North Korea has arrested two people in Wonsan, a city in Kangwon province, in mid-July 2026. Investigators say the pair used a “smishing” scheme, sending malware-laden text messages, to steal money from donju, the country’s wealthy market entrepreneurs.
A Daily NK source in Kangwon province said recently that the two had brazenly exploited the fact that contactless mobile payments and money transfers have become the norm, the source said. The pair carried out a sophisticated information-technology crime, disrupting the Jonsong electronic payment system and telecommunications networks to steal users’ funds.
The two arrested are reportedly gifted students who majored in information technology at Pyongyang’s Central University. The state later trained them as IT specialists for a government institution.
Their method was revealed during the investigation.
The pair first posed as the central bank or a senior inspection agency. They sent mass fake text messages to donju, the wealthy entrepreneurs who operate in North Korea’s jangmadang markets. The messages claimed that inspectors had detected “non-socialist fund flows” in the recipient’s e-wallet account and flagged it for a surprise inspection. Each message urged the recipient to click a link to confirm.
Alarmed at the prospect of an inspection, donju who clicked the link unknowingly triggered malware that installed automatically on their phones. This let the pair intercept e-wallet passwords for Jonsong, the electronic payment app on the victims’ phones, in real time. They then stole the funds stored inside.
Their crimes did not stop at smishing-based phone hacking. The hack had also handed them personal information about victims’ families. Using those details, the pair carried out so-called “voice fraud,” or voice phishing, as well.
For example, the pair would learn that a donju‘s child was in Pyongyang or a border region. They would then call and use the child’s real name to make the threat convincing. The caller claimed North Korea’s National Intelligence Agency, formerly known as the Ministry of State Security, had detained the child on charges of spreading reactionary ideology and culture. To avoid punishment and secure the child’s release, the caller said, the family needed to transfer money immediately to a designated account. This extorted even more money from the victim.
The source said major donju in Wonsan, Sinuiju, and Chongjin lost fortunes built over a lifetime of trading, all in a single stroke. Some donju halted wholesale transactions because of the resulting cash crunch, the source added. That, in turn, caused wholesale prices in local jangmadang to spike, creating market-wide disruption.
A state-trained talent pool turns to crime
North Korea’s Ministry of Social Security, the country’s police agency, learned of the cyber financial crimes and set up a special investigation task force that ultimately arrested them. Investigators are now looking into whether the pair had accomplices, and are tracing the flow of the stolen funds and examining similar cases reported in other regions.
The government likely feels the sting of this case, the source said. It had invested heavily to cultivate elite IT talent, only to see that talent turn to crime at home. There is also growing concern, the source added, that even more sophisticated IT crimes could spread in the future.
Reporting from inside North Korea
Daily NK operates networks of sources inside North Korea who document events in real-time and transmit information through secure channels. Unlike reporting based on state media, satellite imagery, or defector accounts from years past, our journalism comes directly from people currently living under the regime. We verify reports through multiple independent sources and cross-reference details before publication.
Our sources remain anonymous because contact with foreign media is treated as a capital offense in North Korea — discovery means imprisonment or execution. This network-based approach allows Daily NK to report on developments other outlets cannot access: market trends, policy implementation, public sentiment, and daily realities that never appear in official narratives.
Maintaining these secure communication channels and protecting source identities requires specialized protocols and constant vigilance. Daily NK serves as a bridge between North Koreans and the outside world, documenting what’s happening inside one of the world’s most closed societies.
August 5, 2026 at 05:47AM
by DailyNK(North Korean Media)