North Korea Laundered $2.8B in Crypto Since 2024, RUSI Report Reveals

North Korea has stolen at least $2.8 billion in cryptocurrency between January 2024 and September 2025, according to a new report by the Royal United Services Institute (RUSI). The findings, cited by Decrypt, highlight the regime’s increasingly sophisticated methods for laundering stolen digital assets, which now involve blending funds with investment scam proceeds and money linked to organized crime.

RUSI Report Details Sophisticated Laundering Tactics

The RUSI report underscores a growing challenge for blockchain analysts and law enforcement: tracing stolen crypto has become significantly harder. In some cases, third parties purchased entire batches of stolen assets at a discount during the cash-out process. Once transferred, these funds were mixed with scam proceeds or sent to addresses associated with criminal groups, further obscuring their origin.

Notably, the report identified specific patterns in how the stolen funds were liquidated. After the Bybit hack in February 2025, launderers with Chinese connections, over-the-counter (OTC) trading firms, and peer-to-peer traders were mobilized to move the funds. RUSI found signs that stablecoins were sold in roughly $7,000 increments, while larger sums were split into $30,000 tranches before being cashed out—a tactic likely designed to avoid triggering anti-money laundering (AML) thresholds.

Why This Matters for the Crypto Industry

This report comes at a time when the cryptocurrency industry is under increased regulatory scrutiny. The scale of North Korean thefts not only poses a national security threat but also undermines the legitimacy of digital assets. It demonstrates how bad actors can exploit decentralized finance (DeFi) protocols and cross-chain bridges, which often have weaker compliance measures.

For exchanges and financial institutions, the report serves as a reminder of the importance of robust transaction monitoring. The specific cash-out patterns identified by RUSI could be used to improve detection algorithms and flag suspicious activity more effectively.

Implications for Global Security and Regulation

The laundering of stolen crypto alongside other illicit funds complicates international efforts to sanction North Korea. The regime has long been accused of using cyberattacks to fund its weapons programs, and this report reinforces the need for coordinated action among governments, intelligence agencies, and the private sector.

Regulators may push for stricter know-your-customer (KYC) requirements on OTC desks and peer-to-peer platforms, which are often used in these schemes. Additionally, the report could accelerate the adoption of blockchain analytics tools that can trace funds across multiple hops and identify mixing patterns.

Conclusion

The RUSI report provides a detailed look at how North Korea has managed to launder billions in stolen cryptocurrency, using a combination of direct sales, mixing services, and fragmentation techniques. As the methods evolve, so too must the responses from both the crypto industry and global regulators. The findings are a clear call to action for enhanced transparency and cooperation to combat this growing threat.

FAQs

Q1: How did North Korea steal the cryptocurrency?
North Korean hackers, often linked to state-sponsored groups like Lazarus, have targeted cryptocurrency exchanges, DeFi protocols, and individual users through phishing, malware, and exploiting vulnerabilities in smart contracts.

Q2: What is the significance of the Bybit hack mentioned in the report?
The Bybit hack, which occurred in February 2025, was one of the largest crypto thefts attributed to North Korea. The RUSI report indicates that the laundering of these funds involved a network of Chinese-rooted launderers, OTC firms, and peer-to-peer traders, illustrating the complexity of tracking stolen assets.

Q3: What can be done to prevent such thefts?
Improving security practices at exchanges and DeFi platforms, implementing stricter AML/KYC procedures, and enhancing international cooperation for tracking and freezing stolen funds are critical steps. Additionally, the use of advanced blockchain analytics can help identify laundering patterns and disrupt these operations.