Report: North Korean hackers use "Huipay" for money laundering, having stolen virtual assets worth $1.65 billion this year

ChainCatcher message, a multilateral sanctions monitoring group (MSMT) composed of 11 countries including the US, Japan, and South Korea, recently released a report titled "North Korea's Violations and Evasion of UN Sanctions through Cyber and Information Technology Personnel Activities" (MSMT/2025/2), stating that from January 2024 to September 2025, North Korean hacker groups have stolen at least $2.837 billion in cryptocurrency through attacks on global exchanges, with the theft amounting to $1.645 billion in the first nine months of 2025.

The report points out that North Korea launders money through intermediaries based in Russia, Hong Kong, and Cambodia, and uses platforms such as "Huione Payment" under the "Huione Group" to convert cryptocurrency assets into cash. North Korea also collaborates with Russian ransomware gangs and uses AI tools like ChatGPT to enhance the concealment of attacks. Additionally, there are approximately 1,000 to 2,000 IT personnel from North Korea working remotely under false identities in Russia, Laos, Cambodia, and several African countries, sending their salaries back to North Korea to fund nuclear and missile programs.