North Korea’s State Intelligence Bureau raided a safe house in Pyongyang on July 12 and arrested a hacking group accused of infiltrating the internal networks of the country’s central bank and a trade bank, according to BlockBeats.
Former cyber warfare personnel allegedly led the group
A source in Pyongyang said the ring was headed by former members of a cyber operations unit under North Korea’s Reconnaissance and Intelligence General Bureau. The group allegedly recruited young IT talent from Kim Chaek University of Technology and Pyongyang University of Science and Technology, then used skills developed through military and university training to break through the heavily protected internal networks and external payment systems of the two banks.
Stolen trade funds were reportedly routed through crypto wallets
The report says the group split stolen state trade funds into small transfers and moved them to overseas cryptocurrency wallets, where brokers later exchanged them into cash. It also says the ring established bases in border regions including Sinuiju in North Pyongan Province and Hyesan in Ryanggang Province, using those locations to convert laundered cryptocurrency into U.S. dollars in real time.
The group had reportedly operated a crypto trading network for an extended period from a safe house in Pyongyang. The operation was exposed after central bank officials detected irregular small-value items in foreign-exchange payment approvals, along with suspicious login records tied to overseas IP addresses.
Raid led to arrests and equipment seizure
North Korea’s State Intelligence Bureau then traced the location and raided the site, arresting suspects who were allegedly in the middle of the operation. Authorities reportedly seized computer equipment worth hundreds of thousands of dollars as well as a large number of unregistered burner phones.
After the arrests, authorities sealed the headquarters and computing centers of the two banks and deployed mobile signal-detection vehicles to track abnormal wireless frequencies.
Case reportedly shook official and academic circles
After news of the case spread, it caused what the report described as a major shock among senior circles in Pyongyang, the military, and university communities. One official was quoted as saying, "The state trained them to use these skills to defend the country, but they looted the national treasury. Not only will they themselves face extreme punishment, even their entire family line may struggle to survive."
The report added that senior officials at the Reconnaissance and Intelligence General Bureau and departments tied to science and technology education have become anxious over the case, fearing that accountability could reach them as well.