Did North Korea’s hackers just rob their own government?

North Korea has arrested a ring of former military hackers accused of breaking into two of the country’s own state banks and washing the stolen money through cryptocurrency. However, the claim could not be independently verified.

The arrests occurred on the night of July 12, when National Intelligence Agency officers raided a safe house in the capital and, according to the source, caught the plotters at their computers in the midst of laundering hundreds of millions of dollars. The agents confiscated disposable cellphones and other equipment worth hundreds of thousands of dollars.

After that, armed officers isolated the Foreign Trade Bank’s headquarters and the computer center of the Chosun Central Bank, the Korean state bank issuing the local currency, preventing any access to them from the outside world. The source added that vehicles equipped to track down mobile phone signals scoured Pyongyang for the rogue radio waves.

The report linked the arrests to the discovery of discrepancies in the approvals of foreign-currency transfers and strange foreign IP addresses.

Rogue cyber veterans turned on North Korea

What upset officials, the source said, was that the ringleaders were discharged personnel from a cyber unit of the Reconnaissance and Intelligence General Bureau, the military intelligence agency of North Korea, who had been involved in operations overseas. After being discharged, they recruited young technical specialists from Kim Chaek University of Technology and Pyongyang University of Science and formed a clandestine network to siphon off funds without the knowledge of the state security apparatus.

The reason for the crime, according to the source, was personal gain rather than political or ideological beliefs. This also makes the incident unique, since it involves Pyongyang’s own cyber tools being used against the system. One of the officials said that in addition to standard disciplinary measures, the families of those involved would have to live in perpetual fear since the punishment “will be hard for the entire family line to survive.”

The modus operandi was similar to how state-sponsored hackers usually launder cryptocurrency proceeds in China. The hackers’ networks transferred foreign currency and state trading company funds in small batches from internal bank accounts to cryptocurrency wallets abroad.

There, the digital assets were exchanged for Chinese yuan and US dollars through crypto-exchange brokers in China. Transfers of physical cash were made through local intermediaries in the border cities of Sinuiju, in North Pyongan province, and Hyesan in Ryanggang province. Encrypted messengers, unregistered mobile phones, and Chinese-made satellite communication devices were used to conceal the identities of the participants in the scheme.

North Korea is the buyer and the victim this time

The significance of the latest incident lies in the fact that North Korea is typically on the opposite side in such schemes. According to TRM Labs data, state-sponsored hackers are behind 76% of all value stolen in crypto heists through April 2026, or roughly $577 million, most of it from just two operations. A $285 million exploit on April 1 and a $292 million exploit of KelpDAO on April 18. 

TRM puts the regime’s cumulative crypto theft at above $6 billion, which was withdrawn from the compromised Drift Protocol smart contract, and about 6 billion in total since 2017. According to blockchain intelligence company Chainalysis, North Korean hackers stole a record 2 billion in crypto during the past fiscal year.

A multinational coalition of monitors of sanctions against North Korea concluded that Chinese over-the-counter currency dealers played a crucial role in facilitating the conversion of crypto proceeds from North Korean hackers into cash, as this criminal scheme also suggests.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.