How North Korean Hackers Use Cross-Chain Crypto Laundering to Hide Stolen Funds

Imagine stealing $1.5 billion in a single heist and then making it disappear into thin air. That is exactly what DPRK hackers are state-sponsored cybercriminals from the Democratic People's Republic of Korea who use advanced techniques to steal and launder cryptocurrency for regime funding doing right now. They aren't just breaking into exchanges anymore; they are moving money across different blockchains so fast that even the best investigators struggle to keep up. This isn't just about lost crypto-it’s about how a sanctioned nation funds its weapons programs using the very technology designed to be transparent.

In 2023, North Korean hackers stole $660 million. By 2024, that number jumped to $1.34 billion. In 2025 alone, they have stolen over $2 billion. The biggest chunk came from the record-breaking Bybit heist in February 2025. But here is the real problem: getting the money out is harder than getting it in. To solve this, these groups have perfected cross-chain crypto launderinga method of moving stolen funds between different blockchain networks to obscure their origin and evade detection by analytics firms. If you hold crypto or work in compliance, you need to understand how this works because the threat landscape has changed completely.

The Shift from Mixers to Bridges

For years, if you wanted to hide stolen crypto, you used a mixer. Services like Tornado Cash were the go-to tool for scrambling transaction histories. But as law enforcement cracked down on mixers, the Lazarus Groupthe primary hacking unit associated with North Korea's Reconnaissance General Bureau, responsible for major cyberattacks and thefts had to adapt. Around 2022 and 2023, they stopped relying solely on mixing services. Instead, they started hopping chains.

Cross-chain bridges allow you to move assets from one blockchain, like Ethereum, to another, like Tron or Bitcoin. It sounds simple, but when done at scale and speed, it creates a massive blind spot. According to TRM Labs, the Lazarus Group became the dominant force behind an 111% surge in funds processed through cross-chain conversion services after June 2023. They seized nearly $240 million from breaches at platforms like CoinsPaid, Alphapo, CoinEx, Stake.com, and Atomic Wallet. The key difference? Mixers try to anonymize transactions within one chain. Cross-chain laundering breaks the link entirely by moving the asset to a new network where the previous history doesn’t automatically follow.

How the "Flood the Zone" Technique Works

You might think that tracing crypto is easy because every transaction is public on the blockchain. It is, until someone decides to overwhelm the system. Nick Carlsen, a North Korea expert at TRM Labs and former FBI subject matter expert, describes the current strategy as "flood the zone."

Here is how it plays out in real time:

1. The Breach: Hackers drain high-value wallets rapidly. In the Bybit incident, they moved billions worth of assets in minutes.
2. Rapid Conversion: They don’t just hold the stolen tokens. ERC-20 and TRC-20 tokens are systematically swapped for native assets like Ether (ETH) or Tron (TRX) via decentralized exchanges.
3. Bridge Hopping: Funds are sent through bridges like Ren Bridge or Avalanche Bridge. Bitdefender reported that the Lazarus Group deposited more than 9,500 BTC through the Avalanche Bridge alone.
4. High-Frequency Swapping: Investigators traced multiple rounds of swaps between Bitcoin, Ethereum, BTTC (BitTorrent Chain), and Tron. The goal is to create thousands of transactions in a short window.

This volume overwhelms compliance teams and blockchain analysts. By the time you identify one path, the funds have already split into dozens of smaller transactions across three different networks. It’s not just about hiding; it’s about creating too much noise for anyone to listen to clearly.

New Tactics: Obscure Chains and Token Creation

As analytics firms like Elliptic and Chainalysis get better at tracking major chains, DPRK hackers are moving to the shadows. They are now using "obscure blockchains"-networks with low liquidity and limited coverage by security firms. If an analytics company doesn’t monitor a specific chain, your stolen funds become invisible.

Even more concerning is the creation of custom tokens. After the Bybit breach, investigators noticed hackers issuing new tokens directly from laundering networks. These tokens can be traded among themselves or converted back into major assets later. It’s like printing your own currency inside a closed loop to avoid external scrutiny. Additionally, they use "refund addresses" to redirect assets to fresh wallets, effectively breaking the chain of custody. Each step adds a layer of complexity that requires manual investigation to unravel.

The Human Element: Social Engineering Rising

We often assume that sophisticated hacking means complex code exploits. While that is still true, there is a growing shift toward targeting people. Elliptic noted that "the weak point in cryptocurrency security is now human, not technological." As centralized exchanges harden their defenses, DPRK hackers are pivoting to individuals-specifically high-net-worth holders and company executives.

In 2025, with crypto prices rebounding, these targets became incredibly lucrative. Hackers use phishing emails, fake job offers, and compromised social media accounts to steal private keys directly. Once they have access to a personal wallet, they don’t need to break into an exchange. They just need to convince one person to click a link. This broadens the attack surface significantly. You can secure your server, but you can’t easily patch a human being.

Why This Matters Beyond Crypto

This isn’t just a tech story. It’s a national security issue. A senior Biden administration official stated in 2024 that approximately 50% of the DPRK’s foreign-currency earnings come from cybercrime. A UN report confirmed that member states believe the DPRK’s weapons program is largely funded by these operations. When you see $2 billion stolen in a year, you are looking at direct financing for nuclear proliferation.

The FBI has intervened, urging exchanges to halt transactions from known Lazarus Group wallets. In August 2023, they released a list of connected Bitcoin addresses. But the game is changing faster than the lists can be updated. The "flood the zone" tactic ensures that by the time an address is blacklisted, the funds have already moved through five different chains and been converted into Bitcoin, which remains stationary for large-scale over-the-counter (OTC) liquidation.

What Can Be Done?

The battle is now an arms race. Blockchain intelligence firms are responding with tools like TRM Phoenix, which automatically traces funds across blockchains. However, no tool is perfect. For exchanges and institutions, the focus must be on speed and collaboration. Sharing threat intelligence in real-time is critical. For individual users, the advice is simple: never share your private keys, verify all links, and use hardware wallets. If you are a developer, consider the security implications of bridge integrations. Every bridge is a potential entry point for attackers looking to exploit interoperability.

The sophistication of DPRK hackers shows no signs of slowing down. As long as crypto remains a viable way to move value globally without permission, these actors will find ways to exploit it. Understanding their methods is the first step in defending against them.