Report: North Korean Hacker Uses "Huiwang Payment" for Money Laundering, Having Stolen Virtual Assets Worth $1.65 Billion This Year

According to Mars Finance, a multilateral sanctions monitoring group (MSMT) composed of 11 countries including the US, Japan, and South Korea recently released a report titled “North Korea's Violations and Evasion of UN Sanctions through Cyber and IT Personnel Activities” (MSMT/2025/2). The report states that from January 2024 to September 2025, North Korean hacker groups have stolen at least $2.837 billion in Crypto Assets by attacking global exchanges, with thefts reaching $1.645 billion in the first nine months of 2025 alone. The report indicates that North Korea is laundering money through intermediary organizations based in Russia, Hong Kong, and Cambodia, and is using platforms like “Huione Group”'s “Huione Pay” to convert Crypto Assets into cash. North Korea is also collaborating with Russian Ransomware groups and using AI tools like ChatGPT to enhance the stealth of their attacks. Additionally, North Korea has about 1,000 to 2,000 IT personnel working remotely under false identities in places like Russia, Laos, Cambodia, and several African countries, sending their salaries back to North Korea for funding nuclear and missile projects.