North Korea used Cambodian platform to launder $2.84B in cryptocurrency

North Korea used the Cambodian financial platform Huione Pay to launder cryptocurrency stolen through state-run hacking and IT schemes, according to a multinational investigative report released on October 22.

The Multilateral Sanctions Monitoring Team (MSMT) — representing 11 countries, including South Korea, the United States and Japan — identified Huione Pay as a key laundering channel. The platform has already been sanctioned by the United States for money laundering linked to human trafficking and detentions associated with Cambodia’s Prince Holding Group.

The report details how North Korea’s cyber units — run by the Workers’ Party’s munitions industry department — the military’s reconnaissance general bureau and the Ministry of Atomic Energy Industry stole and laundered digital assets. Most of these agencies are already under UN Security Council (UNSC) sanctions.

North Korean hackers posed as investors or recruiters to trick targets into downloading malware. They also staged fake job interviews to gain remote employment for profit and, in some cases, sold stolen data in coordination with Russian ransomware groups.

From January 2024 through September 2025, North Korea is believed to have stolen approximately $2.84 billion worth of cryptocurrency. MSMT said the regime used the digital currency to purchase weapons, materials and raw resources banned under UNSC resolutions.

The laundered funds were typically converted into cash through overseas brokers, with China’s UnionPay system serving as a key conduit. Laundering networks in Russia, Hong Kong and Cambodia were also utilized, including the Huione Pay platform, according to the report.

The report said North Korean intelligence officials have maintained close ties with Huione Pay employees since at least 2022. Those links allegedly enabled the regime to launder $37.6 million stolen from Japan’s DMM Bitcoin exchange in May 2024. In 2022, the Green Pine Association, a North Korean organization, reportedly used Huione Pay to launder $600 million stolen from the Vietnamese gaming company Axie Infinity.

In response, MSMT countries raised concerns with the Cambodian government in October and December 2024, citing Huione Pay’s support for North Korean entities under UN sanctions. Although Cambodia’s central bank revoked the platform’s license, Huione Pay continues to operate. The U.S. Financial Crimes Enforcement Network designated the Huione Group a “primary money laundering concern” in May.

The full report is available to the public at the MSMT website.

In a joint statement, the 11 MSMT member states reaffirmed their commitment to implementing UNSC sanctions against North Korea and urged Pyongyang to engage meaningfully in diplomacy. They also called on all UN member states to join efforts to counter those facilitating North Korea’s illicit activities, which threaten international peace and security.

The group further urged the restoration of the UN panel of experts on North Korea sanctions — which was dissolved in April 2024 due to a Russian veto — with its original mandate and structure. MSMT, which was launched in October 2024 to continue the panel’s role, released its first report in May, detailing illegal military cooperation between North Korea and Russia.

“This is the first comprehensive report to present a full picture of North Korea’s cyber activities,” said a South Korean foreign ministry official.

BY SHIM SEOK-YONG [kim.minyoung5@joongang.co.kr]