How North Korea Cashes Out Stolen Cryptocurrency to Fiat

You might think stealing a billion dollars in digital assets is the hard part. It’s not. The real challenge for North Korea is turning those invisible, traceable tokens into cold, hard cash that can buy oil, weapons, and luxury goods without raising alarms. Between 2017 and 2023, state-sponsored hackers linked to the regime swiped over $3 billion in cryptocurrency. In February 2025 alone, they pulled off the largest theft in history at the Bybit exchange, grabbing $1.5 billion. But here’s the kicker: having stolen funds means nothing if you can’t spend them. This article breaks down exactly how the Kim regime converts illicit digital wealth into usable fiat currency, bypassing some of the strictest financial sanctions on Earth.

The Four-Stage Laundering Pipeline

North Korea doesn’t just hit "sell" on an exchange. They run a sophisticated, multi-stage operation designed to break the chain of evidence. According to TRM Labs, this process has evolved from simple withdrawals to complex cross-chain maneuvers. Think of it as a relay race where each runner changes the baton so no one knows who started with it.

• Phase 1: The Heist and Immediate Movement. Once funds are stolen via phishing or infrastructure compromise (which accounts for 68% of attacks), hackers move assets immediately. In the Bybit case, they routed Ethereum through Binance Smart Chain and Solana within hours.
• Phase 2: Cross-Chain Obfuscation. Assets hop across different blockchains using bridges like Ren Bridge or Avalanche Bridge. A 2025 CSIS analysis showed 73% of stolen assets pass through at least three networks before final conversion.
• Phase 3: Bitcoin Conversion. Most stolen altcoins are swapped for Bitcoin. Why? Because BTC has massive liquidity and is the preferred intermediary for moving value globally. About 82% of final conversions target Bitcoin.
• Phase 4: Fiat Extraction. The final step involves converting Bitcoin into local currencies (like USD, RMB, or KHR) through third-party networks with minimal Know Your Customer (KYC) checks.

This pipeline isn't static. Nick Carlsen, a former FBI expert now at TRM Labs, describes a "flood the zone" technique. Instead of making a few large transfers, North Korean actors execute 400-500 high-frequency transactions daily across multiple platforms. This noise overwhelms blockchain analysts trying to track specific wallets, making it nearly impossible to isolate the stolen funds from legitimate traffic.

Geographic Hubs: Where Crypto Becomes Cash

If the blockchain is the highway, certain countries are the exit ramps where digital money turns into physical bills. Cambodia has emerged as the primary hub for this conversion, largely due to its loosely regulated financial sector. The U.S. Treasury Department identified the Huione Group as a critical player here. FinCEN designated Huione as a major money laundering concern, documenting $37.6 million in North Korean-linked crypto processed through their entities between 2021 and 2025.

Huione operates subsidiaries like Huione Guarantee and Huione Crypto. These aren't just random businesses; they provide the infrastructure for scams and issue non-freezable stablecoins. Essentially, they act as a bridge between the illicit digital world and the Cambodian banking system. While China remains a secondary hub, increased scrutiny there has pushed more activity toward Southeast Asia. Macau-based casinos also play a role, accepting cryptocurrency deposits with only 5% verification rates compared to the 95% standard in regulated markets. This allows launderers to walk out with chips that can be cashed out as winnings.

The Human Element: IT Workers Abroad

Technology alone doesn’t cash out money. People do. North Korea deploys thousands of IT workers abroad, primarily in China, Russia, and Southeast Asia, generating an estimated $600 million annually according to the UN Panel of Experts. These aren't your average remote developers. They assume false identities-often using falsified Indian or Vietnamese passports-to work for legitimate cryptocurrency exchanges and fintech firms.

Once inside these companies, they have privileged access to internal systems. The Center for Strategic and International Studies (CSIS) documented 27 cases in 2024 where these workers enabled direct wallet-to-bank transfers with only 12-hour notification periods, bypassing the standard 72-hour fraud detection windows. They use virtual private networks (VPNs) and remote monitoring software to appear as if they are working from the United States or Europe. Their job is to create "clean" withdrawal channels. When they receive payment in crypto for freelance coding gigs, they convert it locally through exchange networks that don't ask too many questions about the ultimate beneficiary.

Evolving Tactics: From Mixers to Speed

In the early days, North Korea relied heavily on mixing services like Tornado Cash. However, when the U.S. sanctioned Tornado Cash in September 2022, it cut off a channel that had processed $1.2 billion in stolen funds. The regime adapted quickly. Now, speed is the new obfuscation. TRM Labs reports that 78% of stolen assets are converted within 72 hours, down from 120 hours in 2021.

They’ve also shifted toward automated transaction patterns and decentralized finance (DeFi) protocols. A March 2025 investigation revealed testing of "stablecoin arbitrage laundering." Here, stolen assets are converted to USDC through decentralized exchanges, then exploited through price discrepancies between regional exchanges to generate clean fiat. The Atomic Wallet hack in June 2023 demonstrated this precision: after stealing $100 million, hackers executed 1,842 cross-chain transactions in 48 hours, funneling funds through 17 different Over-The-Counter (OTC) desks while keeping average transaction sizes below $10,000 to avoid reporting thresholds.

Challenges and Future Outlook

Despite their ingenuity, North Korea faces growing headwinds. The implementation of the Crypto-Asset Reporting Framework requires exchanges to share beneficiary information across more than 100 jurisdictions. The Office of Foreign Assets Control (OFAC) reported a 22% decrease in successful cash-outs in Q1 2025 compared to the previous quarter. Only 3-5% of global exchanges still maintain lax enough KYC procedures to handle large-scale withdrawals without triggering alerts.

However, the regime isn't standing still. The FBI warns that North Korea has recruited 37 blockchain developers from defunct projects to build custom cross-chain protocols capable of processing $500 million+ transactions with plausible deniability. Treasury Secretary Janet Yellen recently noted that the window for these operations is closing, projecting success rates to drop to 40% by 2027. Yet, experts like Dr. Kim Heung Kwang, a former professor who defected from North Korea, argue the regime will continue adapting until cryptocurrency itself becomes fully regulated or obsolete. For now, the flow of stolen digital gold continues, fueled by military-grade hacking teams and a network of complicit intermediaries.