North Korea Arrests Former State Hackers for Raiding Domestic Banks
In a rare internal crackdown, Pyongyang detains ex-intelligence cyber operators who allegedly turned their skills on the regime's own financial institutions.
North Korean authorities arrested a group of former state-sponsored cyber operators on July 12, 2026, for allegedly hacking two of the country's own banks and laundering the proceeds through cryptocurrency channels, according to reporting from Daily NK cited by multiple crypto news outlets.
The suspects were detained at a safe house in Pyongyang by the National Intelligence Agency. They are discharged veterans from a cyber operations unit under the Reconnaissance and Intelligence General Bureau who reportedly recruited young IT specialists from Kim Chaek University of Technology and Pyongyang University of Science to carry out the operation.
Targets: State Banks Turned Victims
The group allegedly breached the internal networks of the Chosun Central Bank, which oversees currency issuance and state fund management, and the Foreign Trade Bank, which handles foreign payments and currency transactions. The hackers are accused of diverting foreign currency and state trade funds before moving the assets through overseas cryptocurrency wallets.
To convert the stolen crypto into fiat currency, the ring used Chinese brokers operating in border cities including Sinuiju and Hyesan, where digital assets were exchanged for USD and yuan in real time. This laundering infrastructure mirrors methods long employed by North Korean state hacking groups to evade international sanctions.
A Rare Internal Crackdown
The incident marks an unusual case of North Korea's famed cyber warfare apparatus being turned inward. Pyongyang has deployed units like the Lazarus Group for years to steal cryptocurrency and fiat from foreign targets, generating hundreds of millions of dollars to fund the regime and its weapons programs.
This case suggests those same capabilities are now being exploited by individuals within the system for personal gain. The arrests signal a potential tightening of internal financial controls and a warning to elite cyber personnel that even former operators remain under scrutiny.
Sources and Verification
The reporting originates from Daily NK, a South Korea-based outlet that relies on anonymous in-country sources. While major wire services have not independently corroborated the account, more than 10 crypto news publications including CoinDesk, Cointelegraph, and CryptoNews have republished the story with consistent details on the banks, dates, locations, and methods involved.
North Korean state media has not commented on the arrests. Details regarding the amount stolen and specific technical methods remain unverified.