Imagine stealing $1.5 billion in Ethereum and then trying to buy a tank with it. You can’t just walk into a bank with a USB drive full of ETH and ask for cash. The world watches blockchain transactions like hawks, and international sanctions make moving money from Pyongyang nearly impossible. So how does North Korea actually turn billions in stolen digital assets into usable hard currency? It’s not magic-it’s a gritty, high-speed game of financial cat-and-mouse that has evolved far beyond simple mixing services.
The Four-Stage Laundering Pipeline
Early on, North Korean hackers were sloppy. They’d steal Bitcoin and try to withdraw it directly from major exchanges. That didn’t last long. Once exchanges started tightening KYC (Know Your Customer) rules, the regime had to get creative. According to a May 2025 report by the Financial Crimes Enforcement Network (FinCEN), their methodology has shifted to a complex, multi-stage laundering process designed to break the trail before regulators even notice the money is gone.
This process generally follows four distinct technical phases:
- Initial Theft: Most attacks (68% according to FBI data) start with phishing or infrastructure compromise. Think compromised validator keys or supply chain attacks, like the Atomic Wallet hack in June 2023 where $100 million was drained from 4,100 addresses.
- Cross-Chain Movement: This is the critical step. Assets don’t stay on one blockchain. In the massive Bybit exchange hack of February 2025, hackers routed stolen Ethereum through Binance Smart Chain and Solana networks. By using cross-chain bridges like Ren Bridge or Avalanche Bridge, they obscure the origin. A February 2025 CSIS analysis found that 73% of stolen assets now pass through at least three different blockchain networks.
- Conversion to Bitcoin: Despite the rise of altcoins, Bitcoin remains the king of liquidity. About 82% of final conversion targets are Bitcoin because it’s easier to sell in bulk without crashing the local price. In the Bybit case, 87% of assets were converted to BTC within 72 hours.
- Fiat Conversion: Finally, the clean-ish Bitcoin is moved to third-party networks with minimal KYC requirements, often in jurisdictions like Cambodia or China, to be swapped for physical cash.
Why Mixing Services Are Dead
You might remember Tornado Cash, the privacy protocol that was popular for hiding transaction trails. For years, it processed over $1.2 billion in stolen funds between 2019 and 2022. But when the U.S. Treasury sanctioned Tornado Cash in September 2022, it effectively killed the go-to tool for North Korean launderers. Suddenly, using a known mixer was a red flag.
So, what replaced it? Speed and volume. Nick Carlsen, a former FBI subject matter expert and current analyst at TRM Labs, calls it the "flood the zone" technique. Instead of relying on one smart contract to hide the money, North Korean operatives execute 400-500 high-frequency transactions daily across multiple platforms. The goal isn’t necessarily perfect anonymity anymore; it’s overwhelming blockchain analysts with so much noise that the specific path of the stolen funds gets lost in the shuffle. This shift has increased their adaptation speed by 65%, creating a widening gap in effective interdiction efforts.
The Human Element: IT Workers as Mules
Technology alone doesn’t move money into a bank account. You need humans. And North Korea has thousands of them deployed abroad. The UN Panel of Experts estimated in December 2024 that these overseas IT workers generate about $600 million annually for the regime. These aren’t just coders fixing bugs; they are integral to the cash-out strategy.
These workers operate primarily in China, Russia, and Southeast Asia. They use falsified identities-often Indian or Vietnamese passports-to secure remote jobs with Western tech firms or crypto exchanges. Their job? To create backdoors. When they work as freelancers, they set up fake profiles to accept cryptocurrency payments for contracts. Then, they convert those digital assets to fiat through local exchange networks that have lax oversight.
A CSIS investigation documented 27 cases in 2024 where North Korean IT workers at Chinese exchanges enabled direct wallet-to-bank transfers with only 12-hour notification periods, bypassing the standard 72-hour fraud detection windows. They use virtual private networks (VPNs) and remote monitoring software to appear as if they are working from New York or London, while physically sitting in Beijing or Shenyang. This human layer adds a level of plausibility that pure algorithmic laundering cannot match.
Geographic Hubs: Where the Cash Actually Appears
If you’re tracking the money, you’ll find it ending up in specific geographic hubs. While the blockchain is global, the fiat conversion is local. Two regions dominate this landscape: Cambodia and China.
| Region | Primary Mechanism | Key Entities/Notes | Regulatory Status |
|---|---|---|---|
| Cambodia | Huione Group subsidiaries | Huione Guarantee, Huione Crypto; 14 "crypto cafes" in Sihanoukville | Designated primary money laundering concern by FinCEN (May 2025) |
| China | Bank accounts & OTC desks | 37 accounts linked to network processing $250M; IT worker hubs | Increased scrutiny but still viable via intermediaries |
| Southeast Asia (Macau) | Gambling/Casinos | Accept crypto deposits with low verification rates | High risk, used for smaller scale conversions |
Cambodia has emerged as the primary fiat conversion center. The reason? Loosely regulated financial sectors and entities like the Huione Group. In May 2025, FinCEN designated Huione as a primary money laundering concern, documenting $37.6 million in North Korean-linked crypto processed through them between 2021 and 2025. Huione’s subsidiaries issue non-freezable stablecoins, allowing illicit assets to be converted into ostensibly legitimate value. There are also 14 North Korean-controlled "crypto cafes" operating in Sihanoukville, each processing $500,000 to $2 million monthly in cash transactions with zero identification required.
China remains a secondary hub despite heavy surveillance. A Department of Justice indictment in February 2024 revealed a network processing $250 million through 37 Chinese bank accounts with minimal documentation. The proximity to North Korea and the sheer size of the Chinese market make it indispensable, even if it’s harder to navigate than Cambodia.
The Bottleneck: Final Fiat Conversion
Here’s the catch: getting crypto out of the blockchain is easy. Getting it into a bank account without raising alarms is hard. Only 3-5% of global cryptocurrency exchanges maintain sufficiently lax KYC procedures to facilitate large-scale withdrawals without triggering alerts. This bottleneck forces North Korea to rely heavily on Over-The-Counter (OTC) desks and peer-to-peer networks.
In the Atomic Wallet hack aftermath, hackers funneled funds through 17 different OTC desks, keeping average transaction sizes below $10,000 to avoid reporting thresholds. This micro-management of transaction size is crucial. If you send $1 million in one go, you get flagged. If you send 100 transactions of $10,000 spread over a week, you look like a regular trader.
However, the walls are closing in. The Office of Foreign Assets Control (OFAC) reported a 22% decrease in successful North Korean cash-outs in Q1 2025 compared to Q4 2024. This drop is attributed to the Crypto-Asset Reporting Framework, which requires exchanges to share beneficiary information across more than 100 jurisdictions. As transparency increases, the window for easy conversion shrinks.
What’s Next? Stablecoin Arbitrage
North Korea isn’t standing still. They are actively developing next-generation mechanisms to bypass these new restrictions. A March 2025 CSIS investigation revealed that the regime is testing "stablecoin arbitrage laundering." Here’s how it works: stolen assets are converted to non-sanctionable stablecoins like USDC through decentralized exchanges (DEXs). Then, they exploit price discrepancies between regional exchanges to generate clean fiat with minimal transaction trails.
The FBI’s April 2025 Cyber Threat Advisory warned that North Korea has recruited 37 blockchain developers from defunct crypto projects to build custom cross-chain protocols. These protocols could process transactions worth $500 million or more while maintaining plausible deniability. Dr. Kim Heung Kwang, a former computer science professor who defected from North Korea, notes that the regime treats each hack as a strategic resource extraction mission. They will continue adapting until cryptocurrency itself becomes fully regulated or obsolete.
Treasury Secretary Janet Yellen stated in May 2025 that the success rate for these operations is projected to decline to 40% by 2027 due to coordinated international regulatory action. But given their track record of evolving faster than regulations can catch up, betting against them is risky business.
How much cryptocurrency has North Korea stolen?
According to TRM Labs, North Korean state-sponsored hacking groups have stolen over $3 billion in cryptocurrency between 2017 and 2023. Recent activity includes the $1.5 billion Bybit exchange hack in February 2025, which is the largest single cryptocurrency theft in history.
Why do North Korean hackers prefer Bitcoin for conversion?
Bitcoin is preferred due to its high liquidity and widespread acceptance. Approximately 82% of stolen assets are converted to Bitcoin before being turned into fiat currency because it is easier to sell in large volumes without significantly impacting the market price compared to other cryptocurrencies.
What role do North Korean IT workers play in crypto laundering?
IT workers deployed abroad assume false identities to gain employment with crypto exchanges and fintech firms. They create backdoors for fund movement, establish clean withdrawal channels, and facilitate direct wallet-to-bank transfers, often bypassing standard fraud detection windows.
Which countries are key hubs for converting stolen crypto to fiat?
Cambodia is the primary hub, largely due to entities like the Huione Group and loosely regulated financial sectors. China serves as a secondary hub, utilizing bank accounts and OTC desks. Macau-based casinos also serve as minor conversion vectors due to lower verification standards.
Has the sanctioning of Tornado Cash affected North Korea's operations?
Yes, significantly. The September 2022 sanctions eliminated North Korea's primary mixing service, forcing a shift toward speed-based laundering. Now, 78% of stolen assets are converted within 72 hours, compared to 120 hours in 2021, to avoid detection without traditional mixers.
