Crypto▼ Bearish
North Korea Shifted $2.8B in Stolen Crypto Through Crime Networks, RUSI Says
$2.8B in stolen crypto moved through networks shared with scam syndicates. RUSI paper tracks how North Korea converts coins to cash through mules, Chinese banks and OTC desks.
Continue with
North Korea is routing stolen cryptocurrency through criminal ecosystems that also serve scam syndicates, a move that blurs the line between state-backed theft and ordinary financial crime. A new paper from the Royal United Services Institute says the regime pushed at least $2.8 billion in stolen virtual assets between January 2024 and September 2025, with researchers focusing on how those assets convert into cash.
Ownership of stolen coins changes hands before conversion, sometimes through discounted bulk purchases. Investigators told the authors those handovers become visible when stolen funds appear alongside proceeds from pig butchering scams or at addresses tied to entities like Cambodia's Huione Group, whose infrastructure the Justice Department seized in June.
Elliptic data suggests these transfers often happen on the Bitcoin blockchain. After the February 2025 Bybit hack, ZeroShadow responders watched the regime rely on launderers, over-the-counter desks and peer-to-peer traders, many of them Chinese nationals working round the clock.
TraderTraitor, the group behind the theft, used Chinese organised crime networks to move funds and return cash, further embedding state-linked theft inside commercial criminal infrastructure. Once inside those ecosystems, the markers of proliferation finance become hard to separate from standard crypto laundering patterns.