Security Current Affairs

North Korea's Elite Hackers Got Caught Stealing From Their Own Banks

2026-07-25

Here's a story that shouldn't work but absolutely does: North Korea's best hackers—the ones trained to plunder crypto exchanges worldwide—got nabbed stealing from their own government. On July 12, the National Intelligence Agency raided a safe house in Pyongyang and arrested the ringleaders, catching them red-handed laundering funds at their computers. The irony is almost too perfect.

The group had breached the Chosun Central Bank and the Foreign Trade Bank. The first handles North Korea's currency issuance and state fund management; the second manages foreign payments and currency transactions. Not exactly minor targets. These weren't random teenagers—they were former members of a cyber warfare unit under the Reconnaissance and Intelligence General Bureau, people who'd recruited top graduates from Kim Chaek University of Technology and Pyongyang University of Science.

The operation they ran was slick. They stole state trade funds, converted them into cryptocurrency, and smuggled large amounts of foreign currency across border regions. Contacts in Sinuiju and Hyesan exchanged the laundered coins for U.S. dollars and Chinese yuan in real time. They fragmented transfers into smaller amounts, used encrypted communications, and tried every trick in the book. But they were designed to evade oversight from abroad, not from above.

What caught them was almost mundane. Officials in Pyongyang noticed small discrepancies in foreign currency payment approvals and flagged suspicious overseas IP access records. The National Intelligence Agency launched a covert internal investigation. The breach proved impossible to hide once it reached scale. When authorities moved in, they confiscated computer equipment worth hundreds of thousands of dollars.

Now here's where it gets interesting. Internationally, North Korean hacking groups have become the dominant force in cryptocurrency theft. In 2026 year-to-date, they stole approximately $577 million—76% of all crypto hack losses through April—across just a handful of attributed incidents. Last year, 2025, was worse: they stole $2.02 billion, a 51% year-over-year increase. Their all-time total sits at $6.75 billion despite fewer attacks. They've gotten better at stealing more with less effort.

The playbook is sophisticated. They embed IT workers inside crypto services. They use advanced impersonation tactics targeting executives. They show clear preferences for Chinese-language money laundering services, bridge services, and mixing protocols. Chinese intermediaries have become the backbone of North Korea's ability to convert stolen digital assets into usable currency. In fact, the laundering phase is handled almost entirely by Chinese intermediaries, not the North Koreans themselves.

So we have this paradox. North Korean state-backed groups dominate global cryptocurrency theft and sanctions evasion. But domestic control is fragile. Elite military-trained operatives could siphon state funds with relative ease, requiring months of investigation just to detect them. That suggests something uncomfortable: North Korea's intelligence apparatus struggles to monitor its own cyber personnel. If they can't watch their own people, controlling the decentralized networks that move billions in stolen crypto across international borders becomes nearly impossible.

A regime built on total control, undone by the very operatives it trained to evade control. There's a lesson in there somewhere.

Source & further reading:

Sources