North Korea uses criminal networks to launder $2.8 billion in stolen crypto

North Korea has stolen at least $2.8 billion in cryptocurrency between January 2024 and September 2025, according to a report by the Royal United Services Institute (RUSI). These funds are believed to finance the regime's weapons program.

Research indicates that Pyongyang is increasingly outsourcing the laundering of these stolen assets to established Asian criminal networks. Instead of managing the entire process, the regime often sells stolen coins at a discount to third parties or uses the same infrastructure employed by organized crime and investment scam syndicates, such as “pig butchering” operations. This strategy blurs the distinction between traditional money laundering and proliferation financing.

The laundering process frequently involves mixing stolen funds with proceeds from other criminal activities, making it difficult for investigators to track. The report notes that cashing out often relies on money mules in countries including China, the Philippines, and Indonesia. Following the February 2025 Bybit hack, which involved approximately $1.5 billion, investigators observed the regime utilizing over-the-counter desks, peer-to-peer traders, and networks tied to entities like Cambodia's Huione Group to convert digital assets into fiat currency.