Key facts
- North Korea stole at least $2.8 billion in cryptocurrency between January 2024 and September 2025.
- The regime increasingly launders stolen crypto through established criminal networks and investment scam proceeds.
- Money mules are recruited in the Philippines, Indonesia, and China to facilitate cash-outs.
- Funds are often mixed with proceeds from activities like 'pig butchering' investment scams.
- Bybit has recovered $48.4 million and frozen an additional $30.5 million of stolen assets.
North Korea is increasingly utilizing established criminal networks to launder stolen cryptocurrency, blurring the lines for investigators, according to a research paper by the British think tank Royal United Services Institute (RUSI). The regime is estimated to have stolen at least $2.8 billion in virtual assets between January 2024 and September 2025, with these funds presumed to support its weapons programs.
The paper, authored by Allison Owen and Noémi També, focuses on how these stolen funds are converted into cash. Ownership often changes hands before conversion, with third parties sometimes purchasing the stolen coins at a discount. Investigators have observed these funds mixed with proceeds from investment scams, such as 'pig butchering,' or appearing at addresses linked to entities like Cambodia's Huione Group. Data suggests these handovers frequently occur on the Bitcoin blockchain.
Following the February 2025 Bybit hack, incident responders identified North Korea's reliance on a network of launderers, over-the-counter desks, and peer-to-peer traders, often Chinese nationals. The TraderTraitor group, responsible for the Bybit theft, reportedly used Chinese organized crime groups for money movement and cash conversion. This overlap between proliferation finance and ordinary money laundering presents a significant challenge for compliance teams.
To facilitate cash-outs, North Korea recruits money mules, primarily in the Philippines, Indonesia, and China, where credentials can be acquired cheaply in bulk to open numerous accounts. Funds are typically converted in small amounts, often around $7,000 in stablecoins, to avoid triggering bank reviews. Larger sums are broken into $30,000 chunks to mitigate the impact of potential freezes. Launderers also employ tactics like filing numerous support tickets to release held transactions.
Fiat currency is often deposited into North Korean-controlled accounts via UnionPay cards issued by Chinese banks. The paper identifies 19 Chinese banks previously flagged by the Multilateral Sanctions Monitoring Team for use by the regime. Of the approximately $1.5 billion stolen from Bybit, 95% moved through decentralized services, with all of it reportedly converted to fiat or hard currency by September 2025.
The authors advocate for enhanced regulatory guidance, including standardized onboarding questionnaires for exchanges, secure intelligence-sharing channels, and a Virtual Asset Service Provider (VASP) identifier in payment messages to aid receiving banks in identifying illicit flows. Bybit announced it had sued North Korea and secured an order freezing assets, recovering $48.4 million and freezing an additional $30.5 million, representing about 5% of the total stolen.