How North Korean Hackers Launder Stolen Cryptocurrency Through Global Networks
North Korean hackers are increasingly relying on professional money-laundering networks to move stolen cryptocurrency and convert it into usable funds, according to information reported by Wu Blockchain. These intermediaries can take control of stolen assets early in the process, pay the hackers after deducting fees, and assume responsibility for the risks involved in transferring and cashing out the funds.
The process separates the theft of digital assets from the subsequent movement of the proceeds. Rather than handling every stage themselves, attackers can rely on specialist networks to manage transactions across different services and routes. The arrangement allows intermediaries to handle the operational risks associated with moving stolen cryptocurrency, while the hackers receive payment after the service fees have been deducted.
More Than $1 Billion in Stolen Funds Laundered After Bybit Hack
The scale of the activity was highlighted following the $1.5 billion Bybit hack in February 2025. According to Wu Blockchain estimates from zeroShadow, more than $1 billion in stolen funds was laundered between February and June 2025.
The estimate does not mean that the entire amount was converted into fiat currency. Laundering cryptocurrency can involve multiple transfers and conversion methods, and moving funds through different transaction routes is not necessarily the same as completing a conversion into traditional money.
The distinction is important when assessing the movement of stolen digital assets. Funds may pass through several services or blockchain networks before reaching another destination. As a result, the amount estimated to have been laundered should not automatically be interpreted as the total amount successfully cashed out.
Elliptic Traces Funds Through Multiple Routes
Blockchain analytics firm Elliptic traced approximately $200 million through eXch, a cryptocurrency exchange service identified in its analysis. The firm also identified funds routed through cross-chain transfers, conversions into USDT and suspected Chinese over-the-counter (OTC) services.
These methods illustrate the different routes that stolen cryptocurrency can take as it moves between services and networks. Cross-chain transfers move assets between blockchain ecosystems, while converting funds into USDT changes their form into a dollar-pegged stablecoin. Suspected OTC services represent another potential channel for moving or exchanging digital assets outside conventional exchange order books.
However, the reported tracing of funds through these routes does not by itself establish that every transaction resulted in a successful cash-out. The source information identifies the methods and services through which funds were traced, but does not provide a complete accounting of the final destination of every asset.
Tracing Does Not Guarantee Recovery
Although cryptocurrency transactions recorded on public blockchains can remain traceable, identifying the movement of stolen funds is only one part of the recovery process. Recovering the assets also depends on cooperation from cryptocurrency exchanges, token issuers and law enforcement agencies.
Those organizations may play different roles in identifying accounts, assessing transactions and taking action where their authority and capabilities permit. The ability to follow funds on a blockchain therefore does not automatically mean that investigators or victims can retrieve them.
The cases described by zeroShadow and Elliptic highlight both the scale of laundering activity associated with major cryptocurrency thefts and the complexity of following assets through multiple transaction routes. In the Bybit case, zeroShadow estimated that more than $1 billion in stolen funds was laundered from February through June 2025, while Elliptic traced approximately $200 million through eXch and identified cross-chain transfers, USDT conversions and suspected Chinese OTC services.
Writer: Victoria HaleTechnology & Blockchain WriterVictoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.She prioritises clarity and accuracy when explaining technical developments to a general audience.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.