North Korea Now Leans on Crime Networks to Launder Stolen Crypto: RUSI

North Korea is increasingly pushing stolen cryptocurrency through the same money-laundering networks used by scam syndicates and organised crime, blurring the trail investigators follow, according to a research paper published this month by the Royal United Services Institute, a British defence and security think tank.

The regime stole at least $2.8 billion in virtual assets between January 2024 and September 2025, funds the paper says are assumed to support its weapons programme. Authors Allison Owen and Noémi També focus on the point where that money turns into cash, rather than the well-documented journey through decentralised services.

Ownership frequently changes hands before conversion, with a third party sometimes buying the stolen coins outright at a discount. One investigator told the authors that such a handover can be inferred when funds turn up mixed with proceeds from activities like “pig butchering” investment scams, or at addresses tied to entities such as Cambodia’s Huione Group, whose infrastructure the Justice Department seized in June. Elliptic, which supplied data for the research, believes that handover often happens on the Bitcoin blockchain.

After the February 2025 Bybit hack, incident responders at ZeroShadow found the regime relying on a network of launderers, over-the-counter desks and peer-to-peer traders, often Chinese nationals working around the clock. TraderTraitor, the North Korean group behind the theft, used Chinese organised crime groups to move the money and hand back cash.

That overlap is the problem the paper puts to compliance teams, because once the regime’s proceeds enter criminal ecosystems the markers of proliferation finance become hard to separate from ordinary laundering.

Mules and small amounts

The accounts doing the cashing out usually belong to someone else, with mules recruited mainly in the Philippines, Indonesia and China, where credentials sell cheaply enough to buy in bulk and open accounts at scale. Interviewees said mules told whom they are actually working for generally want no further part in it.

Conversion happens in small pieces, with actors selling roughly $7,000 of stablecoins at a time on peer-to-peer marketplaces, under the thresholds that trigger bank review, while ZeroShadow found larger sums broken into $30,000 chunks so that a freeze “would not be overly impactful.” Behaviour at the exchange itself offers further signals, from Astrill VPN logins to the 50 to 70 support tickets launderers now file to get a single held transaction released.

Reaching cash

Fiat rarely arrives by simple bank transfer, with proceeds from over-the-counter brokers often deposited into North Korean-controlled accounts using UnionPay cards issued by Chinese banks. The paper lists 19 Chinese banks that the Multilateral Sanctions Monitoring Team identified last year as used by the regime and its proxies.

Of the roughly $1.5 billion taken from Bybit, 95% moved through decentralised services, and the monitoring team reported that all of it had been converted into fiat or hard currency by September 2025.

The authors call for regulatory guidance on correspondent relationships between exchanges, standardised onboarding questionnaires, secure intelligence-sharing channels, and a VASP identifier in payment messages so receiving banks can spot them.

What that leaves for victims is clear from Bybit’s own accounts: the exchange announced Monday that it had sued North Korea and won an order freezing identified assets, having recovered $48.4 million and frozen $30.5 million more, together about 5% of what was taken.