North Korean authorities have arrested a group of former cyber operators and IT specialists accused of hacking two public banks and laundering funds via cryptocurrencies. South Korean media D
North Korean authorities have arrested a group of former cyber operators and IT specialists accused of hacking two public banks and laundering funds via cryptocurrencies. South Korean media Daily NK revealed the case on July 25, citing an anonymous source in Pyongyang. A case that disrupts the usual narrative of North Korean cyberattacks, which were until now systematically directed outward.
According to the specialized media Daily NK, based in Seoul, the suspects infiltrated the internal networks of the North Korean central bank and those of the Foreign Trade Bank, two strategic institutions of the regime. They then converted the funds into digital assets and laundered them through intermediaries located in China.
Your 1st cryptos with BitpandaThis link uses an affiliate program.Cointelegraph could not independently verify the report. Daily NK relies on a network of sources inside the country, a notoriously difficult exercise given the absolute control Pyongyang exerts over information.
The case remains credible in view of the background: in June 2026, Consensys, the company behind the MetaMask wallet, discovered that a developer linked to North Korea had infiltrated its teams.
The described modus operandi follows known patterns of international law enforcement. Internal hacking, conversion into cryptocurrencies, laundering via Chinese brokers. The difference this time lies in the target: not a foreign exchange platform nor a DeFi protocol, but the very coffers of the North Korean state.
Pyongyang has been the top suspect for the world’s biggest digital heists for more than a decade.
The Lazarus group, an elite unit of North Korean intelligence, notably looted 620 million dollars from the Ronin Network bridge in 2022, before pulling off the historic 1.5 billion dollar heist on the Bybit platform in February 2025.
The US Treasury Department estimates the regime’s annual cyberoperation yield between 1 and 2 billion dollars. A windfall that funds the ballistic program and allows to circumvent international sanctions. In 2026, the analytics company Chainalysis even attributed 76% of cryptocurrency thefts recorded worldwide to actors linked to North Korea, according to a report relayed by Cointelegraph.
The novelty of the Daily NK case does not lie in the method but in the target. Until now, North Korean operators targeted foreign infrastructures. This time, the line between attacker and victim seems blurred inside the regime itself.
If the Daily NK report is confirmed, this case marks a troubling precedent. Agents trained by the state, skilled in the most advanced hacking techniques, would have turned their skills against their own employer. A scenario that raises questions about the loyalty of these units, often deployed under extreme pressure.
Laundering via Chinese brokers highlights another reality: China still functions as a hub for recycling stolen cryptocurrencies, despite repeated calls from the FATF. OTC trading platforms and nominee networks continue to thrive there.
It remains to be seen whether Pyongyang will make this wave of arrests public. Transparency has never been part of Kim Jong-un’s regime catalog, but the leak via Daily NK indicates that the story has already crossed borders.
In short, this case exposes a North Korea caught in its own cybercriminal machine. On one side, a regime that exploits hacking as a lever for economic survival. On the other, agents who have become uncontrollable, capable of turning their arsenal against the state that trained them. A revealing paradox, especially as Pyongyang already rejects accusations attributing 76% of global crypto thefts in 2026.
