How North Korean Hackers Launder Stolen Cryptocurrency Through Global Networks

North Korean-linked hacking groups increasingly depend on professional money-laundering networks to turn stolen cryptocurrency into funds they can use, according to blockchain investigations into major crypto thefts. Rather than handling every stage themselves, attackers may rely on intermediaries who manage stolen assets, coordinate transfers and arrange eventual cash-outs in exchange for a fee.

The scale of the problem became particularly visible after the February 2025 Bybit hack, in which approximately $1.5 billion in cryptocurrency was stolen. The incident triggered a major effort by blockchain investigators and security firms to trace the funds as they moved through the crypto ecosystem.

Blockchain analytics firm zeroShadow estimated that more than $1 billion in stolen funds had been laundered between February and June 2025 following the attack. That estimate does not mean the entire amount had been converted into traditional currency. Laundering can involve moving assets through different wallets and services to obscure their origins, even when the funds remain within the cryptocurrency ecosystem.

The growing use of intermediaries highlights how crypto theft has developed beyond isolated hacking incidents. Specialist networks can take on the complicated work of moving funds, while the original attackers receive a share after fees and other costs are deducted. This arrangement can separate the people who steal assets from those responsible for handling the proceeds.

Professional Laundering Networks Complicate Crypto Investigations

These intermediaries may assume responsibility for managing stolen assets early in the process, including coordinating transfers and attempting to reduce the likelihood of funds being frozen. Their involvement creates additional layers between the original theft and the people or services that ultimately receive the money.

Investigators have identified several techniques used to move stolen cryptocurrency across the market. These include cross-chain transfers, conversions between digital assets and the use of third-party services that facilitate transactions. Such activity can make investigations more complex, although it does not automatically erase the transaction history recorded on public blockchains.

Elliptic traced approximately $200 million through eXch in connection with the investigation into stolen funds. The firm also identified movements involving different blockchain networks, conversions into Tether’s USDT stablecoin and suspected Chinese over-the-counter trading services. These findings illustrate the range of intermediaries and platforms that investigators may need to examine when following stolen assets.

Over-the-counter services can facilitate large cryptocurrency transactions outside conventional exchange order books. However, their involvement in a transaction trail does not, by itself, prove that every service or participant knowingly assisted criminal activity. Establishing responsibility requires evidence about the transactions, the parties involved and what they knew about the funds.

Why Tracing Stolen Crypto Does Not Guarantee Recovery

Public blockchain records give investigators an important advantage: transactions can often be followed from one address to another. Analysts can use transaction histories and other evidence to identify patterns, connect wallets and flag assets that may be linked to a known theft. This visibility can help exchanges and authorities intervene when the circumstances allow.

Yet tracing funds and recovering them are different challenges. Investigators may identify where cryptocurrency has moved without having the authority or technical ability to seize it. Funds can also pass through multiple services and jurisdictions, requiring coordination between private companies, regulators and law enforcement agencies.

Exchanges and token issuers can play a significant role when they have the ability to restrict access to identified assets or provide relevant account information. Stablecoin issuers may have additional controls over tokens issued on supported networks, while exchanges can review transactions and respond to lawful requests. The available options depend on the asset, platform, jurisdiction and circumstances of each case.

International cooperation remains another obstacle. Investigations involving North Korean-linked operations may cross several jurisdictions, each with different legal procedures and enforcement capabilities. Delays can give stolen funds more time to move, while incomplete information can make it harder to connect wallets and identify the people controlling them.

The Bybit case demonstrates both the transparency and the limitations of blockchain investigations. Billions of dollars in stolen cryptocurrency can generate a detailed public transaction trail, but following that trail does not guarantee that assets will be recovered or converted into cash. Disrupting professional laundering networks will depend on timely intelligence-sharing, coordinated enforcement and stronger controls across the services used to move digital assets.