The London-based Royal United Services Institute (RUSI) has set out a detailed picture of how funds linked to North Korean cyber operations are increasingly converted from cryptocurrency into fiat currency through a complex, multi-stage laundering process involving organised crime networks and money mules.
Complex laundering pipeline crosses blockchains and jurisdictions
In its report, RUSI describes a system in which illicit proceeds travel across multiple blockchains and wallets before being passed to third-party groups that specialise in turning digital assets into conventional money. The study highlights the growing role of facilitators who operate in Chinese-language markets and employ a variety of methods — from peer-to-peer marketplaces to over-the-counter deals — to obscure the origin of stolen funds.
The think‑tank identifies a layered approach: digital transfers that exploit the anonymity of some cryptocurrencies are followed by engagement with human networks that can move value into cash or banked assets. Those networks include organised criminal syndicates, according to the report, alongside so‑called money mules who accept or transfer funds on behalf of others.
Methods used by facilitators
- Multiple blockchains and wallets to fragment and disguise transaction trails.
- Chinese-language online markets that provide conversion and brokerage services.
- Third‑party laundering groups, including organised crime syndicates, which handle conversion into fiat.
- Money mules and peer‑to‑peer transactions that place distance between operators and final recipients.
- Illicit online marketplaces and over‑the‑counter trades used to convert digital value into spendable cash.
The report underlines that the involvement of human intermediaries — rather than purely technological obfuscation — complicates efforts by law enforcement and compliance teams to trace and recover stolen assets.
Implications for enforcement and sanctions
RUSI's analysis suggests that simply tracking on‑chain movements is no longer sufficient to dismantle the networks converting stolen cryptocurrency into usable funds. The use of cross‑border human networks, including criminal groups and mules, presents challenges for investigators and regulators who must co‑operate internationally to identify and disrupt conversion points.
Financial institutions, compliance teams and law enforcement agencies face increased pressure to detect and interdict transactions that move off‑chain or are laundered through informal channels. The report also points to the risk that conversion mechanisms might exploit jurisdictions with weaker controls, or platforms that operate in languages and markets less visible to English‑language monitoring.
How the pipeline operates: a summary
| Stage | Function | Actors cited |
|---|---|---|
| On‑chain fragmentation | Split and move funds across multiple blockchains and wallets | Unknown wallets, cross‑chain services |
| Conversion facilitation | Convert digital assets to fiat via markets or brokers | Chinese‑language markets, P2P platforms |
| Cash-out | Turn converted value into banked funds or cash | Third‑party laundering groups, organised crime, money mules |
RUSI's findings add to a string of analyses indicating that state‑linked cyber operations are increasingly intertwined with conventional criminal methods. The combination of sophisticated technical know‑how and ground‑level facilitators can accelerate the monetisation of cyber theft while reducing the visibility of the money trail.
Experts say that effective disruption will require closer co‑operation between blockchain analytics firms, banks, law enforcement and foreign partners to identify the human and commercial nodes that enable cash‑outs. The report implicitly calls for enhanced information‑sharing and targeted action against the conversion points where digital assets are most vulnerable to being laundered into fiat.
While the RUSI analysis focuses on modalities rather than naming specific incidents or amounts, it emphasises a structural shift in how proceeds from cyber theft are processed — moving beyond technical concealment towards leveraging existing criminal markets and actors to turn stolen crypto into spendable money.
