to the very hackers it trained.
A clearer example of being “hoist by one’s own petard” you will not find, and one which will likely be accompanied by a healthy serving of schadenfreude from the numerous victims of North Korean state-backed hacking operations around the world.
North Korean hacking
In recent years North Korea has become notorious for its state-backed hacking operations, particularly those targeting or utilizing the digital asset space.
According to an end-of-year report from blockchain analysis firm Chainalysis, in 2025 the country posed “the most significant nation-state threat to cryptocurrency security, achieving a record-breaking year for stolen funds despite an assessed dramatic reduction in attack frequency.”
In 2025, North Korean hackers stole at least $2.02 billion in cryptocurrency, $681 million more than in 2024, representing a 51% increase year-over-year. This marked the most severe year on record for North Korea digital asset theft in terms of value stolen, with attacks emanating from the country also accounting for a record 76% of all service compromises.
Chainalysis said that, overall, 2025’s numbers brought the lower-bound cumulative estimate for cryptocurrency funds stolen by North Korea to a whopping $6.75 billion.
This worrying trend has continued into 2026, with North Korea-linked groups responsible for around two-thirds of digital asset hacking losses worldwide in the first half of the year, according to a recent report from blockchain analytics firm TRM Labs.
The July 1 report revealed that North Korea state-linked attackers carried out 207 separate hacks over the previous six months, “the highest number TRM has recorded in any six-month period,” said the firm.
The total value of losses was down from $2.3 billion in the first half of 2025 to $972 million in 2026. But of this latter figure, North Korean state-linked entities accounted for 66.2%—roughly $643 million—with TRM Labs attributing the majority to two major attacks: a $285 million breach of decentralized finance (DeFi) platform Drift in April and a $292 million hack of another DeFi platform, KelpDAO.
The artificial intelligence (AI) revolution has also given North Korean hackers a dangerous new tool in their arsenal.
In February, Google’s cybersecurity firm, Mandiant, released a threat intelligence report warning that North Korean “threat actors” were evolving their techniques targeting digital currency and DeFi, including the use of AI–generated deepfakes to deceive victims in fake Zoom videos.
Based on such evidence, it seems unlikely the arrest of the hacking group that turned on its former trainer and master will dramatically slow down or alter North Korea’s operations, which have proven so lucrative to the heavily sanctioned state up to this point.
Watch | Blockchain Futurist 2025 (Part 1): What’s real vs what’s hype on blockchain?
Be the first to comment