Experts at AlienVault said the monero is being sent back to Kim Il Sung University in North Korea.