After leaving the military, the scheme’s organizers began recruiting young IT specialists from Kim Chaek University of Technology and Pyongyang University of Science and Technology, an anonymous source told Daily NK. According to him, the group established a clandestine infrastructure for cryptocurrency operations to launder stolen funds.
Group members used specialized wireless equipment manufactured in China and encrypted messaging apps. Skills acquired during service in cyber units enabled them to infiltrate the central bank’s internal networks and payment systems, as well as those of the state foreign trade bank.
According to the source Daily NK, funds were withdrawn in small batches to avoid detection. They were then sent to overseas crypto wallets, after which brokers linked to the group in China exchanged the digital assets for cash. The resulting US dollars and Chinese yuan were allegedly distributed through a network of intermediaries in the border cities of Xinjiang and Hesan.
North Korean authorities launched an investigation after financial agencies discovered discrepancies in foreign exchange transactions and suspicious connections to banking systems from overseas IP addresses. Subsequently, North Korea’s National Intelligence Service initiated an internal review.
Intelligence agencies identified the address of a covert apartment in Pyongyang, from which, according to investigators, the operations were coordinated. During the raid, suspected organizers and IT specialists were detained, and computer equipment and unregistered disposable phones were seized. Following the incident, security was heightened around the Foreign Trade Bank and the Central Bank’s computing center, while equipment was deployed to detect other devices operating on the same non-standard frequencies.
According to sources from Daily NK, the investigation has caused widespread concern among North Korean officials and military personnel, as former employees of elite state cyber units were involved in the criminal scheme. A source told the publication that those implicated in the case could face the harshest possible penalties, including the death penalty.
Previously, cybersecurity experts at CertiK calculated that over the past ten years, North Korean hackers have stolen $6.75 billion worth of crypto assets in 263 confirmed attacks.