North Korea is increasingly funneling stolen cryptocurrency through money-laundering networks shared with scam syndicates and organized crime, making it harder for investigators to trace the illicit funds, according to a research paper published this month by the Royal United Services Institute (RUSI), a British defense and security think tank.
The regime is estimated to have stolen at least $2.8 billion in virtual assets between January 2024 and September 2025, funds that the paper suggests are likely used to support its weapons programs. Authors Allison Owen and Noémi També focused their analysis on the critical stage where these digital assets are converted into usable cash, rather than the more widely documented movement through decentralized services.
Ownership of the stolen cryptocurrency frequently changes hands before conversion. In some instances, a third party will purchase the illicit coins outright at a discounted rate. One investigator cited in the paper indicated that such a transfer of ownership can be inferred when the stolen funds are found mixed with proceeds from activities like “pig butchering” investment scams, or when they appear at addresses linked to entities such as Cambodia’s Huione Group, whose infrastructure was seized by the U.S. Justice Department in June. Elliptic, a firm that provided data for the research, believes these handovers often occur on the Bitcoin blockchain.
Following the February 2025 Bybit hack, incident responders at ZeroShadow observed the North Korean regime relying on a complex network of launderers, over-the-counter (OTC) desks, and peer-to-peer traders. Many of these individuals are reportedly Chinese nationals working around the clock. TraderTraitor, the North Korean hacking group implicated in the theft, allegedly utilized Chinese organized crime groups to facilitate the movement of funds and the subsequent return of cash.
This overlap between North Korea’s illicit finance activities and criminal ecosystems presents a significant challenge for compliance teams, as the markers of proliferation finance become difficult to distinguish from ordinary money laundering once the proceeds enter these networks.
The accounts used for cashing out the cryptocurrency typically belong to individuals recruited as mules, primarily from the Philippines, Indonesia, and China. In these regions, credentials can be acquired cheaply enough to allow for bulk purchases and the opening of numerous accounts at scale. Interviewees indicated that these mules generally have no further involvement or knowledge of who they are ultimately working for.
The conversion process is often conducted in small increments. Actors are observed selling approximately $7,000 worth of stablecoins at a time on peer-to-peer marketplaces, amounts designed to fall below thresholds that would trigger bank reviews. ZeroShadow also noted that larger sums, such as those from the Bybit hack, were broken down into $30,000 chunks to minimize the impact of potential asset freezes. Further indicators of suspicious activity at exchanges include logins via Astrill VPN and the filing of 50 to 70 support tickets by launderers to expedite the release of single held transactions.
The conversion to fiat currency rarely occurs through simple bank transfers. Proceeds from OTC brokers are frequently deposited into accounts controlled by North Korea, often using UnionPay cards issued by Chinese banks. The RUSI paper identifies 19 Chinese banks that were flagged last year by the Multilateral Sanctions Monitoring Team as being used by the North Korean regime and its proxies.
Of the approximately $1.5 billion stolen from Bybit, 95% was initially moved through decentralized services. The monitoring team reported that by September 2025, all of these funds had been converted into fiat or hard currency.
The authors of the report are calling for enhanced regulatory guidance on correspondent banking relationships between exchanges, standardized customer onboarding questionnaires, secure channels for intelligence sharing, and the implementation of a Virtual Asset Service Provider (VASP) identifier in payment messages. This would enable receiving banks to more easily identify and flag suspicious transactions.
The limited success in recovering stolen assets is evident in Bybit’s recent actions. The exchange announced Monday that it had sued North Korea and obtained an order freezing identified assets. Bybit has recovered $48.4 million and frozen an additional $30.5 million, collectively representing about 5% of the total amount stolen.
