Former North Korean military hackers allegedly infiltrated the internal networks of two state banks and moved stolen state trade funds into cryptocurrency, according to a report from defector-run outlet Daily NK. The report says North Korea’s state intelligence agency arrested the group on July 12.
Daily NK identified the two institutions as the Central Bank of the Democratic People’s Republic of Korea and the country’s Trade Bank. The central bank handles currency issuance and treasury funds, while the Trade Bank is responsible for external payments and foreign-exchange transactions. The report says the breach by former insiders shocked authorities in Pyongyang.
CoinDesk and Cybernews each cited the Daily NK report, but both said the claims could not be independently verified.
Daily NK says former military personnel built an underground crypto network
According to a source cited by Daily NK, the alleged masterminds were several former personnel who had served in North Korea’s Reconnaissance General Bureau, now referred to in the report as the Reconnaissance Intelligence Bureau, an agency known for cyber espionage and hacking operations.
After leaving the military, they allegedly recruited young IT talent from Kim Chaek University of Technology and Pyongyang University of Technology. Daily NK says the group built a cryptocurrency trading network designed to evade state monitoring, with the goal of earning foreign currency and accumulating wealth.
The report says the group used specialized wireless communication equipment made in China and encrypted communication software to avoid detection. It also says they relied on hacking skills developed during military service and university training to penetrate the banks’ internal systems and cross-border payment mechanisms.
Once the money was obtained, the stolen state trade funds and foreign currency held in nominee accounts were allegedly split into many small transfers and sent to overseas crypto wallets. From there, the funds were reportedly converted into cash through brokers in China, then exchanged into U.S. dollars and Chinese yuan by contacts in border areas such as Sinuiju and Hyesan.
Investigation reportedly began with payment discrepancies and overseas IP logs
Daily NK says officials first noticed small discrepancies while reviewing foreign-currency payment approvals. They also detected suspicious overseas IP access records, prompting the state intelligence agency to open a covert internal investigation.
Investigators then traced encrypted traffic tied to cryptocurrency transactions to a safe house in Pyongyang, according to the report. A raid was carried out on the night of July 12, and the alleged ringleaders and IT staff were arrested while conducting money-laundering activity in front of computers.
The report says authorities seized computer equipment worth hundreds of thousands of dollars, along with multiple unregistered mobile phones allegedly used to bypass surveillance. It also says armed intelligence personnel briefly set up security around the Trade Bank headquarters and the central bank’s computer center, cut off external connections, and deployed signal-detection vehicles across Pyongyang to track unusual wireless frequencies.
Daily NK says the case sent shockwaves through elite circles in Pyongyang, the military, and universities, and that authorities are expected to impose heavy penalties on those involved.
Case is framed against a broader record of North Korea-linked crypto laundering
Daily NK says the bank infiltration appears to be a single case, but that it also highlights North Korea’s longstanding use of cyber tools for illicit financial activity.
A report published by blockchain security firm CertiK in May said North Korea-linked hacking groups were responsible for $2.06 billion in cryptocurrency losses in 2025, accounting for 60% of global crypto theft losses. Since 2016, the cumulative amount stolen has reached $6.75 billion, according to the report.
CertiK report author Taylor Monahan said social engineering remains the primary attack method used by North Korean hacking groups, and that stolen funds are often laundered very quickly through decentralized exchanges and cross-chain bridges.
CertiK also said the U.S. Department of Justice filed a civil forfeiture action in June last year involving $7.7 million in cryptocurrency tied to a money-laundering network linked to North Korean IT workers. Court documents cited in the report say a wallet controlled by sanctioned North Korean Trade Bank representative Sim Hyon Sop received more than $24 million in cryptocurrency between August 2021 and March 2023.
The reported breach of internal banking systems adds another example of how North Korea faces cybersecurity weaknesses within its own financial system while remaining a focus of international scrutiny over external crypto-related attacks.