source_3920.pdf (2 MB)

North Korea is estimated to have stolen at least $2.8 billion in virtual assets between January 2024 and September 2025, with proceeds moving through decentralised services, third-party launderers, OTC and peer-to-peer traders, money mules and guarantee marketplaces before conversion to fiat currency or cash. The Bybit operation illustrates the scale and speed of this ecosystem: almost $1.5 billion was stolen in February 2025, and the funds were reportedly converted into fiat or hard currency by September. Supporting indicators include fragmented transactions, pre-arranged wallet distribution, mixers and bridges, mule-account anomalies, repeated demands to release frozen funds, certain VPN and device patterns, and handoffs to Chinese or Southeast Asian laundering networks. RUSI recommends stronger VASP due diligence, payment-message identifiers, secure intelligence sharing and rapid tracing during the first 72 hours after a theft.