North Korea's $2.8B Crypto Laundering Network Exposed by RUSI Report

Woofun AI reports that the Royal United Services Institute (RUSI) has published a comprehensive analysis revealing North Korea's systematic laundering of stolen cryptocurrency, a finding highlighted by Decrypt. The investigation exposes a highly organized network that has successfully obscured the origins of illicit digital assets through increasingly complex financial maneuvers. This disclosure marks a significant escalation in the regime's cyber-financial operations, challenging existing detection frameworks.

The sheer volume of stolen assets underscores the severity of the threat. Between January 2024 and September 2025, North Korean actors managed to appropriate at least $2.8 billion in cryptocurrency. This timeline covers a period of intense activity, suggesting a sustained and well-funded operation rather than isolated incidents. The scale of these thefts indicates a strategic shift towards maximizing financial yield through cyber-enabled means.

Structurally, the laundering process relies on blending illicit funds with proceeds from other criminal activities. Investment scam proceeds and money linked to organized crime are frequently mixed with stolen crypto to obscure the original source. In some instances, third parties purchase entire batches of stolen assets at a discount during the cash-out process. Once acquired, these funds are transferred to addresses associated with criminal groups, further complicating attribution efforts for law enforcement.

Per Woofun AI, the operational tactics employed are highly specific and designed to evade detection. Following the Bybit hack in February 2025, launderers with Chinese connections, over-the-counter (OTC) trading firms, and peer-to-peer traders were mobilized to liquidate the assets. Stablecoins were sold in roughly $7,000 increments, while larger sums were split into $30,000 tranches. This fragmentation strategy is likely intended to avoid triggering anti-money laundering (AML) thresholds and remain below the radar of automated monitoring systems.

The report highlights critical vulnerabilities within the broader cryptocurrency ecosystem. Decentralized finance (DeFi) protocols and cross-chain bridges are frequently exploited due to their weaker compliance measures compared to centralized exchanges. These platforms allow bad actors to move funds across multiple hops, making it difficult for blockchain analytics tools to trace the complete transaction path. The lack of stringent know-your-customer (KYC) requirements on many OTC desks and peer-to-peer platforms further facilitates these illicit flows.

This intelligence reinforces the urgent need for coordinated action among governments, intelligence agencies, and the private sector. North Korea has long been accused of using cyberattacks to fund its weapons programs, and the laundering of stolen crypto complicates international sanctions efforts. Enhanced transparency and cooperation are essential to combat this growing threat. Regulators may respond by pushing for stricter KYC requirements and accelerating the adoption of advanced blockchain analytics tools to identify mixing patterns and flag suspicious activity more effectively.