
A South Korean report says Pyongyang arrested a cell of former military hackers for embezzling state funds and laundering via crypto, a rare case of internal targeting.
North Korean authorities have arrested a group of former military cyber operatives and technology experts on allegations that they embezzled government funds from two state-owned financial institutions and laundered the proceeds through cryptocurrency, according to a Thursday report from South Korean outlet Daily NK.
Daily NK cited an unnamed source based in Pyongyang. Neither Cointelegraph nor other independent media have confirmed the claims. The report said the group infiltrated the internal networks of the Central Bank of the Democratic People's Republic of Korea and the Foreign Trade Bank, siphoning foreign currency reserves and trade-related funds into overseas crypto wallets.
The operation allegedly relied on intermediaries in the Chinese border cities of Sinuiju and Hyesan. Cryptocurrency brokers there converted digital assets into U.S. dollars and Chinese yuan, the report said. The cell fragmented transactions into smaller increments to avoid detection, using encrypted messaging platforms, unregistered mobile devices, and Chinese wireless infrastructure.
North Korea's National Intelligence Agency arrested the individuals on July 12 at a covert residence in Pyongyang, the report said. Authorities had identified irregularities in foreign currency transaction authorizations and traced suspicious internet protocol activity originating from foreign locations.
If the account holds, it would mark a rare case of North Korean cyber personnel targeting domestic government assets rather than international entities. The regime is widely known for state-sponsored hacking against foreign cryptocurrency platforms, which it uses to bypass sanctions and raise revenue.
The laundering methods described in the Daily NK piece closely match those used by established North Korean hacking collectives. A multinational sanctions enforcement assessment has previously documented that Chinese over-the-counter crypto traders play a key role in converting stolen digital currency into fiat for Pyongyang-linked operations.
Hackers linked to North Korea stole an estimated $2 billion in cryptocurrency during 2025, according to blockchain intelligence firm Chainalysis. TRM Labs calculated that actors connected to North Korea accounted for 76% of total cryptocurrency theft and fraud losses through April 2026.
Daily NK operates from Seoul and maintains a network of informants inside North Korea. Information originating from the country is difficult to independently verify, given severe restrictions on external access and information flow. No government authority or international organization has corroborated the report as of this publication.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.