A Focus On "Cashing Out": One Way to Combat DPRK's Crypto Thefts
2026-03-26 • 38North •
https://www.38north.org/2026/03/a-focus-on-cashing-out-one-way-to-combat-dprks-crypto-thefts/
38 North focuses on how DPRK-linked actors convert stolen cryptocurrency into usable funds after hacks and laundering. The article cites estimates that DPRK stole about $3 billion in 58 cyberattacks from 2017 to 2023, plus the Lazarus Group's approximately $1.5 billion Bybit theft in February 2025. It describes cash-out pathways involving OTC brokers, facilitators, centralized exchanges, P2P platforms, shadow-banking brokers, money mules, and networks in jurisdictions including Cambodia, Argentina, Russia, the UAE, China, and Singapore. Published cases include Huione Group, Sim Hyon Sop-linked networks, Chinese OTC traders, and exchange or wallet activity tied to Lazarus Group-linked proceeds, showing where member states may be able to disrupt DPRK sanctions-evasion even when the original hacks and on-chain laundering are hard to see.