25.07.2026 ForkLog

A group of IT specialists in Pyongyang has been arrested for hacking into the internal networks of two North Korean state banks and funneling stolen assets through cryptocurrency. This was reported by Daily NK, citing a source in the capital.

Details

According to the source, the organizers were former military personnel from the country’s cyber intelligence units. After their service, they recruited graduates from Kim Chaek University and Pyongyang University of Science and Technology.

The group gained access to the internal networks of the Central Bank of North Korea and the Foreign Trade Bank, as well as the international settlement system. The Central Bank is responsible for issuing and managing state funds, while the Foreign Trade Bank handles currency operations. To bypass controls, the participants allegedly used Chinese wireless equipment and encrypted messaging apps.

The money was transferred in small amounts to overseas crypto wallets. Through Chinese brokers, the assets were converted into cryptocurrency. The funds were then moved to the border cities of Sinuiju and Hyesan, where they were exchanged for cash in dollars and yuan.

How the Group Was Discovered

Authorities became suspicious due to discrepancies in currency payment approvals in Pyongyang. Simultaneously, attempts to access the system from foreign IP addresses were recorded. The State Information Bureau initiated an internal investigation.

The agency traced the encrypted traffic of cryptocurrency transactions to a safe house in Pyongyang. According to the source, on the night of July 12, the house was raided, and all participants were arrested on the spot. Authorities seized computer equipment worth hundreds of thousands of dollars and phones registered to fake identities.

Following the arrests, armed guards were stationed at both banks, and radio interception vehicles were deployed throughout the city. The source noted that harsh sentences are expected in the North Korean capital.

“They were taught technology to protect the country, but they looted the state treasury,” the source said.

Earlier, in the first half of 2026, groups linked to North Korea accounted for about 66% of all stolen funds in the crypto industry—approximately $643 million, according to TRM Labs.