North Korea Now Leans on Crime Networks to Launder Stolen Crypto: RUSI – Decrypt

North Korea is more and more pushing stolen cryptocurrency by means of the identical money-laundering networks utilized by rip-off syndicates and organised crime, blurring the path investigators comply with, in line with a analysis paper revealed this month by the Royal United Companies Institute, a British defence and safety suppose tank.

The regime stole a minimum of $2.8 billion in digital belongings between January 2024 and September 2025, funds the paper says are assumed to assist its weapons programme. Authors Allison Owen and Noémi També deal with the purpose the place that cash turns into money, reasonably than the well-documented journey by means of decentralised providers.

Possession incessantly adjustments fingers earlier than conversion, with a 3rd social gathering typically shopping for the stolen cash outright at a reduction. One investigator advised the authors that such a handover may be inferred when funds flip up combined with proceeds from actions like “pig butchering” funding scams, or at addresses tied to entities similar to Cambodia’s Huione Group, whose infrastructure the Justice Division seized in June. Elliptic, which provided knowledge for the analysis, believes that handover typically occurs on the Bitcoin blockchain.

After the February 2025 Bybit hack, incident responders at ZeroShadow discovered the regime counting on a community of launderers, over-the-counter desks and peer-to-peer merchants, typically Chinese language nationals working across the clock. TraderTraitor, the North Korean group behind the theft, used Chinese language organised crime teams to maneuver the cash and hand again money.

That overlap is the issue the paper places to compliance groups, as a result of as soon as the regime’s proceeds enter felony ecosystems the markers of proliferation finance change into onerous to separate from extraordinary laundering.

Mules and small quantities

The accounts doing the cashing out normally belong to another person, with mules recruited primarily within the Philippines, Indonesia and China, the place credentials promote cheaply sufficient to purchase in bulk and open accounts at scale. Interviewees mentioned mules advised whom they’re really working for typically need no additional half in it.

Conversion occurs in small items, with actors promoting roughly $7,000 of stablecoins at a time on peer-to-peer marketplaces, below the thresholds that set off financial institution overview, whereas ZeroShadow discovered bigger sums damaged into $30,000 chunks so {that a} freeze “wouldn’t be overly impactful.” Behaviour on the change itself gives additional indicators, from Astrill VPN logins to the 50 to 70 assist tickets launderers now file to get a single held transaction launched.

Reaching money

Fiat hardly ever arrives by easy financial institution switch, with proceeds from over-the-counter brokers typically deposited into North Korean-controlled accounts utilizing UnionPay playing cards issued by Chinese language banks. The paper lists 19 Chinese language banks that the Multilateral Sanctions Monitoring Crew recognized final 12 months as utilized by the regime and its proxies.

Of the roughly $1.5 billion taken from Bybit, 95% moved by means of decentralised providers, and the monitoring workforce reported that every one of it had been transformed into fiat or onerous forex by September 2025.

The authors name for regulatory steerage on correspondent relationships between exchanges, standardised onboarding questionnaires, safe intelligence-sharing channels, and a VASP identifier in cost messages so receiving banks can spot them.

What that leaves for victims is evident from Bybit’s personal accounts: the change introduced Monday that it had sued North Korea and received an order freezing recognized belongings, having recovered $48.4 million and frozen $30.5 million extra, collectively about 5% of what was taken.