North Korea transfers stolen cryptocurrency to new wallets and sends a small amount to foreign exchanges to cash out. They use phony IDs and avoid sending the money back to North Korea since the wallets get flagged and exchanges refuse to do business with them.