North Korean authorities allegedly arrested a group of former military hackers at a safe house in Pyongyang on July 12, according to CoinDesk, which cited Daily NK, a media outlet that covers North Korea. The allegation has not been independently verified.
Alleged intrusion targeted state banking systems
Daily NK, citing an anonymous source in Pyongyang, said the former military hackers were accused of breaching the internal systems of the Central Bank of North Korea and the Foreign Trade Bank. They allegedly moved foreign currency and state trade funds into overseas crypto wallets. The report did not specify the amount said to have been stolen.
The case stands out because North Korea has long been identified by the security industry as a major source of state-linked crypto attacks. Ripple had previously published threat intelligence tied to North Korean hackers, sharing information with the industry on suspicious employees and wallet addresses. In this case, however, the accused were described as North Korea’s own former military personnel.
Report describes cross-border cash-out methods
According to Daily NK, the group moved crypto assets overseas and then used brokers in the border cities of Sinuiju and Hyesan to exchange the holdings into U.S. dollars and Chinese yuan. The report said they split transfers into smaller amounts and relied on encrypted messaging apps and unregistered phones to avoid detection.
Daily NK also said North Korean intelligence agencies discovered the case after noticing irregularities in foreign-currency payment approvals and suspicious overseas IP activity. Because the account rests on a single anonymous source, the number of people involved, the detailed allegations and any follow-up action remain difficult to verify.
Sharp contrast with North Korea’s broader crypto record
The report has drawn attention in part because it cuts against North Korea’s established image in the crypto sector. According to external reports cited in the source material, North Korean hackers stole about $2 billion in crypto assets in 2025 and accounted for roughly 76% of global crypto hacking and fraud losses by April 2026.
That leaves a striking contrast: a government long accused of using crypto theft to support state finances is now the subject of a report claiming former insiders targeted state banks themselves. Even so, without independent confirmation, the story remains an unverified report from a single source.