North Korea has integrated into global criminal networks: a new era of crypto-asset laundering
My analysis of the latest data from research circles shows that North Korea has radically changed its approach to laundering stolen digital assets. Instead of creating isolated infrastructure for money laundering, DPRK operators are now actively integrating into existing criminal financial ecosystems. This is not just an evolution of tactics—it is a strategic breakthrough that threatens the effectiveness of global countermeasures.
From January 2024 to September 2025, Pyongyang stole at least $2.8 billion in virtual assets. These funds directly fuel the weapons of mass destruction program, making the issue not merely economic but existential for international security. Critically, the stage of conversion into fiat money remains the least studied link in this chain—that is where the main vulnerabilities lie hidden.
Key elements of the new scheme
The paths of fund movement include OTC services, P2P traders, illegal exchangers, mixers, and cross-chain bridges. After the initial movement of assets, the DPRK transfers them to third-party launderers. For example, the process of "whitening" funds after the $1.5 billion Bybit hack in February 2025 involved a network of OTC and P2P traders, many of whom are Chinese citizens. By September 2025, all stolen funds had been fully cashed out.
Of particular concern is the connection between North Korean money and the crypto scam industry. Investigators have found signs of mixing DPRK funds with proceeds from "pig butchering" scams. A key role is played by so-called guarantee marketplaces—underground platforms operating via Telegram in Chinese. They provide money laundering services, technical tools, and intermediation. Elliptic has recorded cases where cryptocurrency from hacks linked to the DPRK ended up in closed escrow deals on such platforms, including transfers via TRON and addresses associated with Xinbi Guarantee and Huione Guarantee.
Fractioning and final conversion
To bypass AML monitoring, North Korean operators break large sums into small transactions. For example, stablecoins are sold through P2P marketplaces in batches of approximately $7,000, and transactions can be split down to $30,000 so that a potential freeze affects only a small portion of the funds. P2P marketplaces in South Asia and unregulated crypto exchanges in Latin America are used as endpoints.
The main feature of this model is not the existence of some single "secret" channel, but the ability to embed stolen cryptocurrency into an already existing ecosystem of illegal exchangers, P2P networks, and scams. After several stages, the funds become almost indistinguishable from other criminal cryptocurrency, creating enormous challenges for exchanges and regulators.
My comment: This trend is an alarming signal for the entire industry. While regulators focus on on-chain analytics, North Korea has found a way to exploit the human factor and informal financial networks that are virtually immune to traditional monitoring. The industry urgently needs new approaches to identifying ultimate beneficiaries and strengthening the P2P sector, otherwise we risk witnessing further escalation of this problem.