North Korea reportedly arrests its own hackers — a look at how stolen crypto gets ‘cashed out’

North Korean authorities have reportedly arrested a group of former state hackers accused of stealing from two of the country’s own state banks and laundering the money through cryptocurrency, according to Seoul-based outlet Daily NK. The report cites an anonymous source inside Pyongyang and could not be independently verified.

According to the report, the group breached the internal networks of the Central Bank of the DPRK and the Foreign Trade Bank, diverted foreign currency and state trade funds into overseas crypto wallets, and were arrested at a Pyongyang safe house on July 12 after officials detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity. If confirmed, it would be a rare case of North Korean operators stealing from their own government.

The part worth understanding is the laundering method. The group allegedly used China-based brokers to convert the crypto into US dollars and yuan, with contacts in the border cities of Sinuiju and Hyesan exchanging crypto for cash in real time. They reportedly split transfers into small amounts to avoid detection — a technique often called “structuring” — and relied on encrypted messaging apps, unregistered phones and Chinese wireless equipment.

Seen against the bigger picture, North Korean hackers stole a record of roughly $2 billion in crypto last year, according to Chainalysis, and TRM Labs estimated they accounted for about 76% of crypto hack and scam losses through early 2026. Pyongyang is widely accused of directing state-backed hacking groups to steal from crypto companies to raise revenue and evade international sanctions.

A caveat on the reporting: Daily NK relies on a network of sources inside North Korea, and information from the country is difficult to verify independently because of its restrictions on access.

For a beginner, the useful takeaway is that a blockchain’s traceability cuts both ways — the same permanent on-chain record that worries privacy advocates is also what lets investigators follow the money. Breaking a large sum into many small transfers is a classic laundering red flag, and stories like this are a big part of why exchanges run identity checks (KYC) and why “tainted” or sanctioned funds carry real risk. This is information, not advice.