Adversary Intelligence — 2026-07-25

North Korea Intelligence Agency Busts Elite Hacking Ring of Former RGB Cyber Operatives Inside State Banks

BLUFPyongyang's own cyber veterans turning state-trained offensive tools against regime banks undercuts Western assumptions that RGB-linked hacking units operate under tight, reliable state control.

North Korea's National Intelligence Agency arrested a hacking ring on the night of July 12 after raiding a safe house in Pyongyang, catching members laundering funds at their computers, according to a Daily NK source inside the country 1. The group, led by discharged veterans of a Reconnaissance and Intelligence General Bureau cyber unit and staffed with recruits from Kim Chaek University of Technology and Pyongyang University of Science, breached internal networks at the Chosun Central Bank and the Foreign Trade Bank 1. Using Chinese-made wireless equipment and encrypted messaging, the ring diverted state trade funds and foreign currency into cryptocurrency, moved it through brokers in China, and exchanged it back into dollars and yuan through contacts in Sinuiju and Hyesan 1. Investigators traced the scheme after flagging discrepancies in currency-payment approvals and irregular overseas IP access; authorities seized computer equipment and burner phones during the arrests 1. CoinTurk News and ChinaTechNews.com relayed the same account, both citing Daily NK as the sole underlying source 23.

Analysis
The breach exposes a control failure inside North Korea's own financial and cyber apparatus: veterans of the Reconnaissance and Intelligence General Bureau turned state-trained offensive skills against the Chosun Central Bank and Foreign Trade Bank rather than foreign targets. Discovery through payment-approval discrepancies and irregular overseas IP access indicates Pyongyang's internal monitoring caught the scheme only after sustained operation, not through preventive controls. The National Intelligence Agency's show of force and the warning that punishment extends across family lines are directed at the broader IT and cyber workforce trained at Kim Chaek and Pyongyang University of Science. The episode complicates external assessments of loyalty and reliability within RGB-linked cyber units that Western governments attribute to state-directed hacking campaigns abroad.

3 sources

North Korea busts elite hacking ring inside its own banks - Daily NK
North Korea arrests state-trained hackers for stealing regime's crypto funds - CoinTurk News
North Korean Hackers Arrested After Laundering State Funds With Crypto - ChinaTechNews.com