North Korea's $2B Crypto Heist: Flow Through the Chinese Laundromat

The scale of illicit capital extraction by North Korea in 2025 was staggering. The regime's cyber actors were responsible for stealing $2.02 billion in digital assets last year, a figure that represents a dominant share of the total. That haul accounted for well over half of the total USD 2.7 billion lost in crypto hacks globally, cementing North Korea as the most sophisticated and financially motivated threat actor in the ecosystem.

This wasn't a year of protocol exploits. The strategic shift was clear: attackers moved upstream to compromise centralized entities and developers. The pivot from targeting bridges to attacking the operational infrastructure of centralized exchanges and custodial service providers unlocked massive sums. This evolution reflects a playbook focused on exploiting the human layer rather than the code itself.

The flow didn't stop at the theft. The stolen assets were then funneled through a complex laundering network, effectively outsourced to what investigators call the "Chinese Laundromat." This fusion of state-directed hacking and industrial-scale laundering is what has made North Korea the dominant high-value attacker in cryptocurrency today.

The Attack Vector: AI-Powered Social Engineering

The attack chain is a precise, multi-stage deception. It begins with a compromised Telegram account of a legitimate industry executive. After building rapport, the attacker sends a Calendly link for a 30-minute meeting, which redirects to a spoofed Zoom meeting hosted on threat actor infrastructure.

The core deception unfolds during the call. The victim is shown a video of a recognizable CEO, which researchers assess may have been artificially generated or manipulated to reinforce legitimacy. The attacker then claims there are audio issues and instructs the victim to perform troubleshooting steps. This is the ClickFix ruse: the victim is directed to copy and paste a series of terminal commands into their macOS or Windows system.

One command in the sequence initiates the infection. The payload is a macOS-specific malware stack. Mandiant identified seven unique malware families deployed, including new tooling like WAVESHAPER (the primary backdoor), HYPERCALL (a downloader), DEEPBREATH (an infostealer), and CHROMEPUSH (a browser token harvester). This multi-stage deployment allows for phased control and data exfiltration.

This campaign marks a clear shift in UNC1069's tradecraft. The actor is no longer just using AI for productivity gains like editing images. As documented in a November 2025 report, UNC1069 has transitioned to deploying novel AI-enabled lures in active operations. The use of AI-generated video in a social engineering campaign against a crypto-focused FinTech firm is a direct application of this new, more aggressive playbook.

The Laundering Flow: The Chinese Laundromat

The stolen funds don't vanish after the hack. They are systematically funneled through a complex, industrial-scale laundering network known as the "Chinese Laundromat." This is a sprawling ecosystem of OTC brokers and underground banks that act as intermediaries, washing the illicit assets across multiple blockchains and jurisdictions. The goal is to sever the link between the stolen crypto and its original source, ensuring the funds are thoroughly obfuscated before they ever touch the formal financial system.

This persistent threat forces a costly operational shift for crypto firms. The old defense-static blocklists of known bad addresses-is no longer sufficient against this typology-driven laundering. Compliance teams must now invest in typology-driven, multi-chain detection frameworks that can identify the complex patterns of movement used by these launderers. This transition from reactive to proactive detection is a significant increase in operational security spend.

The bottom line is that North Korea's heist model is not just about the theft; it's about monetization through a sophisticated, outsourced laundering infrastructure. This dynamic raises the cost of doing business for the entire industry, as firms must continuously upgrade their defenses to keep pace with the evolving laundering playbook.