Report: North Korean hackers used Huiwang Payment to launder money, stealing $1.65 billion worth of virtual assets this year

PANews reported on October 24 that the Multilateral Sanctions Monitoring Team (MSMT), composed of 11 countries including the United States, Japan, and South Korea, recently released a report entitled "North Korea's Violation and Evasion of UN Sanctions through Cyber and Information Technology Personnel Activities" (MSMT/2025/2), stating that from January 2024 to September 2025, North Korean hacker groups stole at least US$2.837 billion in cryptocurrencies by attacking global exchanges, of which the scale of theft in the first nine months of 2025 reached US$1.645 billion.

The report notes that North Korea launders funds through intermediaries in Russia, Hong Kong, and Cambodia, using platforms such as Huione Payment, a subsidiary of the Huione Group, to convert crypto assets into cash. North Korea also collaborates with Russian ransomware groups and uses AI tools such as ChatGPT to enhance the stealth of its attacks.

In addition, North Korea has approximately 1,000 to 2,000 IT personnel working remotely under false identities in Russia, Laos, Cambodia, and several African countries, and remitting their salaries back to North Korea to fund nuclear weapons and missile projects.