{"id":668299,"date":"2026-10-08T20:00:32","date_gmt":"2026-10-08T20:00:32","guid":{"rendered":"https:\/\/www.crypto-news-flash.com\/?p=1303727"},"modified":"2026-10-08T20:00:32","modified_gmt":"2026-10-08T20:00:32","slug":"how-north-korean-hackers-launder-billions-in-stolen-crypto","status":"publish","type":"post","link":"https:\/\/e-bitco.in\/index.php\/2026\/10\/08\/how-north-korean-hackers-launder-billions-in-stolen-crypto\/","title":{"rendered":"How North Korean Hackers Launder Billions in Stolen Crypto"},"content":{"rendered":"<div class=\"eth-editorial-banner\"> <img decoding=\"async\" class=\"eth-editorial-logo\" src=\"https:\/\/www.crypto-news-flash.com\/wp-content\/uploads\/2025\/11\/cnf2-scaled-1-1-1.png\" alt=\"Crypto News Flash\"> <span class=\"eth-editorial-text\">All news is rigorously fact-checked and reviewed by leading blockchain experts and seasoned industry insiders.<\/span> <\/div>\n<ul>\n<li><strong>North Korea-linked operators use cross-chain swaps, decentralized exchanges and professional intermediaries to move stolen cryptocurrency.<\/strong><\/li>\n<li><strong>THORChain played a documented role in processing assets associated with the 2025 Bybit theft, illustrating how legitimate liquidity infrastructure can be exploited.<\/strong><\/li>\n<li><strong>OTC brokers and informal settlement networks create financial relationships that are not fully visible through blockchain transaction records.<\/strong><\/li>\n<\/ul>\n<p>North Korean hacking groups have turned cryptocurrency theft into a sophisticated financial operation, relying on cross-chain infrastructure, professional money launderers and informal payment networks to move assets beyond the reach of exchanges and law enforcement.<\/p>\n<p>The scale of the problem became particularly visible after the $1.46 billion Bybit theft in February 2025. <strong><a href=\"https:\/\/www.fbi.gov\/investigate\/cyber\/alerts\/2025\/north-korea-responsible-for-1-5-billion-bybit-hack\" target=\"_blank\" rel=\"noopener\">The FBI attributed<\/a><\/strong> the attack to North Korea\u2019s TraderTraitor activity, while subsequent blockchain investigations documented the rapid movement of stolen Ether through thousands of transactions.<\/p>\n<p>More recent <strong><a href=\"https:\/\/wublock.substack.com\/p\/north-korean-hackers-have-stolen?r=jbpop&amp;utm_campaign=post&amp;utm_medium=web\" target=\"_blank\" rel=\"noopener\">reporting by Wu Blockchain<\/a><\/strong> has drawn attention to the intermediaries operating between the initial theft and the eventual use of stolen funds. These networks can exchange assets, supply liquidity and arrange settlement without requiring the original attackers to manage every transaction.<\/p>\n<p>The result is a laundering ecosystem in which the technical compromise of a cryptocurrency platform and the financial processing of stolen assets may be handled by different participants.<\/p>\n<h2>How the Bybit Hack Exposed Cross-Chain Laundering<\/h2>\n<p>The Bybit incident began with a compromise of the exchange\u2019s Ethereum cold-wallet signing process. Attackers manipulated the transaction approval workflow, allowing assets to be transferred to unauthorized addresses.<\/p>\n<p>After the theft, the attackers moved large quantities of Ether through intermediary wallets and cross-chain services.<\/p>\n<p>One of the most closely examined services was THORChain, a decentralized liquidity protocol that enables native cryptocurrency swaps between supported blockchains.<\/p>\n<p>Unlike a centralized exchange, a cross-chain liquidity protocol can facilitate asset conversion without relying on a conventional customer account.<\/p>\n<p>In the Bybit case, blockchain investigators reported substantial flows through THORChain as stolen Ether was converted into Bitcoin and other assets.<\/p>\n<p>The mechanism matters because a conversion from ETH to BTC changes the environment in which investigators must follow the funds.<\/p>\n<p>Ethereum\u2019s account-based transaction model and Bitcoin\u2019s unspent transaction output model record transfers differently. Following a cross-chain swap therefore requires investigators to associate an incoming transaction on one network with an outgoing transaction on another.<\/p>\n<p>That association may be possible using transaction timing, amounts, protocol events and other observable evidence, but it is more complicated than tracing transfers between addresses on the same blockchain.<\/p>\n<p>Cross-chain services are not inherently illicit. They also support legitimate trading and liquidity management. Their relevance to money laundering comes from the ability to exchange assets across networks, particularly when access does not involve conventional identity verification.<\/p>\n<p>The Bybit investigation demonstrated that stolen cryptocurrency can be moved through widely used decentralized infrastructure without compromising that infrastructure itself.<\/p>\n<h2>The Professional Launderers Behind the Transactions<\/h2>\n<p>Blockchain movements reveal where assets travel. They provide a less complete picture of the commercial relationships behind those transfers.<\/p>\n<p><strong><a href=\"https:\/\/www.crypto-news-flash.com\/north-korea-reportedly-arrests-hackers-over-crypto-laundering\/\">North Korea-linked operations<\/a> <\/strong>have been associated with intermediaries that exchange suspicious cryptocurrency for other assets, arrange transfers through OTC channels or facilitate payments through networks outside conventional banking.<\/p>\n<p>Some laundering services operate as brokers rather than simple exchange platforms.<\/p>\n<p>An intermediary may accept cryptocurrency associated with a theft and arrange to provide the client with different assets or value through another settlement channel, retaining a fee or discount.<\/p>\n<p>That arrangement can transfer part of the operational risk from the original thief to a separate financial facilitator.<\/p>\n<p>It also complicates efforts to establish the amount ultimately available to the attackers.<\/p>\n<p>For example, Elliptic reported that approximately $200 million connected to the Bybit theft moved through the eXch cryptocurrency exchange service. The figure describes activity attributed to that service, not a verified cash payment to the attackers.<\/p>\n<p>Investigators therefore distinguish between three measures: the value originally stolen, the volume processed through laundering services and the proceeds ultimately obtained by the perpetrators.<\/p>\n<p>Only the first two can sometimes be estimated directly from publicly observable blockchain activity.<\/p>\n<p>A broader investigation by 38 North has examined the role of financial facilitators and OTC brokers in helping North Korean actors convert cryptocurrency into usable resources.<\/p>\n<p>Those intermediaries are significant because they can connect digital-asset transactions to commercial payments, local-currency liquidity or other financial arrangements that blockchain records alone cannot fully reveal.<\/p>\n<h2>From Stolen Tokens to Usable Value<\/h2>\n<p>The laundering process does not follow a single fixed route. Assets may pass through different services, return to earlier networks or remain in cryptocurrency rather than being converted into fiat.<\/p>\n<p>The following sequence illustrates the principal stages investigators examine. It is a generalized model, not a verified transaction path for every North Korean theft.<\/p>\n<div>\n<div>\n<p>CRYPTO CRIME \/ MONEY FLOW<\/p>\n<p>How Stolen Crypto Moves Through Laundering Networks<\/p>\n<p>A simplified view of the financial infrastructure used to process stolen digital assets.<\/p>\n<\/div>\n<div>\n<div>\n<p>01<\/p>\n<div>\n<p>The Initial Theft<\/p>\n<p>Attackers compromise an exchange or wallet and transfer cryptocurrency to addresses under their control.<\/p>\n<p>ENTRY POINT<\/p>\n<\/div>\n<\/div>\n<p>\u2193<\/p>\n<div>\n<p>02<\/p>\n<div>\n<p>Swaps and Chain-Hopping<\/p>\n<p>Assets move between wallets, liquidity protocols and blockchains, changing their form and complicating transaction tracing.<\/p>\n<p>ONCHAIN MOVEMENT<\/p>\n<\/div>\n<\/div>\n<p>\u2193<\/p>\n<div>\n<p>03<\/p>\n<div>\n<p>Professional Intermediaries<\/p>\n<p>OTC brokers and financial facilitators exchange assets or arrange settlement through separate financial channels.<\/p>\n<p>LIQUIDITY &amp; SETTLEMENT<\/p>\n<\/div>\n<\/div>\n<p>\u2193<\/p>\n<div>\n<p>04<\/p>\n<div>\n<p>Usable Financial Value<\/p>\n<p>Proceeds may emerge as fiat currency, commercial payments or cryptocurrency retained for later use.<\/p>\n<p>FINAL ECONOMIC USE<\/p>\n<\/div>\n<\/div>\n<\/div>\n<p><strong>Methodology:<\/strong> Illustrative sequence based on laundering patterns documented in investigations by the FBI, Elliptic and 38 North. Individual cases may involve different routes, additional intermediaries or repeated stages.<\/p>\n<\/div>\n<h2>Where Investigators Can Interrupt the Flow<\/h2>\n<p>The earliest stages of laundering offer opportunities for exchanges and blockchain analytics firms to identify suspicious movements before assets reach intermediaries.<\/p>\n<p>The FBI\u2019s February 2025 advisory on the Bybit theft provided addresses associated with TraderTraitor and urged exchanges, bridges, decentralized finance services and other virtual-asset providers to block transactions involving identified stolen funds.<\/p>\n<p>For compliance teams, that requires more than screening a recipient address against a static sanctions list.<\/p>\n<p>Transaction monitoring should incorporate exposure to known thefts across multiple blockchains. A newly created wallet may have no direct sanctions designation but could receive assets shortly after they pass through a cross-chain swap associated with a confirmed exploit.<\/p>\n<p>Such connections require careful interpretation. Indirect exposure alone does not establish that the recipient knowingly participated in money laundering.<\/p>\n<p>Liquidity providers and exchanges can also monitor unusual transaction patterns, including rapid conversions, fragmented transfers and activity involving addresses recently associated with a security incident.<\/p>\n<p>When suspicious assets reach a centralized platform, investigators may have an opportunity to preserve records, identify account holders and request restrictions through appropriate legal procedures.<\/p>\n<p>The Bybit response provides a documented example. According to the exchange\u2019s incident timeline, industry participants helped freeze approximately $42.89 million in exploited funds by February 23, 2025.<\/p>\n<p>For stablecoins with issuer-controlled freezing functionality, timely coordination with issuers may provide another intervention point. Native Bitcoin and Ether do not offer an equivalent centralized freezing mechanism.<\/p>\n<p>The final stage requires a different investigative approach.<\/p>\n<p>OTC brokers and informal financial facilitators may connect cryptocurrency transfers to bank accounts, cash movements or trade settlements. Detecting those relationships can require suspicious activity reports, financial intelligence, customer records and cooperation across jurisdictions.<\/p>\n<p>Research published by 38 North in March 2026 identified examples involving facilitators operating across several countries and argued that authorities should devote greater attention to cash-out networks, not only the hackers responsible for the initial theft.<\/p>\n<h2>Why Cash-Out Networks Matter More Than Another Wallet Address<\/h2>\n<p>North Korea\u2019s cryptocurrency operations expose a limitation of blockchain transparency: public transaction records can document the movement of assets without identifying every financial relationship behind them.<\/p>\n<p>The distinction becomes especially consequential when professional intermediaries purchase stolen cryptocurrency at a discount or arrange settlement through separate payment networks.<\/p>\n<p>Investigators may know which service received the assets while lacking evidence of the final payment or its recipient.<\/p>\n<p>In some cases, conversion into conventional currency may not be necessary. Research on North Korean sanctions evasion has documented efforts to use cryptocurrency directly in commercial transactions, potentially reducing dependence on conventional cash-out channels.<\/p>\n<p>This shifts part of the investigative focus from cryptocurrency exchanges to the wider financial and commercial networks through which illicit proceeds acquire economic value.<\/p>\n<p>The latest Bitget case remains relevant to that work. Wu Blockchain reported that the exchange revised the assets involved in its September incident to approximately $387.5 million, while North Korean attribution had not been conclusively established in a published technical investigation.<\/p>\n<p>Until additional evidence becomes available, conclusions about the precise perpetrators and their eventual proceeds should remain qualified.<\/p>\n<p>The Bybit case provides stronger attribution, supported by the FBI, and a more developed public record of subsequent laundering activity.<\/p>\n<p>Together, the investigations illustrate why stopping cryptocurrency theft proceeds requires two distinct capabilities: following assets across networks and identifying the people or institutions willing to convert those assets into usable value.<\/p>\n<p>The first is increasingly supported by blockchain analytics. The second depends on financial intelligence, enforceable compliance controls and international cooperation.<\/p>\n<p> <a href=\"https:\/\/www.crypto-news-flash.com\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>All news is rigorously fact-checked and reviewed by leading blockchain experts and seasoned industry insiders. North Korea-linked operators use cross-chain swaps, decentralized exchanges and professional intermediaries to move stolen cryptocurrency. THORChain played a documented role in processing assets associated with the 2025 Bybit theft, illustrating how legitimate liquidity infrastructure can be exploited. OTC brokers and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":668300,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[25],"class_list":{"0":"post-668299","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-other","8":"tag-news"},"_links":{"self":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts\/668299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/comments?post=668299"}],"version-history":[{"count":0,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/posts\/668299\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/media\/668300"}],"wp:attachment":[{"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/media?parent=668299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/categories?post=668299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e-bitco.in\/index.php\/wp-json\/wp\/v2\/tags?post=668299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}