Discharged veterans of a North Korean military intelligence cyber unit allegedly recruited elite university-trained IT personnel to breach the Chosun Central Bank and Foreign Trade Bank. The group reportedly diverted state trade funds in small increments, moved them through overseas cryptocurrency wallets, and used brokers and border contacts to convert the assets into U.S. dollars and Chinese yuan. North Korean investigators traced encrypted transaction traffic to a Pyongyang safe house and arrested the alleged operators on July 12, seizing computers and burner phones. The activity appears to have been an internally motivated financial crime using state-developed cyber expertise rather than an externally directed DPRK operation.