{"id":96664,"date":"2026-07-23T21:38:06","date_gmt":"2026-07-23T21:38:06","guid":{"rendered":"https:\/\/www.europesays.com\/korea\/96664\/"},"modified":"2026-07-23T21:38:06","modified_gmt":"2026-07-23T21:38:06","slug":"north-korea-busts-elite-bank-hacking-ring","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/korea\/96664\/","title":{"rendered":"North Korea busts elite bank hacking ring"},"content":{"rendered":"

\"cryptocurrency,<\/a><\/p>\n

A criminal ring hacked into the internal networks of North Korea\u2019s central bank and its main foreign trade bank. The ring used cryptocurrency to launder stolen funds <\/a>and smuggle foreign currency across the border. Word that state-trained, elite information technology personnel were involved has shaken officials in the capital.<\/p>\n

A source in Pyongyang told Daily NK on Thursday that hackers breached the internal networks of the Chosun Central Bank and the Foreign Trade Bank. The Chosun Central Bank oversees North Korea\u2019s currency issuance and state fund management. The Foreign Trade Bank handles the country\u2019s foreign payments and currency transactions. The ring converted stolen state trade funds into cryptocurrency<\/a> and smuggled large amounts of foreign currency in border regions, the source said. North Korea\u2019s National Intelligence Agency, formerly the Ministry of State Security, rounded up the group on July 12.<\/p>\n

The breach struck at the core of North Korea\u2019s financial system. It came from within, carried out by the country\u2019s own IT workforce.<\/p>\n

Veterans turned hackers built a hidden network<\/p>\n

According to the source, the ringleaders were discharged veterans from a cyber operations unit under North Korea\u2019s Reconnaissance and Intelligence General Bureau<\/a>, the successor to the Reconnaissance General Bureau, the country\u2019s military intelligence agency long known for technology-driven espionage and hacking operations. After leaving the military, the veterans recruited young IT prodigies <\/a>from Kim Chaek University of Technology and Pyongyang University of Science. The group quietly built a cryptocurrency trading network designed to bypass state surveillance. Their goal, the source said, was to earn foreign currency and enrich themselves personally.<\/p>\n

To avoid detection, the group used Chinese-made specialized wireless equipment <\/a>and encrypted messaging apps. They drew on hacking skills sharpened in the military and at university. Using those skills, they broke into the well-guarded internal networks and foreign payment systems of both banks.<\/p>\n

Once inside, the hackers split off portions of state trade funds and foreign currency held in shell accounts. They broke the amounts into tiny increments to avoid detection and then moved the funds into overseas cryptocurrency wallets. Brokers in China converted the coins back into cash.<\/p>\n

Contacts in border areas exchanged the laundered coins for U.S. dollars and Chinese yuan in real time. That network included operatives<\/a> in Sinuiju, North Pyongan province, and Hyesan, Ryanggang province.<\/p>\n

The group accumulated substantial wealth while evading state controls, the source said, but the operation did not last. Officials in Pyongyang began noticing small discrepancies in foreign currency payment approvals. They also flagged suspicious overseas IP access records. The National Intelligence Agency launched a covert internal investigation<\/a> soon after.<\/p>\n

Investigators traced encrypted cryptocurrency transaction traffic to a safe house in Pyongyang. Agents raided the house on the night of July 12. They arrested the ringleaders and IT personnel on the spot, catching them laundering funds at their computers. Authorities also confiscated computer equipment worth hundreds of thousands of dollars. They seized unregistered \u201cburner\u201d phones the group had used to evade monitoring<\/a>.<\/p>\n

Armed National Intelligence Agency personnel then took up positions around the Foreign Trade Bank\u2019s headquarters and the Chosun Central Bank\u2019s computing center. Outside access was cut off entirely. Mobile signal-detection vehicles fanned out across Pyongyang to track the group\u2019s irregular wireless frequencies. The capital saw a tense atmosphere for a time.<\/p>\n

Concern over fallout<\/p>\n

News of the case has since spread among Pyongyang\u2019s elite, military circles and university communities. It reportedly caused shock at the scale and audacity of the scheme. Officials in Pyongyang expect harsh punishment for <\/a>those involved. \u201cThey used the skills the state trained them with to defend the country, and instead robbed the country\u2019s coffers,\u201d one official said, according to the source. \u201cThis goes beyond ordinary guilt-by-association penalties. It will be hard for the entire family line to survive.\u201d<\/p>\n

Senior officials in the Reconnaissance and Intelligence General Bureau and in the country\u2019s science and technology education sector are reportedly staying cautious. They worry that responsibility for the scandal could spread to them as well.<\/p>\n

Read in Korean<\/a><\/p>\n

Reporting from inside North Korea<\/p>\n

\n Daily NK operates networks of sources inside North Korea who document events in real-time and transmit information through secure channels. Unlike reporting based on state media, satellite imagery, or defector accounts from years past, our journalism comes directly from people currently living under the regime. We verify reports through multiple independent sources and cross-reference details before publication.\n <\/p>\n

\n Our sources remain anonymous because contact with foreign media is treated as a capital offense in North Korea \u2014 discovery means imprisonment or execution. This network-based approach allows Daily NK to report on developments other outlets cannot access: market trends, policy implementation, public sentiment, and daily realities that never appear in official narratives.\n <\/p>\n

\n Maintaining these secure communication channels and protecting source identities requires specialized protocols and constant vigilance. Daily NK serves as a bridge between North Koreans and the outside world, documenting what\u2019s happening inside one of the world\u2019s most closed societies.\n <\/p>\n","protected":false},"excerpt":{"rendered":"A criminal ring hacked into the internal networks of North Korea\u2019s central bank and its main foreign trade…\n","protected":false},"author":2,"featured_media":96665,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[174,533,2595,1105,31,38078,129],"class_list":["post-96664","post","type-post","status-publish","format-standard","has-post-thumbnail","category-korea","tag-corruption","tag-cryptocurrency","tag-foreign-currency","tag-hacking","tag-korea","tag-national-intelligence-agency","tag-pyongyang"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/96664","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/comments?post=96664"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/96664\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media\/96665"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media?parent=96664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/categories?post=96664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/tags?post=96664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}