North Korea stole at least $2.8 billion in virtual assets between January 2024 and September 2025 and is increasingly moving the proceeds through the same laundering channels used by scam syndicates and organised crime, according to a paper published this month by the Royal United Services Institute, a British defence and security think tank. The report says the funds are assumed to support the regime's weapons programme and argues that the key challenge for investigators now lies at the cash-out stage, where ownership can change hands before conversion to fiat. In some cases, third parties buy the stolen coins at a discount, while in others the funds appear mixed with proceeds from "pig butchering" investment scams or linked to infrastructure tied to Cambodia's Huione Group. The paper, drawing in part on Elliptic and ZeroShadow, says cashing out often relies on money mules in the Philippines, Indonesia and China, with stablecoin sales broken into roughly $7,000 tranches on peer-to-peer marketplaces and larger sums split into $30,000 chunks to reduce the impact of freezes. It also highlights exchange-level warning signs such as Astrill VPN logins and repeated support tickets to release held transactions. The report says fiat conversion rarely happens through straightforward bank transfers, with over-the-counter brokers instead using UnionPay cards from Chinese banks to deposit proceeds into North Korean-controlled accounts. It cites 19 Chinese banks identified last year by the Multilateral Sanctions Monitoring Team and notes that of the roughly $1.5 billion stolen from Bybit, 95% moved through decentralised services, with all of it converted into fiat or hard currency by September 2025. The authors urge tighter guidance for exchange correspondent relationships, standardised onboarding questionnaires, secure intelligence-sharing channels and a VASP identifier in payment messages. The paper's warning comes as Bybit said Monday it had sued North Korea and obtained an order freezing identified assets, recovering $48.4 million and freezing another $30.5 million, or about 5% of the total taken.