TL;DR
- Criminal Overlap: North Korea mixes stolen crypto with scam and crime proceeds, complicating crypto laundering detection.
- Cash‑Out Tactics: Mules, small conversions, and fragmented transfers help the regime avoid scrutiny during crypto laundering operations.
- Regulatory Gaps: RUSI urges stronger guidance as exchanges recover only a fraction of stolen funds amid persistent crypto laundering networks.
North Korea is increasingly routing stolen cryptocurrency through criminal ecosystems that also serve scam syndicates, making it harder for investigators to trace the funds once they leave the blockchain. A new paper from the Royal United Services Institute says the regime has pushed at least $2.8 billion in stolen virtual assets between January 2024 and September 2025, with researchers focusing on the moment those assets convert into cash. Their findings show how the regime’s reliance on overlapping crime networks complicates efforts to identify proliferation finance, especially as crypto laundering operations blend with ordinary illicit flows.
Criminal ecosystems blur investigative trails
The paper highlights how ownership of stolen coins often changes hands before conversion, sometimes through discounted bulk purchases. Investigators told the authors that these handovers can be inferred when stolen funds appear mixed with proceeds from pig butchering scams or at addresses tied to entities like Cambodia’s Huione Group, whose infrastructure was seized by the Justice Department in June.
Elliptic data suggests these transfers frequently occur on the Bitcoin blockchain, reinforcing how crypto laundering intersects with broader criminal activity. After the February 2025 Bybit hack, ZeroShadow responders observed the regime leaning on launderers, over‑the‑counter desks and peer‑to‑peer traders, many of them Chinese nationals working nonstop.
TraderTraitor, the group behind the theft, relied on Chinese organised crime groups to move funds and return cash, deepening the overlap between state‑linked theft and commercial criminal networks. Once inside these ecosystems, the markers of proliferation finance become difficult to distinguish from standard crypto laundering patterns.
Small conversions, mule accounts and fragmented cash‑outs
The accounts used to cash out typically belong to mules in the Philippines, Indonesia and China, where credentials are cheap enough to buy in bulk. Interviewees said many mules avoid learning who they are actually working for. Conversion usually happens in small slices, with actors selling about $7,000 in stablecoins at a time on peer‑to‑peer marketplaces to stay below bank review thresholds.
ZeroShadow also found larger sums broken into $30,000 pieces so any freeze would not be overly damaging. Exchange behaviour offers clues, from Astrill VPN logins to launderers filing 50 to 70 support tickets to release a single held transaction, a hallmark of intensive crypto laundering cycles.
Fiat delivery and regulatory gaps
Fiat rarely arrives through simple transfers. Over‑the‑counter brokers often deposit proceeds into North Korean‑controlled accounts using UnionPay cards issued by Chinese banks. The paper lists 19 Chinese banks identified last year as used by the regime and its proxies. Of the roughly $1.5 billion taken from Bybit, 95% moved through decentralised services, and all of it had been converted into fiat or hard currency by September 2025.
The authors call for clearer regulatory guidance on correspondent relationships, standardised onboarding questionnaires, secure intelligence‑sharing channels and a VASP identifier in payment messages. Bybit’s own update shows the scale of the challenge: the exchange has recovered $48.4 million and frozen $30.5 million more, only about 5% of what was stolen, underscoring how entrenched crypto laundering networks remain.
