Key Points
- Former military cyber operatives were detained by North Korean authorities for targeting domestic financial institutions
- The suspects allegedly compromised the Foreign Trade Bank and the Central Bank of the DPRK
- Laundering operations involved converting stolen assets to cryptocurrency through contacts in China
- The group employed fragmented transactions and secure communication tools to evade surveillance
- Detentions occurred on July 12 at a secure location in Pyongyang following detection of irregular activity
Authorities in North Korea have allegedly detained a network of former military cyber operatives and technology specialists on charges of embezzling government assets from domestic banking institutions and converting them through cryptocurrency channels.
The incident was first disclosed by Daily NK, a South Korean news organization, on Thursday, based on information from an undisclosed source within Pyongyang. Independent confirmation of these allegations by Cointelegraph and similar media organizations has not been possible.
Based on the reporting, the cyber team successfully infiltrated the digital infrastructure of both the Foreign Trade Bank and the Central Bank of the DPRK. They systematically redirected hard currency reserves and state commerce funds into cryptocurrency accounts held internationally.
The operation depended on establishing connections with intermediaries located in Chinese cities along the border. These brokers, operating from Sinuiju and Hyesan, facilitated immediate conversion of digital assets into U.S. dollars and Chinese yuan.
The operatives employed various evasion tactics, including fragmenting transactions into smaller denominations. Their toolkit also included secure messaging platforms, unregistered mobile devices, and Chinese telecommunications hardware.
Details of the Detention Operation
North Korea’s National Intelligence Agency executed the arrests on July 12 at a covert facility in the capital city. Investigators identified anomalies in foreign exchange authorization procedures and tracked suspicious international IP addresses.
Should these reports prove accurate, this represents an uncommon instance of North Korean cyber personnel targeting domestic government resources instead of international entities.
The hermit kingdom has established a reputation for deploying state-sponsored hacking operations against international cryptocurrency platforms. These initiatives serve as revenue generation mechanisms and circumvent global economic restrictions.
Pyongyang’s History of Cryptocurrency Theft
The money laundering techniques outlined in the Daily NK account are consistent with operational patterns observed in established North Korean cyber groups functioning internationally.
International sanctions monitoring bodies have previously documented the critical involvement of Chinese over-the-counter exchange operators in transforming stolen digital currencies into traditional money for North Korean-affiliated operatives.
According to blockchain intelligence company Chainalysis, North Korean cyber groups successfully exfiltrated a historic $2 billion worth of cryptocurrency during 2025.
Research from TRM Labs indicated that entities linked to North Korea accounted for 76% of total cryptocurrency theft and fraud losses recorded through April 2026.
Daily NK operates from Seoul and maintains a network of informants within North Korean territory. Due to severe limitations on access and information transparency, independent verification of reports originating from the isolated nation remains exceptionally challenging.
As of this writing, no official governmental authority or international organization has provided confirmation of the reported detentions.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
