North Korean hackers stole at least $2.8 billion in virtual assets between January 2024 and September 2025 to fund the country’s weapons program. However, the cash-out flow has now shifted. A recent report by the British defense think tank, the Royal United Services Institute (RUSI), reveals that the regime is increasingly depositing its stolen crypto into the same money laundering networks used by scam syndicates and organized crime groups.
This shifting pattern is most clearly visible following the $1.5 billion exploit of the Bybit crypto exchange in February 2025. The North Korean hacker group known as TraderTraitor no longer cashes out the funds themselves. They employ professional money launderers, over-the-counter (OTC) trading desks, and peer-to-peer (P2P) traders. Many of the ground-level operatives are Chinese nationals working around the clock for organized crime groups to move money across borders.
Splitting Transactions Under the Bank Radar
To avoid blocks, the syndicate cuts down transaction amounts. Exchanges on the P2P market are executed in amounts of around $7,000 per transaction using stablecoins, a figure intentionally set below bank screening thresholds. Even if there is a need to move larger amounts of funds, the size is capped at a maximum of around $30,000 per transaction.
The recipient accounts for these cashed-out fiat funds are also not registered under the hackers’ names. The syndicate recruits ordinary citizens or purchases cheap personal data to open accounts. According to the RUSI report, most of these rented identities are recruited from Asian countries, particularly the Philippines, Indonesia, and China.
Flowing to Regime Accounts
Once converted to cash, the funds are often deposited into accounts controlled by North Korea using UnionPay cards from Chinese banks. MSMT identified 19 Chinese banks whose networks were exploited by this regime. Blockchain analytics firm Elliptic noted that the handovers of stolen funds between these syndicates often occur on the Bitcoin network.
Out of the total $1.5 billion stolen from Bybit, 95% of it was funneled through various decentralized services. As a result, the entire hacked sum had been laundered and converted into fiat currency by September 2025.
This exploitation pattern is increasingly becoming standard for global syndicates. On-chain sleuth @zachxbt on X also recently exposed an Indian scammer network with a similar pattern, which led to the freezing of 5.73 BTC worth $475,000 on the Changelly platform.
What Can Exchanges Do?
On Monday, Bybit announced that it had sued the North Korean hackers and won an asset freezing order from the court. Through this legal action, Bybit secured $48.4 million in recovered funds and $30.5 million currently frozen across various platforms.
However, that amount is only about 5% of the total lost funds. For the crypto industry, this serves as a stark warning: when state-sponsored hackers employ civilian scam networks and thousands of mule accounts across Asia, freezing one or two blockchain wallets is no longer enough to stop the flow of money.
As reported by Decrypt.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
