According to CoinMeta, the North Korean regime stole at least $2.8 billion in crypto assets between January 2024 and September 2025, and increasingly uses existing criminal networks for money laundering. A report released by the Royal United Services Institute (RUSI), a British defense and security think tank, suggests that these funds are believed to be used to support their weapons program. The stolen tokens often change hands before being exchanged for cash; sometimes third parties buy them at a discount or mix them with proceeds from investment scams such as "pump-and-dump" schemes. The cashing out of these funds mainly relies on "money mules" recruited from the Philippines, Indonesia, and China, while stablecoins are typically split and sold through peer-to-peer markets. After a hack targeting Bybit, ZeroShadow discovered that TraderTraitor was using over-the-counter trading desks, peer-to-peer traders, and organized crime groups in China to transfer the funds. To date, Bybit has recovered $48.4 million and frozen $30.5 million in assets, which together account for about 5% of the total amount stolen.