North Korean authorities arrested former military personnel suspected of participating in a scheme involving bank intrusions, diversion of state funds, and money laundering through cryptocurrencies.
According to information released by Daily NK, the group allegedly attacked the internal systems of two financial institutions in the country: the Central Bank of the DPRK and the Foreign Trade Bank.
The suspects are accused of withdrawing foreign currency and resources related to foreign trade before transferring part of the amounts to cryptocurrency wallets held outside North Korea.
The operation allegedly involved Chinese intermediaries responsible for converting the digital assets into U.S. dollars and yuan. According to the report, contacts in Sinuiju and Hyesan also took part in exchanging cryptocurrencies for money.
To make tracing the movements more difficult, those involved allegedly split the amounts into smaller transfers. The group also allegedly used messaging apps with privacy features, unregistered phones, and mobile communication equipment originating from China.
The arrest took place on 12 July, at a safe house located in Pyongyang, after investigators identified irregularities in foreign currency payment authorizations and activities considered suspicious related to intellectual property abroad.
The described method shows similarities to strategies previously attributed to hacker groups linked to the North Korean government. These groups are known for using stolen cryptocurrencies as an intermediate step before converting the funds into traditional currencies.
A multinational sanctions report also pointed to the participation of over-the-counter market operators and Chinese financial institutions in turning cryptocurrencies stolen by groups linked to Pyongyang into conventional money.
The figures associated with the operations are significant. According to Chainalysis, North Korean hackers stole about US$ 2 billion in cryptocurrencies last year, the highest annual amount ever recorded for these groups.
TRM Labs, in turn, estimated that North Korean actors accounted for 76% of losses related to attacks and scams involving cryptocurrencies through April 2020.