North Korea's government reportedly detained a group of former military hackers who allegedly infiltrated two state-owned banks and funneled stolen funds through cryptocurrency channels. This unusual incident, if confirmed, marks a rare case where the regime is the victim rather than the perpetrator of cyber theft.
Inside the Alleged Cyber Theft and Laundering Operation
The arrests took place on the night of July 12, as agents from the National Intelligence Agency raided a safe house in Pyongyang, catching the suspects actively laundering hundreds of millions of dollars. Officials seized numerous disposable phones and electronic devices valued at several hundred thousand dollars.
Following the raid, security forces sealed off the Foreign Trade Bank’s headquarters and the computer center of the Chosun Central Bank to block any external access. Vehicles equipped to detect mobile signals swept the city in search of suspicious radio communications. The crackdown was reportedly triggered by irregularities discovered in foreign-currency transfers and unusual access from foreign IP addresses.
Ex-Military Hackers Turn Rogue for Personal Gain
Sources indicate that the ring leaders were discharged members of North Korea’s Reconnaissance and Intelligence General Bureau’s cyber unit, previously engaged in overseas cyber operations. After leaving their posts, they recruited young tech experts from local universities to build a covert network siphoning state funds without government oversight.
The laundering strategy echoed tactics seen in prior DPRK-linked cyber operations, involving crypto wallets, Chinese OTC brokers, and physical cash couriers across borders. North Korean hackers have previously stolen more than $6 billion in cryptocurrency since 2017, mostly targeting foreign entities. This instance stands out because the alleged victims are state banks themselves.
The motivations appear personal rather than political, with the rogue hackers seeking financial gain. The National Intelligence Agency's swift response highlights rising concerns about internal threats within North Korea's cyber apparatus.
