North Korea arrests its own hackers for stealing from state banks and laundering through crypto
Former military intelligence cyber operatives allegedly siphoned funds from two state banks and funneled them through overseas crypto wallets, turning Pyongyang's most prized digital weapons inward.
North Korea’s government has turned on its own cyber soldiers. On July 12, authorities arrested a group of former state cyber operators and elite IT specialists for allegedly hacking into two of the country’s own banks, the Chosun Central Bank and the Foreign Trade Bank, and laundering the stolen funds through overseas cryptocurrency wallets.
The operatives, reportedly former members of North Korea’s military intelligence cyber units, are accused of siphoning state trade funds in small increments before converting the crypto proceeds into US dollars and Chinese yuan.
How investigators caught them
The arrests came after investigators tracked encrypted transaction traffic back to a safe house in Pyongyang. Computers and burner phones were seized during the operation, according to a report from Daily NK.
The scheme reportedly involved routing stolen funds through crypto wallets based overseas, a laundering technique that mirrors the playbook North Korean hackers have used against foreign exchanges and DeFi protocols for years. No specific exchanges, protocols, or wallet addresses connected to this internal theft have been publicly identified.
The Lazarus Group’s shadow
North Korea’s cyber operations have long been synonymous with the Lazarus Group, the state-backed hacking collective responsible for some of the largest crypto heists in history. The country’s hackers have been linked to approximately $577 million stolen in two major incidents in 2026 alone, representing a staggering 76% of tracked global crypto hack losses during that period.
Internal rot, external consequences
The implications for the regime are potentially severe. Operatives with this level of technical sophistication represent both an asset and a liability. They know the state’s methods, its infrastructure, and its vulnerabilities. If some are willing to steal from their own government, others might be tempted to defect, leak intelligence, or sell their skills to the highest bidder. North Korea’s leadership may respond with tighter internal controls or, given historical precedent, purges within its cyber ranks.