North Korea's Crypto Laundering Now Tied to Crime Networks, RUSI Says

The accounts doing the cashing out usually belong to someone else, with mules recruited mainly in the Philippines, Indonesia and China, where credentials sell cheaply enough to buy in bulk and open accounts at scale. Interviewees said mules told whom they are actually working for generally want no further part in it.

Conversion happens in small pieces, with actors selling roughly $7,000 of stablecoins at a time on peer-to-peer marketplaces, under the thresholds that trigger bank review, while ZeroShadow found larger sums broken into $30,000 chunks so that a freeze "would not be overly impactful." Behaviour at the exchange itself offers further signals, from Astrill VPN logins to the 50 to 70 support tickets launderers now file to get a single held transaction released.

Fiat rarely arrives by simple bank transfer, with proceeds from over-the-counter brokers often deposited into North Korean-controlled accounts using UnionPay cards issued by Chinese banks. The paper lists 19 Chinese banks that the Multilateral Sanctions Monitoring Team identified last year as used by the regime and its proxies.

Of the roughly $1.5 billion taken from Bybit, 95% moved through decentralised services, and the monitoring team reported that all of it had been converted into fiat or hard currency by September 2025.

The authors call for regulatory guidance on correspondent relationships between exchanges, standardised onboarding questionnaires, secure intelligence-sharing channels, and a VASP identifier in payment messages so receiving banks can spot them.

What that leaves for victims is clear from Bybit's own accounts: the exchange announced Monday that it had sued North Korea and won an order freezing identified assets, having recovered $48.4 million and frozen $30.5 million more, together about 5% of what was taken.