Pyongyang skyline viewed across the Taedong River in North Korea

North Korea Reportedly Arrests Former Cyber Operators in State Bank Crypto Scheme

By Isaac • July 25, 2026 8:19 pm • Comments

North Korea’s security apparatus reportedly arrested former state-trained cyber operators accused of breaching two state banks and routing diverted funds through cryptocurrency. The alleged reversal puts skills associated with the state’s external cyber theft record at the center of a reported scheme aimed inward.

The account comes from an anonymous source network inside North Korea and has not been publicly confirmed by North Korean state media. Daily NK says it cross-checks reports from protected contacts, whose identities remain hidden because speaking with foreign media can bring imprisonment or execution.

Within that reliability limit, Daily NK reported that North Korea’s National Intelligence Agency rounded up a group on July 12 after an internal investigation. The report described the case as an alleged effort to divert state-controlled foreign currency for personal enrichment.

Trending: The EU Put HTX on Its Russia Sanctions List. One New Power Reaches Far Beyond an Exchange

Daily NK said the alleged targets included discharged veterans of a cyber operations unit under the military intelligence apparatus. It also reported that younger technical recruits from Kim Chaek University of Technology and Pyongyang University of Science were among those accused.

According to the report, the group allegedly penetrated internal networks belonging to the Chosun Central Bank and Foreign Trade Bank. That claim remains anonymously sourced, with no independent public confirmation from either institution or North Korean state media.

Daily NK alleged that participants diverted portions of state trade funds and foreign currency from shell accounts. The transfers were reportedly divided into small increments, but the report provides no verified aggregate amount.

Daily NK characterized the wealth involved as substantial without publishing a confirmed total. Any specific figure for the alleged theft would exceed the available reporting, leaving the scale unresolved.

The reported laundering route began with overseas cryptocurrency wallets. Daily NK said diverted funds moved into those wallets before brokers in China converted coins back into cash.

The report also alleged that contacts near the border exchanged value into U.S. dollars and Chinese yuan. In Daily NK’s account, cryptocurrency served as an intermediate channel between the alleged bank diversions and access to cash or foreign currency.

The anonymous-source limit applies to every step of that route, from the alleged bank access to the overseas wallets, Chinese brokers and border exchanges. North Korean state media has not publicly acknowledged any part of the case.

The account names two sets of alleged intermediaries without assigning them specific transaction totals. Brokers in China reportedly handled coin-to-cash conversions, while border contacts allegedly exchanged value into dollars and yuan.

Investigators reportedly began noticing small discrepancies in foreign-currency approvals, according to Daily NK. The report places those discrepancies within the detection trail alongside suspicious access from overseas internet protocol addresses.

Daily NK said the overseas access drew attention during the internal investigation. Its account then links the banking irregularities and network activity to encrypted cryptocurrency traffic, though those investigative findings remain unconfirmed outside its protected source network.

The report says agents traced the encrypted crypto traffic to a safe house in Pyongyang. That reported step moved the investigation from foreign-currency approvals and digital access records toward a location where agents could conduct a raid.

Daily NK reported that agents entered the location on July 12 and arrested people while they were at computers. Its sources also alleged that agents confiscated costly equipment and unregistered phones during the operation.

The outlet further reported that authorities restricted outside access around facilities belonging to the Chosun Central Bank and Foreign Trade Bank. North Korean state media has not publicly confirmed those restrictions or the reported raid.

As presented by Daily NK, the detection path runs from small approval discrepancies and suspicious overseas IP activity to encrypted crypto traffic and the Pyongyang safe house. Those are the specific investigative steps attributed to the outlet’s anonymous sources.

Daily NK presented access to foreign currency for personal enrichment as the alleged objective. Its account supports no broader conclusion about where the money ultimately went beyond the described wallets, brokers, cash conversions and exchanges into U.S. dollars and Chinese yuan.

The accused group should be treated as the specific network described in the report: discharged military cyber veterans and younger technical recruits. The account does not establish that every person connected to their former unit or universities participated, and it does not prove responsibility by a wider organization.

The detailed nature of the allegations cannot erase the source boundary. Until public confirmation or independently verifiable evidence emerges, the bank breaches, laundering route, arrests and investigative trail remain claims attributed to Daily NK.

The reported reversal remains striking within those boundaries. Former operators allegedly trained for cyber work under military intelligence are accused of applying technical capabilities against domestic state banks instead of external targets.

The younger recruits add another layer to Daily NK’s account by linking the alleged group to two technical universities. Their reported presence remains an allegation from protected sources, not a publicly verified institutional connection.

July 12 anchors both the roundup and raid in the report. Daily NK says an internal investigation preceded the action, while approval discrepancies, overseas IP access and encrypted cryptocurrency traffic formed the reported path to the Pyongyang safe house.

The alleged laundering chain is specific without supplying a verified total: bank-related foreign currency, small transfers, overseas crypto wallets, Chinese cash brokers and border conversion into U.S. dollars and Chinese yuan. Each component remains attributed to Daily NK.

That precision is essential because the report describes substantial wealth but provides no confirmed sum. The current information supports neither an estimated stolen total nor conclusions extending beyond the alleged goal of personal enrichment and access to foreign currency.

With no public confirmation from North Korean state media, the case cannot be presented as settled fact. It remains a detailed anonymous-source report of former state-trained operators allegedly turning inward, followed by reported arrests and restrictions around two state banks.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews