Former Military Hackers Detained in North Korea for Stealing State Funds via Crypto

TLDR

• Pyongyang authorities detained ex-military cyber specialists for allegedly stealing from state financial institutions
• The suspects reportedly breached the DPRK Central Bank and Foreign Trade Bank systems
• Stolen assets were reportedly converted into cryptocurrency and laundered via China-based intermediaries
• The operation used fragmented transfers and encrypted communication tools to evade surveillance
• Detentions occurred on July 12 at a secure location in Pyongyang following detection of irregular activity

Authorities in North Korea have reportedly detained a cell of former military cyber operatives and technology experts on allegations of embezzling government funds from two state-owned financial institutions and laundering proceeds via cryptocurrency channels.

The report emerged Thursday from Daily NK, a South Korean media outlet, which cited an unnamed source based in Pyongyang. Neither Cointelegraph nor other independent media organizations have been able to authenticate these allegations.

The report indicates that the operatives infiltrated internal networks of both the Central Bank of the Democratic People’s Republic of Korea and the Foreign Trade Bank. They allegedly siphoned foreign currency reserves and trade-related funds into cryptocurrency wallets located overseas.

The purported operation depended on a web of intermediaries stationed in Chinese cities along the border. Cryptocurrency brokers operating in Sinuiju and Hyesan allegedly facilitated immediate conversion of digital assets into United States dollars and Chinese yuan.

To circumvent monitoring systems, the cell reportedly fragmented transactions into smaller increments. The operation also allegedly utilized encrypted messaging platforms, unregistered mobile devices, and Chinese wireless infrastructure.

How the Arrests Happened

North Korea’s National Intelligence Agency apprehended the individuals on July 12 at a covert residence in Pyongyang. Authorities reportedly identified irregularities in foreign currency transaction authorizations and traced suspicious internet protocol activity originating from foreign locations.

Should these reports prove accurate, this would represent an unusual instance of North Korean cyber personnel targeting domestic government assets rather than international entities.

The regime is internationally recognized for orchestrating state-sponsored hacking operations against foreign cryptocurrency platforms. These activities serve as revenue generation mechanisms and circumvent economic sanctions.

North Korea’s Crypto Hacking Record

The laundering techniques outlined in the Daily NK account closely resemble operational methods employed by established North Korean hacking collectives targeting international targets.

A multinational sanctions enforcement assessment has previously documented that Chinese over-the-counter cryptocurrency traders serve a crucial function in transforming stolen digital currency into traditional money for Pyongyang-affiliated operations.

Hackers linked to North Korea stole an unprecedented $2 billion in cryptocurrency during 2025, based on data from blockchain intelligence firm Chainalysis.

TRM Labs calculated that actors connected to North Korea accounted for 76% of total cryptocurrency theft and fraud losses through April 2026.

Daily NK operates from Seoul and maintains a network of informants within North Korea. Information originating from the country remains challenging to independently authenticate given severe limitations on external access and information dissemination.

As of this publication, no official government authority or international organization has corroborated the report.

The post Former Military Hackers Detained in North Korea for Stealing State Funds via Crypto appeared first on Blockonomi.