North Korea Hackers Shift to Fast Bridge-OTC Laundering

North Korean state-backed hacking crews have accelerated their laundering flow, compressing the time between exploit and cash-out. TRM Labs counted roughly $972 million in total hack losses during the first half of 2026, with about 66% of that tied to DPRK-linked actors. Two incidents in April – the Drift and KelpDAO exploits – alone totaled roughly $577 million combined, according to the analytics firm.

The pattern follows a compressed sequence. Attackers drain funds from a validator key leak, a bridge bug, or a governance permissions slip, pushing assets to fresh, unlabeled addresses within hours. The scramble phase hits one or more cross-chain bridges before the victim confirms the exploit. TRM Labs said the largest H1 heists moved through bridges first, then no-KYC swap aggregators. Funds later reached exchanges or OTC desks.

Bridges break simple heuristics. Moving assets between chains strips away context tied to the source chain. No-KYC swap aggregators and high-liquidity DEXs convert the stolen tokens into stablecoins and liquid majors, splitting amounts into smaller packets across multiple wallets before reconsolidation. CoinDesk reported July arrests tied to North Korea laundering, where suspects allegedly converted crypto into U.S. dollars and yuan through Chinese OTC brokers. Transfers were split into small amounts to avoid detection, the report said.

The exit relies on human counterparties. OTC desks willing to take stablecoins and return fiat, or brokers providing prefunded exchange accounts and cash-out services, bridge the crypto and cash worlds. The July case outlined a network of brokers who helped convert stolen funds to fiat, the report said.