North Korea arrests elite hackers in July 12 bank crypto theft

North Korean authorities detained a group of former state cyber operators who allegedly hacked two state banks and laundered stolen funds through cryptocurrency, marking a rare internal crackdown on the country's elite hacking units.

North Korean authorities arrested a group of former state cyber operators on July 12 for allegedly hacking the country's central bank and Foreign Trade Bank, converting stolen funds into cryptocurrency and laundering them through China-based brokers, Daily NK reported Thursday.

"Investigators traced suspicious crypto transfers to a safe house in Pyongyang, where the group operated using encrypted communication systems and Chinese wireless equipment," the Seoul-based outlet reported, citing an anonymous source inside North Korea.

The group included former members of a cyber warfare unit under the Reconnaissance and Intelligence General Bureau and recruited graduates from Kim Chaek University of Technology and Pyongyang University of Science, according to the report. The stolen cryptocurrency was moved through brokers in China who converted the digital assets into cash before contacts near the North Korean border exchanged the funds into fiat currencies.

If confirmed, the arrests would mark the first known case of North Korea cracking down on its own state-backed hackers for stealing from domestic financial institutions. Pyongyang has long been accused by the United Nations, the United States, South Korea and Japan of directing groups including the Lazarus Group to steal billions of dollars from crypto companies to circumvent international sanctions.

The suspects were detained after investigators reviewed cryptocurrency transactions linked to the Chosun Central Bank and the Foreign Trade Bank, the report said. Officials have not released the identities of those arrested or announced potential penalties, and Cointelegraph could not independently verify the report.

North Korea has consistently rejected allegations of state-sponsored hacking as politically motivated. The reported arrests suggest internal tensions within the country's cyber operations, which have been a key revenue source for the regime as international sanctions tightened. The regime has used cyber theft to generate hard currency that bypasses the formal financial system, making its hacking units a critical component of its sanctions-evasion strategy.

The Lazarus Group and other North Korean hacking units have been linked to some of the largest crypto thefts globally, including attacks on Ronin Bridge, Harmony Horizon Bridge, Atomic Wallet, Alphapo, CoinEx, DMM Bitcoin and WazirX, according to US government and blockchain security firm reports. North Korea-linked hackers have stolen billions of dollars in digital assets since 2017, according to UN Security Council findings. The scale of these operations has made North Korea one of the most prolific state-backed cyber threats to the crypto industry.

The involvement of former cyber warfare operatives in the alleged scheme raises questions about oversight of North Korea's hacking apparatus. If the regime is now policing its own operators, it could signal instability in a system that has relied on cyber theft as a primary sanctions-evasion tool. The arrests also highlight how cryptocurrency continues to serve as both a revenue source and a point of vulnerability for the isolated state.

The case is likely to draw renewed attention from international regulators and blockchain forensic firms monitoring North Korea-linked wallet addresses. Any confirmation of internal disciplinary action could provide investigators with rare insight into the structure and personnel of the country's cyber operations, potentially aiding efforts to trace and freeze stolen assets held in crypto wallets tied to the regime. South Korean and US authorities have previously identified thousands of crypto addresses linked to North Korean hacking groups, many of which remain under active surveillance.

This article is for informational purposes only and does not constitute investment advice.