Interviews with experts and defectors detail North Korea's Reconnaissance General Bureau, whose hackers are estimated to have stolen $650M+
The Reconnaissance General Bureau, North Korea's equivalent to the CIA, has trained up the world's greatest bank-robbing crews. Facebook: Patrick Winn . Tweets: @josungkim , @pritheworld , @pri , @pritheworld , @pwinn5 , @bdeskin , @pri , and @pri_security Facebook: Patrick Winn : My latest: How North Korean hackers became the world's greatest … Tweets: Joseph Kim / @josungkim : Malware on Google Play and Facebook, with IP addresses that point to N Korea, is targeting defectors http://securingtomorrow.mcafee.com/ ... Pri's The / @pritheworld : 1/ While the world has been worrying about North Korean nuclear weapons, Kim Jong-un's Reconnaissance General Bureau (its CIA) has been training its hackers to rob the world's financial institutions. @pwinn5 has that story for @pritheworld and @globalpost http://s.pri.org/ZQfizCe @pri : North Korea has launched hacks against more than 100 banks and online exchanges in a total of 30 countries. The RGB (its equivalent of the CIA) appears to have successfully pilfered $650 million. That we know of. http://s.pri.org/gVg7JSA via @globalpost @pri_security pic.twitter.com/yqZJYvetdp Pri's The / @pritheworld : Barred from global markets and starved by Western sanctions, North Korea sought revenue in realms beyond the law. The Reconnaissance General Bureau has become home to the greatest hackers in the world. http://s.pri.org/qPTOyuD via @globalpost @pri_security pic.twitter.com/yaw2uYVMXi Patrick Winn / @pwinn5 : My latest: for @PRI: How North Korean hackers became the world's best bank robbers. Units under NK's foreign intel bureau pulled a heist on the Fed — and many, many others. https://gpinvestigations.pri.org/ ... pic.twitter.com/0TE0YIVjsI Blake Eskin / @bdeskin : “In the capital, he says, the hackers' families can enjoy great luxuries: hot water around the clock, regular electricity, rare food items—such as bananas—that are beyond the basic soldier's ration allotment.” https://gpinvestigations.pri.org/ ... @pri : North Korea's elite hackers receive prestige and benefits for themselves and their families in exchange for their talent and loyalty. Revolt is unthinkable: They have too much to lose. http://s.pri.org/HPO6SeX via @globalpost @pri_security pic.twitter.com/4IBW9joTu8 Global Security / @pri_security : 1/ While the world has been worrying about North Korean nuclear weapons, Kim Jong-un's Reconnaissance General Bureau (its CIA) has been training its hackers to rob the world's financial institutions. @pwinn5 has that story for @pritheworld and @globalpost http://s.pri.org/ZQfizCe Expand More For Next Unexpand More For Next
Context & Ripple Effects
This 2018 GlobalPost investigation was among the first detailed portraits of the Reconnaissance General Bureau as a revenue engine rather than a pure espionage shop: hackers trained for loyalty with privileges for their families, running heists against more than 100 banks and online exchanges across 30 countries, including a reported strike at the Federal Reserve. The later coverage fills in what happened next — the bank-hacking campaigns documented in “The Hacker and the State” and the pivot toward digital assets, where the UN now credits Pyongyang with billions stolen from exchanges and spies planted inside US crypto firms as remote workers.
First-order effects
- Global banks and online exchanges are the direct targets: RGB crews have hit over 100 institutions across 30 countries, with investigations attributing at least $650 million in losses to the unit.
- Defectors face immediate personal risk — malware distributed through Google Play and Facebook, with infrastructure pointing back to North Korea, is used to track and target them.
Second-order effects
- Crypto exchanges displace traditional banks as the preferred target class, because stolen digital assets are harder to freeze and trace than SWIFT-era wire fraud — the pattern behind the Axie Infinity and Bangladesh Bank heists documented by the Financial Times.
- Western financial institutions and exchanges must treat a nation-state crew as a persistent criminal competitor, pushing KYC and insider-threat screening toward the paranoia levels usually reserved for counterintelligence.
Third-order effects
- State-directed cybercrime hardens into a formal pillar of regime finance: the Research Center 227 unit focused on AI-based hacking shows the operation being institutionalized and upgraded rather than wound down under sanctions pressure.
- If the pattern holds, sanctions enforcement shifts from interdicting goods to policing digital-asset flows, making exchange security a de facto instrument of international sanctions policy.
The trend: North Korea's state hacking is scaling from bank robberies into an industrialized crypto-theft economy, with each new unit — from the RGB to Research Center 227 — widening the gap between its capabilities and the defenses of its targets.