Cambodia's Huione Pay becomes a Money Laundering hub: North Korea uses it to launder $2.84 billion in encryption proceeds.

A report released this Wednesday by a multilateral sanctions monitoring group involving 11 countries (MSMT) indicates that North Korea is using the Cambodian financial platform Huione Pay to launder the cryptocurrency stolen through state-sponsored hacking and IT programs. The report claims that from January 2024 to September 2025, North Korea has stolen approximately $2.84 billion in crypto assets and used them to purchase weapons and raw materials prohibited by the United Nations Security Council (UNSC). Despite Huione Pay's license being revoked and being designated as a primary money laundering concern by the Financial Crimes Enforcement Network (FinCEN), the platform continues to operate, exacerbating threats to international peace and security.

North Korean Cyber Crime: Up to $2.84 Billion in Crypto Assets Stolen

The latest multinational investigation report reveals the astonishing scale of North Korea's state-sponsored cyberattacks to steal digital assets and use them for illegal activities. These actions not only provide significant foreign exchange revenue for the North Korean regime but also pose systemic risks to global crypto asset exchanges and DeFi projects.

Multilateral Sanctions Monitoring Group (MSMT) estimates that since the beginning of 2024, North Korea has stolen at least $2.84 billion in digital assets through cryptocurrency Hacker attacks. The report notes that this massive amount of illicit funds “accounts for about one-third of North Korea's foreign exchange revenue in 2024,” indicating that encryption crime has become a major source of funding for the country.

The analysis of MSMT was assisted by professional organizations such as Chainalysis and Mandiant. Although security researcher Taylor Monahan disputes the attribution of some of the stolen incidents in the report, believing that the total profits attributed to North Korea may be overestimated, the report confirms several major hacking incidents, including approximately $1.46 billion stolen from a mainstream CEX in February 2025, approximately $308 million stolen from DMM Bitcoin, and approximately $235 million lost by a large exchange in India, all of which undoubtedly point to an escalation of threats from state-sponsored hacker groups. Additionally, several DeFi protocols, such as PlayDapp ($290 million), Radiant Capital ($50 million), and UwU Lend ($19.3 million), were also included in the analysis.

Huione Pay: A Key Node in the Money Laundering Network

The report specifically pointed out that the Cambodian financial platform Huione Pay played a key role in North Korea's crypto money laundering network, fueling its large-scale illegal fundraising.

MSMT has determined that Huione Pay is a major money laundering channel for North Korean crypto illicit funds. The platform has previously been sanctioned by the United States for reasons related to money laundering, human trafficking, and detention incidents related to Cambodia's Prince Holding Group. The report reveals that North Korean intelligence officials have maintained close contact with Huione Pay employees since 2022, allowing North Korea to efficiently launder stolen assets through the platform.

Specific cases include: the $37.6 million stolen from the Japanese DMM Bitcoin exchange in May 2024, and the reported $600 million laundered by the North Korean organization Green Pine Association using Huione Pay, stolen from the Vietnamese gaming company Axie Infinity in 2022. The report mentions that the laundered funds are often converted into cash through overseas brokers, with the China UnionPay system ( being an important transit point.

Concerns of the International Community and Response Measures

In response to North Korea's use of financial platforms and online means to evade sanctions, the international community, especially MSMT member countries, is taking action and calling for the restoration of the United Nations monitoring mechanism.

North Korea's hacker attack strategies include: disguising as investors or recruiters to trick targets into downloading malware; obtaining remote job opportunities under false pretenses to make profits; and even coordinating with Russian ransomware organizations to sell stolen data. These illegal proceeds are ultimately used by the North Korean regime to purchase weapons, materials, and raw materials banned by UNSC resolutions.

Regarding Huione Pay's support for North Korean entities under UN sanctions, MSMT member countries expressed concerns to the Cambodian government in October and December 2024. Although the Cambodian central bank has revoked the platform's license, Huione Pay continues to operate. In May, the U.S. FinCEN listed Huione Group as a “primary money laundering concern.”

The MSMT member countries, composed of 11 nations including South Korea, the United States, and Japan, reiterated their commitment to enforcing the UNSC sanctions against North Korea in a joint statement and called on all UN member states to work together to combat entities that facilitate illegal activities for North Korea. They also called for the restoration of the UN North Korea sanctions expert group, which was disbanded in April 2024 due to a Russian veto, to continue its work with its original mandate and structure.

Conclusion

North Korea is engaging in large-scale Money Laundering activities using platforms such as Huione Pay in Cambodia, posing a significant threat to the international financial system and geopolitical security. As much as $2.84 billion in Crypto Assets has flowed into arms procurement, highlighting the urgency of regulatory measures for digital assets at the national security level. Although the comprehensive report released by MSMT for the first time reveals the full scope of North Korea's cyber activities, Huione Pay continues to operate despite its license being revoked, requiring the international community to take more decisive and coordinated action to sever North Korea's illegal funding chains and maintain global financial stability.

Disclaimer: This article is for informational purposes only and does not constitute any investment advice. The crypto market is highly volatile, and investors should make decisions with caution.