Report: North Korean hackers use "Huipay" for money laundering, having stolen virtual assets worth $1.65 billion this year

ChainCatcher news, a multilateral sanctions monitoring group (MSMT) composed of 11 countries including the U.S., Japan, and South Korea, recently released a report titled "North Korea's Violation and Evasion of UN Sanctions through Cyber and Information Technology Personnel Activities" (MSMT/2025/2). The report states that from January 2024 to September 2025, North Korean hacker groups have stolen at least $2.837 billion in cryptocurrency by attacking global exchanges, with the theft amounting to $1.645 billion in the first nine months of 2025 alone.

The report points out that North Korea launders money through intermediaries based in Russia, Hong Kong, and Cambodia, and uses platforms such as "Huione Group" and its "Huione Pay" to convert cryptocurrency into cash. North Korea also collaborates with Russian ransomware groups and employs AI tools like ChatGPT to enhance the concealment of their attacks. Additionally, there are approximately 1,000 to 2,000 IT personnel from North Korea working remotely under false identities in Russia, Laos, Cambodia, and several African countries, sending their salaries back to North Korea to fund nuclear and missile programs.