North Korea arrests former cyber elite for hacking state banks
The suspects were former cyber operatives from North Korea's main military intelligence agency, according to reports.
N. Korean hacker silhouette with North Korean flag. Bill Hinton/Getty.
- North Korea reportedly arrested former state cyber operators accused of hacking two state banks and laundering stolen funds through cryptocurrency.
- Daily NK said the suspects breached bank networks, split stolen money into small transfers, and cashed out through Chinese brokers.
- Authorities allegedly traced encrypted cryptocurrency traffic to a Pyongyang safe house and seized computers, burner phones, and other equipment.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
North Korea's government has reportedly arrested former state cyber operators accused of hacking two of the country's state banks and laundering the stolen funds through cryptocurrency.
The group allegedly breached the computer networks of the Central Bank of Korea, which oversees the country’s currency issuance and state fund management, and the Foreign Trade Bank, which handles foreign currency transactions and international settlements.
On July 23rd, an anonymous source in Pyongyang told Daily NK, “A criminal organization that hacked the internal computer networks of the Central Bank of Korea and the Foreign Trade Bank, which oversee state trade funds, converted stolen funds into virtual currency (coins), and smuggled foreign currency on a large scale in border areas, was completely wiped out by the State Intelligence Bureau (formerly the Ministry of State Security) on the 12th.”
The report could not be independently verified.
According to Daily NK, the group used specialized Chinese wireless equipment and encrypted messengers to avoid being monitored by North Korean authorities.
The group allegedly infiltrated the banks' internal networks and payment systems. Those who successfully breached the systems split the money into many small transfers to avoid detection.
After the breach, they converted the funds into cryptocurrencies “that are easy to cash out through Chinese brokers.” Those brokers then converted the coins into US dollars and Chinese yuan.
Local associates in border regions, such as Sinuiju in North Pyongan Province and Hyesan in Ryanggang Province, collected the dollars and yuan and smuggled the cash.
According to the publication, the suspects formerly belonged to the cyber operations unit under the General Reconnaissance and Intelligence Bureau (formerly known as the Reconnaissance General Bureau), North Korea's main military intelligence agency.
After leaving the military, they recruited young IT prodigies from state universities to establish a cryptocurrency trading network designed to avoid government surveillance, Daily NK reports.
Authorities noticed small accounting inconsistencies and detected suspicious overseas IP access records, launching an internal investigation.
They eventually traced encrypted cryptocurrency traffic to a house in downtown Pyongyang and launched a raid on July 12th.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The operation resulted in the arrests of the group's ringleaders and IT personnel from the General Reconnaissance and Intelligence Bureau, Daily NK reports. Computer equipment worth hundreds of thousands of dollars and burner phones were all confiscated.
Reportedly, Pyongyang officials anticipate severe punishment, stating, “Since they robbed the national treasury using the skills taught to defend the country, it will be difficult for their entire family to survive, going beyond the principle of guilt by association.”
Pyongyang has repeatedly been linked to state-backed cyber operations targeting cryptocurrency firms and exchanges. The funds are believed to help finance the regime and avoid sanctions.
