How North Korea Converts Stolen Cryptocurrency to Fiat: A Detailed Breakdown

In February 2025, hackers stole $1.5 billion from Bybita cryptocurrency exchange targeted in the largest single theft in history in February 2025. According to TRM Labsa blockchain analytics firm tracking North Korean cryptocurrency operations, North Korean state-sponsored hacking groups have stolen over $3 billion in cryptocurrency between 2017 and 2023 through 58 documented cyberattacks, with 2024 and 2025 seeing accelerated activity including the $1.5 billion Bybit exchange hack in February 2025-the largest single cryptocurrency theft in history as confirmed by Chainalysis on March 3, 2025. The regime's primary cash-out methodology evolved from early direct exchange withdrawals to complex multi-stage laundering processes involving cross-chain bridges, decentralized exchanges, and regional criminal partnerships, as documented in a May 2025 Financial Crimes Enforcement Network (FinCEN) report. The United Nations Security Council estimates that cryptocurrency operations now provide 20-30% of North Korea's foreign currency reserves, with the Harvard Belfer Center reporting that $2.1 billion in stolen cryptocurrency was successfully converted to fiat between 2017-2025, directly funding the Kim regime's weapons programs and evading UN Security Council Resolution 2397 sanctions which cap North Korea's annual oil imports at 500,000 barrels.

The Four-Stage Cash-Out Process

North Korea's cash-out process follows a precise sequence. First, they steal funds through phishing or infrastructure compromises-68% of attacks start this way. Next, they move assets across multiple blockchains to hide the trail. Using bridges like Ren Bridge or Avalanche Bridge, they shift funds between networks. Then, they convert most of the stolen crypto to Bitcoin-82% of final conversions target Bitcoin due to its liquidity. Finally, they convert Bitcoin to fiat through third-party networks with weak KYC checks.

Global Hubs for Fiat Conversion

Cambodia has become North Korea's primary cash-out hub. FinCEN's May 2025 report identified Huione Group as a key player, processing $37.6 million in North Korean-linked crypto between 2021-2025. Huione's subsidiaries handle everything from scams to issuing non-freezable stablecoins. China remains a secondary hub despite scrutiny. The Department of Justice indicted two Chinese nationals in February 2024 for processing $250 million through 37 bank accounts with minimal documentation. Meanwhile, Macau casinos accept crypto with just 5% KYC checks-far below the 95% standard in regulated markets.

Four-stage crypto cash-out process with bridge, Bitcoin, and fiat icons

IT Workers as Money Laundering Agents

North Korea deploys thousands of IT workers abroad to facilitate cash-outs. The UN Panel of Experts reported they generate $600 million annually. These workers use fake identities-89% claim to be from India or Vietnam-to get jobs at exchanges. Once inside, they create backdoors for fund movement. In 2024 alone, CSIS documented 27 cases where North Korean staff at Chinese exchanges enabled wallet-to-bank transfers in just 12 hours, bypassing standard fraud detection.

How Methods Have Evolved Since 2017

Early operations relied on mixing services like Tornado Cash, which processed $1.2 billion in stolen funds before its 2022 shutdown. Now, North Korea uses 'flood the zone' tactics-executing 400-500 transactions daily across platforms. According to CSIS, 73% of stolen assets pass through three or more blockchains before conversion. The Ronin Bridge hack in March 2022 saw $625 million stolen using compromised validator keys. Today, experts say launderers achieve 92% success rates in converting crypto to fiat within 90 days-up from 65% in 2020.

Workers exchanging cryptocurrency for cash in Cambodia crypto cafe

Current Challenges and Regulatory Pressure

Despite their adaptability, North Korea faces growing hurdles. The Crypto-Asset Reporting Framework now requires exchanges to share beneficiary info across 100+ jurisdictions. OFAC reported a 22% drop in successful cash-outs in Q1 2025. However, the regime is building its own infrastructure-FinCEN identified 14 North Korean-controlled 'crypto cafes' in Cambodia's Sihanoukville, each processing $500,000-$2 million monthly in cash transactions with no ID required.

Future Trends in North Korea's Cash-Out Methods

North Korea is now experimenting with 'stablecoin arbitrage laundering'-converting stolen assets to USDC via decentralized exchanges, then exploiting price gaps between regional markets. The FBI warned in April 2025 that they've recruited 37 blockchain developers to build custom cross-chain protocols capable of processing $500 million+ transactions. But Treasury Secretary Janet Yellen stated in May 2025 that success rates could drop to 40% by 2027 due to coordinated international action.

How does North Korea hide the origin of stolen cryptocurrency?

North Korea uses cross-chain bridges to move stolen assets across multiple blockchains like Binance Smart Chain and Solana. They execute hundreds of transactions daily to overwhelm blockchain analysts, a technique called 'flood the zone.' This makes it extremely difficult to trace the funds back to the original theft.

Why does North Korea prefer Bitcoin for cash-outs?

Bitcoin is the preferred intermediary currency due to its high liquidity and widespread acceptance. Over 82% of stolen crypto is converted to Bitcoin before final fiat conversion because it's easier to exchange for cash without raising red flags compared to other cryptocurrencies.

What role does Cambodia play in North Korea's cash-out operations?

Cambodia has become North Korea's primary fiat conversion hub due to its loosely regulated financial sector. FinCEN identified Huione Group, a key player in processing $37.6 million in North Korean-linked crypto between 2021-2025. Huione's subsidiaries issue non-freezable stablecoins and facilitate scams, while 'crypto cafes' in Sihanoukville process up to $2 million monthly in cash transactions with no identification required.

How do North Korean IT workers assist in money laundering?

North Korea deploys thousands of IT workers abroad who assume false identities to work at cryptocurrency exchanges and fintech firms. These workers create backdoors for fund movement, enabling wallet-to-bank transfers in as little as 12 hours-bypassing standard 72-hour fraud detection windows. The UN reported they generate $600 million annually through these operations.

What challenges does North Korea face in cashing out cryptocurrency?

Global regulatory pressure has made cash-outs harder. The Crypto-Asset Reporting Framework now requires exchanges to share beneficiary information across 100+ jurisdictions. OFAC reported a 22% decrease in successful cash-outs in Q1 2025. However, North Korea continues adapting by building its own infrastructure like 'crypto cafes' in Cambodia, though experts predict success rates will drop to 40% by 2027 due to coordinated international action.