The Hidden Network Behind Global Crypto Heists

Hooded person using a laptop in a dark server room — Photo: Svitlana Hulko / Shutterstock

U.S. officials say North Korea built a government-run hacker pipeline that steals billions to fund the regime’s needs, and the record now shows how it works and who runs it.

Story Snapshot

Treasury tied Lazarus Group and allied teams to North Korea’s spy service and sanctioned them.
Justice Department charged named North Korean hackers in a wide theft and extortion scheme.
Officials say North Korea trains cyber operators to hit banks and crypto platforms.
Reuters described a school-to-military pipeline that starts selecting children around age 11–12.

U.S. Government Links Groups To North Korea’s Spy Service

The U.S. Department of the Treasury said in 2019 that Lazarus Group, Bluenoroff, and Andariel are agencies or controlled entities of North Korea, tied to the Reconnaissance General Bureau, the regime’s main spy service. The designations aimed to block assets and cut the groups off from the financial system. The move signaled that Washington views the groups as state tools, not freelancing gangs. It also warned global banks and companies to tighten defenses and report suspect activity.

The Treasury Department added in 2020 that North Korea trains cyber operators to target financial institutions and to launder stolen money through complex networks. That statement matched a broader shift in the regime’s tactics. Early attacks went after banks and payment systems. Newer campaigns focused on cryptocurrencies and exchanges. The structure lets thieves move value fast and across borders. It also makes tracing and recovery harder once assets pass through mixers and shell services.

Criminal Cases Name Hackers And Alleged Operations

The U.S. Department of Justice filed a criminal complaint in 2018 against programmer Park Jin Hyok, alleging he worked for a North Korean front company and belonged to Lazarus Group. Prosecutors tied him to major breaches that used custom malware, spoofed emails, and social engineering. The complaint laid out technical indicators and tactics that investigators say connect the activity to North Korea. It remains an allegation, but it shows how the U.S. builds legal cases in this arena.

In 2021, a federal indictment named three North Korean military intelligence hackers—Kim Il, Jon Chang Hyok, and Park Jin Hyok—and described a wide plot to steal from banks and cryptocurrency platforms. The charging document alleged theft, extortion, and laundering schemes across many countries. It detailed how fake personas, spear-phishing, and malicious code opened doors inside targets. The case linked operations to the Reconnaissance General Bureau and to clusters known as Lazarus Group and APT38.

Training Pipeline And Youth Selection Claims

Reuters reported in November 2026 that North Korean authorities select about 150 to 200 children each year, starting around ages 11 to 12, for elite cyber training, based on interviews with a named former trainer and defectors. The report said top performers move to advanced schools and then to military cyber units. The account described study in math, programming, and foreign languages. The outlet framed this as a system built to produce operators who can penetrate networks and move stolen funds.

The U.S. Treasury in 2023 called Pyongyang University of Automation a premier training hub whose graduates often enter cyber units under the Reconnaissance General Bureau. That official description aligns with a pipeline from schools into state units. It also ties named institutions to later operations against banks and cryptocurrency targets. Together with the sanctions and cases, it sketches a state program that recruits, trains, and deploys talent for cyber theft and disruption.

Crypto Heists And Money Laundering Tactics

The Treasury Department said Lazarus Group stole about six hundred twenty million dollars in March 2022 from the Ronin blockchain tied to the Axie Infinity game, underscoring the scale of thefts linked to the regime. That figure illustrated why cryptocurrency became a prime target. Decentralized platforms can move large sums quickly. Attackers often chain transfers, use mixers, and swap tokens to hide tracks. These methods challenge law enforcement and make recovery rare once funds fragment.

🔐 North Korea’s Secret Army of Hackers: How Kim Jong Un Built a Cyberwarfare Machine Behind the 3 Billion Binance Heist

-Fact Checker: ✅: 5 ❌: 0 || 5/5 → Score: 100% 🦾
-Prediction: 📈 4 Positive | 📉 1 Negativehttps://t.co/c3r4wCaimI

— Undercode News (@undercode_news) November 6, 2026

Officials say the aim goes beyond headlines: cyber theft helps North Korea work around sanctions and pay for state goals. That concern cuts across U.S. politics. Conservatives see a hostile regime exploiting weak controls and poor borderless finance rules. Liberals see global platforms failing to protect users and communities. Both sides see a system where elites and bureaucracies missed the warning signs while ordinary people and small firms carry the risk and the cost.

Why This Matters For Americans And Allies

Banks, hospitals, small businesses, and crypto users are all in the blast radius when state hackers strike. When platforms lose funds, fees rise or services shrink. When hospitals get hit, delays can harm care. When trust drops, the economy slows. The U.S. can harden defenses, share threat data faster, and push stricter checks on crypto cash-outs. But deterrence is hard when a government treats cyber theft as policy and shields its operators from arrest.

Limits And The Road Ahead

The most specific details about early-age selection and class size come from defectors and one former trainer, which are not the same as official North Korean records. Even so, U.S. designations, training hub identifications, and criminal cases show a real state-backed program. Expect more pressure on mixers, over-the-counter brokers, and shell firms that help cash out stolen tokens. Expect more joint probes with allies and faster wallet freezes after major hacks.