Hackers Don’t Launder It Themselves: Inside the Shadow Network That Gets North Korea Paid

A new investigation has shed light on the intricate networks that facilitate the laundering of funds for North Korean hackers. These specialized laundering networks play a crucial role in converting stolen cryptocurrency into usable assets, thus supporting the regime's economy amidst ongoing international sanctions.

According to the report, North Korean hackers do not handle the laundering of stolen assets themselves. Instead, they rely on intermediaries who take on the financial risk and process the stolen funds. This arrangement complicates efforts to trace and recover the stolen assets, as the intermediaries often provide replacement funds from other illicit activities, further obscuring the money trail.

The report highlights significant incidents, such as the February 2025 Bybit theft, which resulted in approximately $1.5 billion being stolen. Investigators found that over $1 billion from this theft was laundered through various channels, demonstrating the scale and sophistication of these laundering operations.

Chainalysis, a blockchain analysis firm, pointed out that North Korea-linked actors have moved tens of millions of dollars through these networks, which include vendors known for accepting traceable stolen assets. The complexity of these operations makes it challenging for authorities to track the flow of stolen cryptocurrency and recover funds for victims.

As the situation evolves, disrupting North Korea's cybercrime funding will require a concerted effort to identify and dismantle these laundering networks, which are essential for the regime's financial survival.