Inside North Korea’s Secret Crypto Heist: How $2.83 Billion Vanished Since 2024

Who knew North Korean hackers were moonlighting as crypto Robin Hoods—except instead of giving to the poor, they’re hijacking billions in stolen digital loot? Between January 2024 and September 2025, they’ve snagged a staggering $2.83 billion in cryptocurrency, a haul amounting to nearly a third of the country’s foreign currency intake last year. What’s even more bewildering is the intricate web of Chinese, Russian, and Cambodian intermediaries laundering this virtual treasure through a complex nine-step dance involving decentralized exchanges, mixers, and shady OTC brokers. And the sneakiest part? These cyber pirates rarely attack exchanges directly; instead, they exploit third-party providers, turning legitimate platforms into conduits for their digital heists. If you thought laundering cash was complicated, wait ’til you see how cryptocurrency’s shady underbelly operates across continents and jurisdictions! Curious about the full chronicle of this globe-spanning crypto cloak-and-dagger saga? LEARN MORE.

Chinese, Russian, and Cambodian intermediaries reportedly played key roles in moving and cashing the stolen funds.

A new report by the Multilateral Sanctions Monitoring Team (MSMT) shows that North Korean hackers stole $2.83 billion in cryptocurrency between January 2024 and September 2025.

This figure accounts for nearly one-third of the country’s total foreign currency income in 2024.

Bybit Exploit Was the Largest Contributor

The MSMT, a coalition of 11 countries formed in October 2024, was created to track how North Korea evades international sanctions through cybercrime. Its latest findings reveal that the scale of crypto theft rose in 2025, with hackers stealing $1.64 billion in the first nine months alone, marking a 50% increase from the $1.19 billion stolen last year.

Most of this year’s total came from a February attack on Bybit, which was linked to the TraderTraitor group, also known as Jade Sleet or UNC4899. The hackers targeted SafeWallet, a multi-signature wallet provider for Bybit, using phishing emails and malware to gain access to internal systems. They then disguised external transfers to appear as internal ones, allowing them to take control of the cold wallet’s smart contract and move the funds undetected.

According to the MSMT, North Korean hackers often avoid attacking exchanges directly, instead targeting third-party service providers. Groups such as TraderTraitor, CryptoCore, and Citrine Sleet have used fake developer profiles, stolen identities, and detailed knowledge of software supply chains to carry out their attacks. In one notable case, the Web3 project Munchables lost $63 million in a hack, although the funds were later returned after they reportedly faced problems during laundering.

How the Laundering Works

The analysis reveals a nine-step process used to clean and convert stolen crypto into cash. Hackers begin by swapping stolen assets for Ethereum (ETH) on decentralized exchanges, then use mixing services such as Tornado Cash and Wasabi Wallet to hide transaction trails. The ETH is then converted to Bitcoin (BTC) through bridge platforms, mixed again, stored in cold wallets, and then traded for Tron (TRX) before being converted to USDT. The final step involves sending USDT to over-the-counter brokers who exchange it for cash.

Brokers and companies in China, Russia, and Cambodia were identified as key players in this process. In China, nationals Ye Dinrong and Tan Yongzhi of Shenzhen Chain Element Network Technology, along with trader Wang Yicong, helped move funds and create fake IDs. Russian intermediaries converted about $60 million from the Bybit hack through OTC brokers, while Cambodia’s Huione Pay was used to transfer stolen funds despite its license not being renewed by the central bank.