North Korea has arrested former state-linked cyber operatives for hacking two of its own banks and laundering the stolen money through cryptocurrency wallets, according to reports this week. The detentions mark a rare instance of Pyongyang publicly disciplining its own hackers, who are typically deployed for foreign cyberattacks and sanctions evasion.
The suspects, described as former employees of a state cyber unit, are accused of breaching two domestic banks and siphoning funds before converting the proceeds into crypto to obscure the trail. The arrests were confirmed by North Korean state media, which did not name the individuals or specify the banks involved.
The arrests
State media said the former operators were taken into custody after an internal investigation uncovered the theft and subsequent laundering operation. The hackers allegedly used cryptocurrency wallets to move the stolen funds, a method North Korea itself has employed extensively to bypass international sanctions. The exact amount stolen has not been disclosed.
North Korea rarely prosecutes its own cyber operatives. The country’s hacking units, such as the Lazarus Group, are known for targeting foreign exchanges and financial institutions. This internal crackdown could signal a purge within the elite cyber corps or an effort to rein in rogue actors who threaten the regime’s control over illicit finance. It may also be a show of discipline aimed at foreign audiences, though analysts caution against reading too much into a single incident.
The crypto angle
The use of cryptocurrency wallets to launder the proceeds is notable. North Korea has been accused by the United Nations of using crypto to fund its weapons programs, with estimates suggesting the regime stole over $1.7 billion in digital assets between 2017 and 2023. That the same technique was turned against domestic banks underscores how deeply crypto laundering has penetrated the state’s operations.
What’s next
No further details have emerged about the fate of the arrested operators. It remains unclear whether they will face a public trial or be dealt with quietly. The incident raises unresolved questions about how much control Pyongyang actually has over its cyber units — and whether more arrests could follow.
