North Korean authorities have reportedly arrested former state cyber operatives accused of breaking into two government-controlled banks and laundering stolen funds through cryptocurrency. The allegations have not been independently verified.
Daily NK reported that the suspected group targeted the Chosun Central Bank and the Foreign Trade Bank. The first institution manages currency issuance and government funds, while the second processes foreign-currency transactions and international payments.
The publication based its account on an anonymous source in Pyongyang. North Korean authorities have not publicly confirmed the reported breach, arrests, or investigation.
According to the source, the suspects gained access to internal banking networks and payment systems. They allegedly divided the stolen money into numerous small transfers to make the movement of funds less noticeable.
The group then reportedly converted the proceeds into cryptocurrency and transferred the assets through channels connected to brokers in China. Those brokers allegedly exchanged the cryptocurrency for US dollars and Chinese yuan.
Associates operating near the Chinese border reportedly collected the cash. Daily NK named Sinuiju in North Pyongan Province and Hyesan in Ryanggang Province as locations connected to the alleged operation.
The report said the suspects used specialised Chinese wireless equipment and encrypted messaging services to avoid government surveillance. It did not identify the equipment, messaging platforms, cryptocurrencies, wallets, brokers, or transaction values involved.
Daily NK described the alleged organisers as former members of a cyber operations unit within North Korea’s military intelligence apparatus. The publication said they had previously served under the agency formerly known as the Reconnaissance General Bureau.
After leaving military service, the former operatives allegedly recruited technically skilled young people from state universities. They reportedly used those recruits to create a cryptocurrency trading and money-transfer network outside authorised government channels.
The report did not identify any of the detained suspects. It also provided no independently verifiable evidence linking named individuals to the alleged bank intrusions.
Authorities reportedly began investigating after detecting minor discrepancies in financial records and overseas internet protocol addresses accessing bank systems. Investigators then allegedly traced encrypted cryptocurrency communications to a property in central Pyongyang.
The State Intelligence Bureau reportedly raided the location on July 12. Daily NK said the operation resulted in the detention of alleged organisers and IT personnel linked to the military intelligence service.
Computers, disposable mobile phones and other communications equipment were allegedly confiscated during the raid. The publication described the seized computer equipment as highly valuable but provided no inventory or official valuation.
The anonymous source also claimed that those accused could face severe punishment because they allegedly used state-provided cyber training to steal government money. The source further suggested that their families could be punished under North Korea’s system of collective responsibility.
No court proceedings, formal charges or sentences have been publicly documented. The identities, number and current status of the reported detainees remain unknown.
North Korea has previously been accused by foreign governments of conducting state-backed cyber operations against banks, cryptocurrency businesses and digital-asset exchanges abroad. In this case, however, the allegations concern former state-trained personnel accused of turning those capabilities against institutions inside North Korea.
Daily NK’s account remains the primary source for the reported arrests. North Korean state media and government agencies have not issued a public statement confirming that the banks were breached or that the July 12 raid took place.