A criminal ring hacked into the internal networks of North Korea’s central bank and its main foreign trade bank. The ring used cryptocurrency to launder stolen funds and smuggle foreign currency across the border. Word that state-trained, elite information technology personnel were involved has shaken officials in the capital.
A source in Pyongyang told Daily NK on Thursday that hackers breached the internal networks of the Chosun Central Bank and the Foreign Trade Bank. The Chosun Central Bank oversees North Korea’s currency issuance and state fund management. The Foreign Trade Bank handles the country’s foreign payments and currency transactions. The ring converted stolen state trade funds into cryptocurrency and smuggled large amounts of foreign currency in border regions, the source said. North Korea’s National Intelligence Agency, formerly the Ministry of State Security, rounded up the group on July 12.
The breach struck at the core of North Korea’s financial system. It came from within, carried out by the country’s own IT workforce.
Veterans turned hackers built a hidden network
According to the source, the ringleaders were discharged veterans from a cyber operations unit under North Korea’s Reconnaissance and Intelligence General Bureau, the successor to the Reconnaissance General Bureau, the country’s military intelligence agency long known for technology-driven espionage and hacking operations. After leaving the military, the veterans recruited young IT prodigies from Kim Chaek University of Technology and Pyongyang University of Science. The group quietly built a cryptocurrency trading network designed to bypass state surveillance. Their goal, the source said, was to earn foreign currency and enrich themselves personally.
To avoid detection, the group used Chinese-made specialized wireless equipment and encrypted messaging apps. They drew on hacking skills sharpened in the military and at university. Using those skills, they broke into the well-guarded internal networks and foreign payment systems of both banks.
Once inside, the hackers split off portions of state trade funds and foreign currency held in shell accounts. They broke the amounts into tiny increments to avoid detection and then moved the funds into overseas cryptocurrency wallets. Brokers in China converted the coins back into cash.
Contacts in border areas exchanged the laundered coins for U.S. dollars and Chinese yuan in real time. That network included operatives in Sinuiju, North Pyongan province, and Hyesan, Ryanggang province.
The group accumulated substantial wealth while evading state controls, the source said, but the operation did not last. Officials in Pyongyang began noticing small discrepancies in foreign currency payment approvals. They also flagged suspicious overseas IP access records. The National Intelligence Agency launched a covert internal investigation soon after.
Investigators traced encrypted cryptocurrency transaction traffic to a safe house in Pyongyang. Agents raided the house on the night of July 12. They arrested the ringleaders and IT personnel on the spot, catching them laundering funds at their computers. Authorities also confiscated computer equipment worth hundreds of thousands of dollars. They seized unregistered “burner” phones the group had used to evade monitoring.
Armed National Intelligence Agency personnel then took up positions around the Foreign Trade Bank’s headquarters and the Chosun Central Bank’s computing center. Outside access was cut off entirely. Mobile signal-detection vehicles fanned out across Pyongyang to track the group’s irregular wireless frequencies. The capital saw a tense atmosphere for a time.
Concern over fallout
News of the case has since spread among Pyongyang’s elite, military circles and university communities. It reportedly caused shock at the scale and audacity of the scheme. Officials in Pyongyang expect harsh punishment for those involved. “They used the skills the state trained them with to defend the country, and instead robbed the country’s coffers,” one official said, according to the source. “This goes beyond ordinary guilt-by-association penalties. It will be hard for the entire family line to survive.”
Senior officials in the Reconnaissance and Intelligence General Bureau and in the country’s science and technology education sector are reportedly staying cautious. They worry that responsibility for the scandal could spread to them as well.
Reporting from inside North Korea
Daily NK operates networks of sources inside North Korea who document events in real-time and transmit information through secure channels. Unlike reporting based on state media, satellite imagery, or defector accounts from years past, our journalism comes directly from people currently living under the regime. We verify reports through multiple independent sources and cross-reference details before publication.
Our sources remain anonymous because contact with foreign media is treated as a capital offense in North Korea — discovery means imprisonment or execution. This network-based approach allows Daily NK to report on developments other outlets cannot access: market trends, policy implementation, public sentiment, and daily realities that never appear in official narratives.
Maintaining these secure communication channels and protecting source identities requires specialized protocols and constant vigilance. Daily NK serves as a bridge between North Koreans and the outside world, documenting what’s happening inside one of the world’s most closed societies.