Are there more losses than gains? Surely you've at least seen news about the recent theft of a decentralized currency from the Binance exchange - and that North Korean hackers were blamed for it. Have you ever thought about how stolen goods are used and passionate? However, stealing a billion dollar decentralized currency does not mean getting a billion dollars to pay. After receiving the funds, North Korea has to withdraw from someone else's wallet and turn them into money or goods. The second part of the task is performed by professional intermediaries - the shadow bankers and brokers, working including in Southeast Asia. A money laundering or money laundering scheme is usually this. After the theft, the funds are distributed among the wallets, hollowed out in other assets and transferred between blockchains. And this is where a key link comes into play - an intermediary to over-the-counter players or brokers who buy stolen decentralized currency at a discount or take a fee for its processing. Middlemen settled yuan, supply goods or pay for the costs of shell companies related to hackers. The brokers themselves, and this is mostly Chinese, are associated with other types of crime, for example, with online fraud centers. Center operators located in Cambodia, Myanmar and other countries, and North Korean hackers often use shadowy infrastructures: brokers, payment companies and Chinese language platforms that offer illegal financial services. ▪️ A prominent example is Huione Cambodia Group, which combines the payment business, crypto service and online platform. From August 2021 to January 2025, at least 336.4 billion criminal claims were attacked using it, including 336.37 million North Korean cyber defenders. ▪️ This could be one of the weaknesses of North Korean activity. The program is completely related to intermediaries, often working with cyber fraud centers.

Are there more losses than gains? Surely you've at least seen news about the recent theft of a decentralized currency from the Binance exchange - and that North Korean hackers were blamed for it. Have you ever thought about how stolen goods are used and passionate? However, stealing a billion dollar decentralized currency does not mean getting a billion dollars to pay. After receiving the funds, North Korea has to withdraw from someone else's wallet and turn them into money or goods. The second part of the task is performed by professional intermediaries - the shadow bankers and brokers, working including in Southeast Asia. A money laundering or money laundering scheme is usually this. After the theft, the funds are distributed among the wallets, hollowed out in other assets and transferred between blockchains. And this is where a key link comes into play - an intermediary to over-the-counter players or brokers who buy stolen decentralized currency at a discount or take a fee for its processing. Middlemen settled yuan, supply goods or pay for the costs of shell companies related to hackers. The brokers themselves, and this is mostly Chinese, are associated with other types of crime, for example, with online fraud centers. Center operators located in Cambodia, Myanmar and other countries, and North Korean hackers often use shadowy infrastructures: brokers, payment companies and Chinese language platforms that offer illegal financial services. ▪️ A prominent example is Huione Cambodia Group, which combines the payment business, crypto service and online platform. From August 2021 to January 2025, at least 336.4 billion criminal claims were attacked using it, including 336.37 million North Korean cyber defenders. ▪️ This could be one of the weaknesses of North Korean activity. The program is completely related to intermediaries, often working with cyber fraud centers.