North Korean authorities have reportedly arrested a group of former state cyber operators accused of hacking two government-owned banks and laundering stolen funds through overseas cryptocurrency wallets.
According to a report by Daily NK, the suspects allegedly infiltrated the internal networks of the Chosun Central Bank and the Foreign Trade Bank, siphoning state funds before converting them into cryptocurrency and ultimately exchanging the proceeds for foreign currencies through brokers in China. If confirmed, the case would mark a rare instance of North Korean cyber specialists allegedly targeting their own government’s financial institutions.
Key Takeaways
- North Korean authorities reportedly arrested former state cyber operatives accused of stealing funds from two state-owned banks.
- The suspects allegedly laundered the stolen funds through overseas cryptocurrency wallets before converting them into U.S. dollars and Chinese yuan.
- Investigators reportedly traced encrypted crypto transactions to a safe house in Pyongyang, leading to the arrests.
- The alleged hackers were said to be former members of North Korea’s military intelligence cyber units.
- The report has not been independently verified, and North Korean authorities have not publicly commented on the arrests.
Former Cyber Operatives Accused of Targeting State Banks
According to Daily NK, the suspects were arrested on July 12 following an internal investigation into suspicious cryptocurrency transactions linked to the Chosun Central Bank and the Foreign Trade Bank.
The report alleges that the group consisted of former members of a cyber warfare unit under North Korea’s Reconnaissance and Intelligence General Bureau, who later recruited skilled graduates from Kim Chaek University of Technology and Pyongyang University of Science.
Investigators believe the group used its technical expertise to infiltrate the internal systems of both banks, gradually diverting state trade funds into cryptocurrency wallets held outside North Korea.
The funds were allegedly transferred in small increments to avoid detection before being converted into U.S. dollars and Chinese yuan through brokers operating in China.
Investigation Reportedly Led to Pyongyang Safe House
Daily NK reported that investigators uncovered irregularities in foreign currency payment approvals and suspicious overseas internet activity, prompting a covert investigation. Authorities allegedly traced encrypted cryptocurrency transaction traffic to a safe house in Pyongyang, where they arrested the suspects during a raid.
The operation reportedly resulted in the seizure of computers, specialized wireless equipment, and unregistered burner phones believed to have been used during the laundering operation.
Following the arrests, security personnel were reportedly deployed around the headquarters of the Foreign Trade Bank and the computing center of the Chosun Central Bank, while investigators expanded efforts to locate additional communications equipment.
Laundering Network Allegedly Extended Beyond North Korea
According to the report, the operation relied on an overseas laundering network. After cryptocurrency was transferred to external wallets, brokers based in China allegedly converted the digital assets into cash. Contacts operating near North Korea’s border were then said to exchange the proceeds into foreign currencies, including U.S. dollars and Chinese yuan.
The report claims the network enabled the suspects to accumulate significant personal wealth while concealing the movement of stolen state funds.
However, no cryptocurrency wallet addresses, exchanges, or decentralized finance protocols allegedly used in the scheme have been publicly identified.
Rare Case of Internal Cybercrime
North Korea has long been accused by the United Nations, the United States, South Korea, and Japan of directing state-backed hacking groups to steal cryptocurrency from foreign exchanges, blockchain projects, and digital asset companies.
Groups such as Lazarus have been linked to several of the industry’s largest cyber thefts, with North Korean hackers repeatedly accused of targeting global cryptocurrency platforms.
If the Daily NK report is accurate, the latest case differs significantly because the alleged victims were North Korea’s own financial institutions rather than foreign organizations. The report also raises questions about the risks posed by highly trained cyber personnel operating outside direct state oversight after leaving military intelligence units.
Report Remains Unverified
Despite widespread reporting, the claims have not been independently verified. Daily NK cited an anonymous source inside North Korea, but the country’s tightly controlled information environment makes independent confirmation difficult.
North Korean authorities have not publicly announced the arrests or identified the individuals allegedly involved. Likewise, no official charges or details regarding possible penalties have been released.
Conclusion
The reported arrests suggest North Korean authorities may be confronting internal cybersecurity threats involving former state-trained cyber specialists. According to Daily NK, the suspects allegedly used skills developed within military intelligence units to steal state funds, launder the proceeds through cryptocurrency, and convert them into foreign currency.
While the allegations remain unverified, the case highlights the growing role of cryptocurrency in cross-border financial crime and the challenges governments face when sophisticated cyber capabilities are turned inward against their own institutions.
