The shadowy world of cybercrime just got a whole lot scarier. According to a recent bombshell report, hackers linked to North Korea stole a staggering $2.83 billion in virtual assets between 2024 and September 2025. This isn't just petty theft; it's a massive, state-sponsored operation that's reportedly fueling about one-third of the nation's total foreign currency income. 🤯
The data comes from the Multilateral Sanctions Monitoring Team (MSMT), a multinational coalition formed in late 2024 to enforce UN sanctions against Pyongyang. Their findings reveal not only North Korea's skill in digital theft but also a surprisingly sophisticated method for washing the illicit cash.
A Steep Rise in Stolen Crypto
The acceleration of these hacks is alarming. In 2024, North Korean syndicates, like the notorious TraderTraitor group, stole $1.19 billion. But in 2025, that figure surged by over 50%, reaching $1.64 billion by the end of September alone—and that’s before the final quarter’s tally is added.
This dramatic jump was heavily influenced by the high-profile hacking of the global exchange Bybit in February 2025.
The Bybit Hack: A Masterclass in Deception
The MSMT pinned the Bybit breach on TraderTraitor, one of the most advanced North Korean hacking organizations. Instead of attacking the exchange head-on, the hackers employed a more subtle, devastating tactic: they targeted third-party service providers.
- They first gathered intel on SafeWallet, Bybit’s multi-signature wallet provider.
- Then, they used classic phishing emails to gain unauthorized network access.
- Once inside, they disguised external transfers as routine internal asset movements, injecting malicious code to seize control of the cold wallet’s smart contract.
The report emphasizes that in recent years, North Korea has often preferred this indirect method, striking the weakest link in the security chain: the external vendors connected to major exchanges.
From Digital Theft to Usable Cash: The Nine-Step Laundering Scheme
Stealing the crypto is only half the battle. Converting billions into usable fiat currency is the real logistical challenge, and the MSMT detailed a meticulously structured, nine-step laundering mechanism North Korea uses to pull it off:
- DEX Swap: Stolen assets are immediately swapped for less traceable cryptocurrencies, like Ethereum (ETH), on a Decentralized Exchange (DEX).
- Initial Mixing: Funds are 'mixed' using privacy-enhancing services such as Tornado Cash, Wasabi Wallet, or Railgun to obscure their origins.
- Bridge to BTC: The mixed ETH is then converted to Bitcoin (BTC) using cross-chain bridge services.
- Centralized Relay: The BTC is briefly moved through centralized exchange accounts before being sent to an "unaffiliated" cold wallet.
- Second Mixing & Dispersal: The funds undergo another round of mixing and are scattered across multiple wallets.
- Swap to TRX: BTC is converted to Tron (TRX) via bridge and Peer-to-Peer (P2P) trades.
- Stablecoin Conversion: TRX is converted into the stablecoin USDT (Tether).
- OTC Transfer: The USDT is transferred to an Over-the-Counter (OTC) broker.
- Fiat Cash-Out: The OTC broker liquidates the assets into local fiat currency, making the money accessible and ready to spend.
The Global Network of Cash-Out Facilitators
This final stage relies on a global network of facilitators. The report implicated OTC brokers and financial companies in third-party countries, including China, Russia, and Cambodia.
- Chinese Intermediaries: Individuals like Chinese nationals Ye Dinrong and Tan Yongzhi (of Shenzhen Chain Element Network Technology) and P2P trader Wang Yicong were named for allegedly providing fraudulent IDs and helping launder the assets.
- Russian Assistance: Russian intermediaries were involved in liquidating roughly $60 million stolen in the Bybit hack.
- Cambodian Financial Services: Huione Pay, a financial service provider under Cambodia’s Huione Group, was used for a similar purpose. The MSMT noted a North Korean national had a personal relationship with the firm's associates, helping cash out assets in late 2023.
Although the National Bank of Cambodia refused to renew Huione Pay’s payment license after the MSMT raised concerns, the company has reportedly continued to operate, underscoring the deep integration of these illicit operations into global finance.
The Takeaway
This report is a stark reminder that the security threats in the crypto space aren't just rogue actors; they're nation-states with near-limitless resources. For exchanges, the key is bolstering defenses against third-party supply chain attacks. For regulators, it’s clamping down harder on the global network of OTC brokers that serve as the final gateway from crypto crime to real-world spending.
