PodcastBanklessAri Redbord

Why North Korea Is Winning Crypto Crime | Ari Redbord

Speakers portray a landscape where state actors and professionalized criminal networks extract large crypto proceeds—North Korea alone is said to steal roughly $1 billion annually—and then rapidly launder and convert funds through chain‑hopping and off‑ramps. Industry and government responses range from Beacon‑style real‑time flags and large forfeitures (including a ~127,000 BTC seizure) to proposals that delegate recovery authorities to private firms, but off‑ramp vulnerabilities and privacy‑first protocols create enforcement blind spots. Concurrently, recurring DeFi breaches and nascent AI threats have produced ad‑hoc recapitalizations that speakers call unsustainable, while policymakers advance victim‑restoration mechanisms and classify crypto/DeFi as a national‑security domain.

Crypto MarketsDeFiBlockchain

Preview · 20 more points in the app

Read the Full Summary

Key Takeaways

Speakers say North Korea runs state‑directed crypto thefts on the order of roughly $1 billion per year and billions total, using a professionalized 'cyber army' and sophisticated laundering (mixers, fast conversions) to fund weapons research and prop up the regime.

Large scam compounds (e.g., the Prince Group/Shenzee style operations) employ thousands—often coerced—workers to run pig‑butchering campaigns that have defrauded hundreds of thousands of victims, contributing to record nominal crypto‑crime losses even as that crime remains a small share of on‑chain activity.

Iran/IRGC have used exchange shells and central‑bank crypto addresses to move funds and evade sanctions, prompting targeted OFAC actions, and speakers flag state‑level holdings (e.g., hundreds of millions in Bitcoin scenarios) as a classified national‑security concern.

Beacon‑style platform controls that flag illicit addresses in real time and currently cover roughly 85% of centralized crypto aim to keep proceeds on‑chain for seizure, but off‑ramp vulnerabilities (unregulated exchanges, Chinese OTC brokers) remain the critical choke points where visibility and enforcement break down.

Private firms like TRM propose delegated authorities and financial incentives (concepts like 'letters of marque') and pair automated analytics with human threat hunters and repeatable playbooks to accelerate recoveries, while acknowledging that attribution ultimately depends on subpoenas to link addresses to identities.

April’s wave of DeFi hacks (hundreds of millions lost) and the prospect of AI‑accelerated attacks have forced ad‑hoc recapitalizations (e.g., ~$300M) that speakers warn are unsustainable, and incidents like the Drift exploit show how social engineering plus protocol config changes can drain funds in roughly a 12‑minute window.

Seizure and forfeiture have proven practical and powerful levers—exemplified by a DOJ/FBI seizure of about 127,000 BTC (~$15 billion)—because on‑chain traceability lets authorities recover assets even when perpetrators are outside extradition reach, provided investigators can marry chain data to off‑chain subpoenas.

GEO-POLITICS

Pyongyang Theft — Speakers say North Korea runs state‑directed crypto heists, stealing roughly $1 billion per year and billions overall, with multi‑hundred‑million and billion‑dollar incidents used to fund weapons research and shore up the regime.

“Right? So, what they've now done over the last five or 6 years is stolen essentially averaging about a billion dollars a year…”—

Cyber Army — North Korea has professionalized its cybercrime operations—recruiting and training operators, using sleeper social‑engineering tactics—and leverages fast conversion and mixer infrastructure that compresses windows for tracing and seizure.

“This is a country with absolutely no economy whatsoever. And yet they're competing on the global stage because they've professionalized cyber crime essentially. there is absolutely no economy…”—

Scam Compounds — Operations like the Prince Group/Shenzee run industrial‑scale scam compounds with thousands of employees, including coerced victims, and pig‑butchering campaigns that have drained very large sums from hundreds of thousands of victims.

“DOJ indicted Shenzi, who was the ring leader here, who actually operated at the highest levels of the Cambodian government…”—

TECHNOLOGY

Beacon Perimeter — Beacon‑style systems that flag illicit addresses in real time and require members to block suspect funds are proposed as a practical enforcement perimeter to keep proceeds on‑chain and enable rapid law‑enforcement action.

“We formed something called the Beacon Network. And the beacon network accounts for about 85% of all centralized crypto today. So think Kraken, OKX, HDX, Paloni X Blockchain.com Crypto…”—

Letters of Marque — Firms like TRM proposed delegated authorities or incentives—analogous to 'letters of marque'—so private actors with superior data can pursue and recover blockchain criminal proceeds when government action is slow.

“What we need to do at TRM is we try to ensure that the government has all the data they need, but we also need some of these authorities…”—

ECONOMY

Whole‑of‑Government — U.S. authorities mounted coordinated DOJ indictments, large forfeiture orders, OFAC sanctions and FinCEN takedowns to freeze proceeds and dismantle laundering plumbing, with at least one case noting Chinese involvement in prosecution sensitivity.

“Then OFAC also sanctioned Prince Group…”—

Privacy Blindspots — Privacy‑first protocols can create enforcement blind spots because human intervention is limited; mixer prosecutions have succeeded when operators conspired with darknet markets, while TRM emphasizes address‑level risk scoring and the need for subpoenas to link addresses to people.

“I do know that there are some protocols where you absolutely do not have that ability…”—

Drift Exploit — The Drift incident used patient social‑engineering, pre‑signed transactions and a 2‑of‑5 validator threshold to execute dozens of withdrawals in about 12 minutes, showing how narrow time windows and a few accounts can produce major DeFi losses.

“Last week your team published a report saying these two accounts, there's a Drift report account and then the Kelp Dow one that we saw two weeks ago accounted for…”—

MARKETS

Off‑Ramp Risk — Off‑ramp vulnerabilities—no‑KYC Russia‑based exchanges, Chinese OTC brokers and similar services—are where on‑chain traceability breaks down and where illicit proceeds most readily enter fiat systems, making them enforcement priorities.

“I think Russia based exchanges that do no KYC that do no that have don't use tools like TRM to monitor transactions or don't care.”—

FORECASTS

Security Focus — National‑security officials treat insecure DeFi and crypto assets as potential national threats and are running classified efforts to enable or defeat certain uses, testing stress scenarios (for example IRGC holdings in Bitcoin) to see if state cyber/military options can affect on‑chain sovereign holdings.

“Is just like look if you guys can't secure your programs, your DeFi and your crypto assets, like this is becoming a national security threat to the US and like…”—

Related Episodes

Important Disclaimers

Not Investment Advice: For education only — not financial, tax or legal advice.

AI-Generated: Made by AI from source transcripts and may contain errors.

No Guarantees: Past performance does not predict future results; investing carries risk.

Our Commentary · Request Removal