Why North Korea Is Interested in Cryptocurrency - Ep.150

Transcript

Hey everyone, welcome to Unchained, your no-hype resource for all things crypto. I'm your host, Laura Shin. One quick announcement before we start the show. Unchained now has a merchandise shop. We've got a few t-shirts, a couple hats, a mug, several mugs, and stickers. My team and I got creative with one of the t-shirt designs and came up with an image of a crypto rabbit falling down a hole. Swirling into the hole with the rabbit are playing cards showing some of the coins like Bitcoin, Ethereum, and Monero, as well as a DAO card ripped in half. There's a Guy Fawkes mask, a DeFi cake, a Lambo, and a teapot that says HODL, as well as teacups showing the Reddit and Twitter logos. There's even a shitcoin. The rabbit is wearing a big Bitcoin key on a keychain, a unicorn and rainbow t-shirt, and of course, is

listening to Unchained. We've also got rabbit versions of the mug and some decals, as well as a special Bitcoin maxi mug and an Ethereum maxi mug. Check it all out at shop.unchainedpodcast.com. Again, that's shop Unchained. First time donors using that link will have their donations matched up to $1,000. They accept traditional payment methods, Bitcoin, Ethereum, and several other cryptocurrencies. Keep this in mind while

you make your end of year tax moves. Again, that's givewell.org slash unchained. CipherTrace cutting-edge cryptocurrency intelligence powers anti-money laundering, blockchain analytics, and threat intel. Leading exchanges, virtual currency businesses, banks, and regulators themselves use CipherTrace to comply with regulation and to monitor compliance. Got any EOS? With Crypto.com, you can top up their card with EOS to spend. You can also earn up to 8% on EOS per year on the Crypto.com app. Download the Crypto.com app today. Kraken is the best exchange in the world for buying and selling digital assets. It has the tightest security, deep liquidity, and a great fee structure with no minimum or hidden fees. Whether you're looking for a simple

fiat on-ramp or futures trading, Kraken is the place for you. Today's guest is Priscilla Moriucci, Director of Strategic Threat Development at Recorded Future and non-resident fellow at Harvard Kennedy School. Welcome, Priscilla. Thank you for having me. Before we get into the particular of today's topic, which is all about North Korea and its interest in cryptocurrency, why don't you give a short background on your work with North Korea and tell us what areas it is that you focus on with respect to the country and how you came to be an expert in this area? Sure. So I spent a while at National Security Agency and it left about three years ago. And that's when I kind of gained some of my interest in North Korea. And at that

same time, about three years ago, I started looking at what we would call like the network traffic, right? Network traffic coming from North Korea to attempt to understand what we can learn about North Korean leaders, their behavior, their interests, you know, any insight really into the regime, you know, from looking at how they use the internet. And that's really how I got onto this I would call it like topic, but this kind of obsession really from both my end and the North Koreans with cryptocurrency and just the myriad ways in which they've been able to kind of use and exploit blockchain and crypto technology. And this might be a really basic question, but how do you do that? Are you literally just like hacking into their computers or are you like monitoring web traffic or like, or I don't even know,

maybe you can't reveal these things. I'm not sure. Yeah, so no hacking involved. All illegal. What many people don't realize is that when you turn on your computer and you go to a website, there's what's called metadata. So these data points, like an IP address, for example, of the website that you're going to, the ports or protocol that your computer is using to communicate with the server that hosts that website, for example. And all of that information, right, called metadata, right, can be harvested and collected. And that allows, you know, researchers like myself, some insight into the behavior, you know, of, in this case, North Korean leadership, you know, some of that, you know, of course, can be mitigated by using things like a

VPN or something like that. But yeah, it's studying the metadata, right? No content, just data points about what North Korean leaders are doing online. And when you first started looking into this, what behavior were you seeing? And then how has that changed over time? Yeah, sure. So when we first started looking at, you know, how North Korean leaders were kind of using the internet, this was back in early 2017. And largely, leaders at this point in time, we're using it or we would call like leisure activities. So lots of video streaming, video gaming, social media use. So just like normal

Western Westerners, like ourselves, you know, they kind of get up in the morning and check social media, check even Western. Sorry, just sorry, when you say Video streaming, are you saying like they're watching YouTube or what does that mean? Yes. Yes. So I think what, what like it's important, I guess there's a few caveats here. So one, we're able to profile this internet behavior of essentially an entire country because most of the country, the population doesn't actually have access to the global internet. North Korean, ordinary North Koreans now are able to use kind of smartphones and ask access like a domestic intranet and a domestic cellular system right one that connects them to other north koreans but not ever to the rest of the world at large

so when we look at global internet traffic sort of to and from these north korean ip ranges we are looking at a very very very tiny subset of north korea and sort of the the 0.1 you know i would call them the most senior leadership and their families who have both the ability and the permission to actually use the global internet and access it for leisure activities or for work. So that's why it looks kind of normal because a lot of these, most senior leaders in their family have what we would consider to be kind of normal Western pieces of life. And they aren't the ones who are struggling to pay the bills or farm or get food on the table or provide heat

for their houses, these are the pampered elite. And if you were to put a number on how many people that is, what would you guess that number is? It's hard to say because again, like the amount of traffic, you know, for a country of 25 million people, you know, we're looking at likely under a few hundred, you know, who actually have access to the global internet. But I don't have a specific number. I would say under 300 people would be my best guess. Oh, wow. Okay. And so I'm sorry, because I actually caught you. I was so shocked when you said they stream videos. So could you just, yeah, finish describing what their internet behaviors are? Sure. So, I mean, you know, at that point, you know, three years ago now, you know, we could see when users, you know, kind of get up

in the morning, you know, North Korea time, you know, sort of checking news and, you There are social media, streaming videos, playing video games, checking news in English, Japanese, a number of different providers and languages. But for the most part, right at that point in time, most of the sort of peaks and activity were at what we would sort of consider off hours. So after work time periods or on weekends or evenings. And that's, you know, that at the time was highly indicative that it was more the internet for these senior leaders at that time was mostly like a amusement, right? Or a leisure tool. And over time, you know, the past three years,

that's, that's changed pretty significantly. So before we get to that, how it's changed, I wanted to ask when you were saying they were using social media, does that mean they actually had like their own profiles? Like, Like, you know, I'm this high level North Korean person on Facebook or how were they using, you know, social media? Yeah. So again, because we were using metadata, right? I wasn't able to see like, I got this question a lot like, what's Kim Jong Un doing online? I don't really know. Right? I know what people in Kim Jong Un's social circle are probably doing, you know, and other leaders. And so, yes, you know, we could see, for example, like, you know, scrolling through the Facebook newsfeed, but I don't know what the content of that newsfeed was or what the account was, for example, you know, same with

Twitter, you know, scrolling through Twitter, but I couldn't see what the user was. And it, okay. Yeah. Cause I was trying to figure out like, are they friending each other or are they trying to friend like people? Okay. But we don't know that, but, but one thing is, know, I asked you kind of the number of people, do you have a sense of like, when you say the most elite, like, can you give examples of like, types of people or titles that would be allowed to access the global internet? Sure. So I could give like types of people, right? So it would be senior Korean Workers Party, right, or KPA, the People's Army leaders, most senior intelligence leaders, You know, certainly Kim Jong-un's sister, right, would be among those who would be sort of trusted enough

for global internet access and possibly some sort of university researchers, right, doing research on behalf of the state. And you may not know this, but obviously since, you know, the other 25 million people are not allowed on the internet, like how is access granted or how is permission granted? I'm sure there are some people who are maybe close to having that privilege, but until they're given it, it would probably be very, very dangerous for them to try to access it on their own. So do you have any sense of that? So I don't know what the procedure is for someone who's granted access to the internet. I mean, we have an idea of the devices that users who do access

the internet are using. So there's a lot of mobile devices, iPhones and iPads. Huawei handsets, also a lot of Windows computers. We know that from a technology perspective, users of North Korea's internet are using everything from the latest iPhone to computers that are running Windows 7, which is now a deprecated operating system. In a certain case, it's like bring your own device, North Korea style. And then for sort of the normal North Koreans, their cellular network and their intranet doesn't even have a physical hardware connection to the global internet. So there'd be no way for them to like hack their

way around things or hack their way through, right? They don't even have that possibility to access the global internet from any device that they own. Plus the devices they do own are supplied by the state and there's spyware. on them, right, which monitors the websites they go to, the files they download, the conversations and messages that they send and receive. Oh, wow. Oh, okay. Wow. I didn't, I wasn't aware of that. So, and I don't know if you know about this, but does that mean then there's like some agency in the North Korean government that's actually monitoring what the population is doing on their devices? Yes, most likely. Yeah. So for, for the population, It's not clear the extent to which all North

Koreans understand the monitoring of their personal communications on their cell phones. I think most of them are aware of it. But mobile phones in North Korea serve this dual purpose for leadership, which is one, giving the population this feeling of modernity. North Koreans, for example, are watching illicitly and illicitly, like more and more videos and media from the outside world, it's making its way into North Korea, you know, on thumb drives, on CDs, on a number of ways, and North Koreans are watching that. And they have at least some idea that, you know, sort of the rest of the world is embracing or has been able

to use these technologies, right, that they're just beginning to see, right, mobile phones, you know, the internet. And so this, you know, allowing North Koreans you know, to have mobile phones, you know, gives them the sense of sort of catching up to the rest of the world on one hand. But on the other side, these are pretty much kind of built in surveillance devices for the Kim regime and the, you know, the security services to keep an eye on the population. Okay, and now I realize we're maybe getting a little bit out of your air of expertise, but just one last question on this. So if you're saying that you know, people can't, people are accessing information from the outside and watching it, consuming it, you know, like movies and songs and whatever, but at the same time, their devices are surveilling them, then are

they using different devices to watch the illicit material? Yes. Yeah. So there's some studies that have come out indicating that North Koreans will have separate devices. So they'll have their mobile phones for their communications, and then they'll have portable CD players are kind of popular or kind of low-end other mobile devices that won't ever connect to a network, but allow them to upload files via USB, for example. OK. So we started with you describing what you saw was the internet behavior of the North Korean elite when you first started monitoring it a few years ago. And then you said that it has changed. How has it changed? Yeah, so over time, and

I wouldn't be so forthright to say that our research has been read by North Korean leadership. I think this is probably likely just patterns in how people are using the internet globally. But when we first started looking at it, it was like 99% of North Korean users we're not even doing the most basic internet hygiene, right? So they wouldn't go to sites and use HTTPS, for example, which enables what we call like SSL encryption. So when you use a HTTPS site, for example, someone from the outside, a third party cannot necessarily view the content of the communication between your computer and that computer. They can see the fact of that communication, for example, but they can't see like that you Laura, check your Facebook account. They

can see a communication between your computer and Facebook. So that's one of the things that over time that we've observed is that North Korean leaders, whoever they are, are becoming more security conscious. They're using VPNs, virtual private networks. They're using some of the most basic, taking some of the most basic steps to internet hygiene, right? Using SSL, for example, And that limits, you know, to some degree, our ability to see what exactly the communications are, the sites exactly that North Koreans are going to. So that's one, they become more security conscious.

And second, is this been this shift over the past few years, what we call like the professionalization of the internet. So we talked earlier about how much internet use was sort of in these off hours or on weekends and involved video streaming. And over time, right, the use of or the percentage of the use of media has stayed the same, but the other types of content, right? And the hours in which North Koreans are using the internet has shifted to be much more now towards work day, work hours. And that indicates, it's an indicator to us that the internet is becoming more of a tool, right? A professional tool for these North Korean leaders, as opposed to just kind of a leisure activity. Yeah, well, clearly

that's why we're doing this show because one of the areas that they're focusing on is definitely cryptocurrency. And so why don't we just give a high level overview of what North Korea's interest in cryptocurrency is like, you know, what are you seeing that showing you that they're interested in that? How do you know that this is going that, you know, it is them that's interacting with these cryptocurrencies and and in general, why do you think they're interested? Sure. So I'll try to break that down. So first, We first saw that North Koreans were interested in cryptocurrency when we observed some mining activity, right? From the North Korean IP ranges in March, 2017. Right. So that, that piqued our interest. It was really

small scale, looked like just a few machines conducting Bitcoin mining. And then from my perspective, that led me to look into is North Korea using sort of Bitcoin and other cryptocurrencies in any other ways. I mean, it's kind of started this odyssey, and especially in 2017, where you have, where we've gotten to this place now, you know, from 2017 through today, where I would say there are like five ways, right, in which North Korea either uses or exploits or gains cryptocurrencies. So one is mining, right? We see them North Korean leaders, some UN member states have sort of submitted anecdotes to the United Nations, which the UN has then put out in their reports

about potentially the military also engaging in cryptocurrency mining. So we've got mining from either senior leaders and or the military. Two, we've got these thefts, right? Large scale thefts from cryptocurrency exchanges, mainly in South Korea. and cryptocurrency users. Third, North Korea has really embraced what we call it crypto scams. So either like standing up a fake blockchain company or crypto jacking, which I'm sure your users will be aware, right? It's this concept of stealing the computing power of another and unwitting users machine to mine cryptocurrency. Fourth, through low-level crime. So another kind of interesting aspect of North Koreans use

of the internet is this idea that they engage in a lot of like low level criminal activity, like thefts from online casinos or thefts from, um, users, uh, gaming users accounts, like theft of armor, for example, and a resale of that, the writing of scripts, right. To cheat at certain games and then selling those grips on. So that generates, um, some of those transactions take place in cryptocurrency as well. And then the fifth is the most kind of speculative at this point. But there have been reports that North Korea is looking to develop its own kind of token or some kind of coin. Right. And for some of the other ones, you know, like the crypto jacking or, you know,

the thefts, how is it that North Korea was determined to be behind those? Sure. So When a, what we call like a cyber operation or an intrusion is executed, typically the attackers leave, I guess what we would call like little breadcrumbs, right? Whether they know it or not, right? Behind evidence that is accumulated over the course of conducting a cyber operation, whether it be sort of inside the victim network or outside on the infrastructure, right? The computers, the IPs, the domains, right? That they had to use.

to sort of trick the victims and conduct the operation. So they leave these little data points that when you pull it together, allow you to develop a signature for something that looks like a North Korean operation. And so this case with like the cryptocurrency exchanges, we had a number of those data points plus for me, right, I only kind of, assess that North Korea was behind an intrusion when one, I've got enough of those data points, so I have at least 70% confidence. And two, in many of the cryptocurrency exchange cases, the South Korean NIS, so their intelligence service has made some kind of public statement in which they've implicated North Korea. And I wanted to also

ask about the exchange hacks when you were saying that they have especially targeted South Korean exchanges. Is that simply because there's like a shared language? You know what I mean? Like, is it just as simple as that? Because obviously there's a ton of cryptocurrency exchanges around the world. Many of them have greater sums of money. So, you know, I don't know why it is that they're focusing there. The only thing I could think of was the language. So I think there are probably three reasons. So one is the language, right? Two is South Korea is kind of enemy number one for North Korean military and intelligence services. They have entire units that are focused just on disrupting aspects of South Korean

government, communications, foreign policy, society, stealing from South Koreans. And so as a target, South Korea is really the pointy end of this fear. the spear when it comes to North Korean cyber operations. And third, I think your listeners will probably understand this is that there's a slightly different environment for cryptocurrency use in South Korea than in much of the rest of the world. Many more of your like average citizens use cryptocurrencies in South Korea than in many other countries. There are a lot more like physical exchanges in South Korea as well, like physical ATMs, physical branches, right, where people can exchange a wide variety of cryptocurrencies for fiat currency. So I think between this

sort of combination of those three, that makes South Korea just a really appealing target for North Koreans. That's true. Yeah, the penetration of the average population there is much higher than I think any other place on earth. So and one other thing I wanted to ask was when you mentioned the mining earlier, you said that it was the military that was mining cryptocurrency. So you know, I don't understand everything about the regime. But is that that's like part and parcel of Kim Jong Un's regime, right? It's, it's not like Was the military doing that independently? Did they decide that themselves? Why is it the military and not just the regime generally? Do you understand what I'm asking? Yeah.

The military are one of the main benefactors of the Kim regime. One of the factions that the Kim regime needs to keep happy. And one which they devote significant resources to. you know, the Kim regime have kind of a military first policy, right, in which resources, food, revenue, right, are diverted to the military first, and then kind of ordinary citizens later. So one, military are extremely important to have on the side of Kim Jong Un, and to support him. And second, you know, the senior military leaders, right, and for special military operations would certainly have access to the global internet. And then in this case,

from what we've seen of both sort of the hardware and the software installed on North Korean networks, it's not likely that anything sort of happens, right, or mining, even on a small scale, right, because the type of the volume of traffic it creates could really be achieved without the sort of monitors, internet monitors or administrators being aware of it. Right. And is that because I read the UN report, you know, talking about how the money being earned from cryptocurrency by North Korea is probably used being used to fund its nuclear power. So is that also why it's connected? Why it is that the the military is the one doing the mining? Or is that not related? It's possible.

I mean, so the, I mean, one of the, there are many interesting slash bizarre things about North Korea. But, you know, one of those interesting things is that, you know, for the most part there, and especially in the military, you know, everyone, every mission, every personal, every person, their first job is to support the state. in the goals of the state. And so in this case, you know, with the military, you know, whether the military were involved in not the state have very specific goals, the continuation of the regime, the Kim regime, establishment of themselves and their ballistic and nuclear missile program, and potentially the reunification of the Korean Peninsula under the Kim regime. So all people,

right? There's no sort of independent, I don't think that's gonna happen. But it's our optimists up there in the North Korea. And there's really no room right for independent careers, right, or independent efforts in North Korea, to a large extent. So when the military is engaged in something, right, it's because it's supportive of one of these three goals. So one other thing that I wanted to ask about, which is pretty well known in the cryptocurrency space is that North Korea was likely behind the WannaCry ransomware attack. First of all, for listeners who maybe aren't familiar with that or have forgotten the details, can you describe that attack and then also explain why

it's believed that North Korea was behind it? Sure. So WannaCry was a piece of ransomware. And the sort of attack that we're talking about occurred in May of 2017, in which, as we now know, the North Koreans kind of tweaked this largely publicly available piece of ransomware called WannaCry to incorporate what's known sort of in the cybersecurity community as a, at the time was a zero day exploit, right? This one, was kind of endemic to Microsoft systems. And at this point in May, many users were aware but hadn't patched their systems. So there were many, many computers globally, right, millions that were still vulnerable to this particular exploit that North Korea then sort of installed in the WannaCry ransomware and

deployed on the world. And really what sort of raised the I guess the specter of WannaCry and why people still refer to it is because it had such a global impact. It spread to computers and users around the world, right? No matter what country you were in, if you had not updated or patched. And that had some really huge impacts. For example, it took out the UK's National Health Service, the NHS computers, and it kind of swept the world for a few days. So yeah, that's WannaCry. So in a moment, we'll discuss what North Korea did with the Bitcoins they earned from the WannaCry attack. But first, a quick word from the sponsors who make this show possible. Today's episode is brought to you by Kraken. Kraken is

the best exchange in the world for buying and selling digital assets. With all the recent exchange hacks and other troubles, you want to trade on an exchange you can trust. Kraken's focus on security is utterly amazing. Their liquidity is deep and their fee structure is great with no minimum or hidden fees. They even reward you for trading so you can make more trades for less. If you're a beginner, you will find an easy on-ramp from five fiat currencies. And if you're an advanced trader, you'll love their 5x margin and futures trading. To learn more, please go to Kraken.com.

That's K-R-A-K-E-N dot com. Got any EOS? Crypto.com is adding more utility to it. You can top up their card with EOS and spend anywhere Visa is accepted. Not only can you spend your crypto, but you can grow it too. Earn up to 8% on EOS per year on their app. Crypto.com has recently launched its exchange and crypto fundraising platform, The Syndicate. is a 50% off EO sale starting next Tuesday, December 17th, 6am UTC for 24 hours only. Sign up on the new exchange to enjoy the sale now. Will the world follow France and advocate banning privacy coins? Will government-backed stablecoins become the new fiat? Are distributed and peer-to-peer exchanges just a flash in the pan? The answer is maybe. Virtual

currencies can flourish and create a new private and more versatile economy. But that grand vision can't happen without keeping crypto clean. And that requires support of governments and accountability for bad actors. Privacy enhanced compliance using cryptographic controls has the potential to preserve anonymity without compromising legitimate investigations. CypherTrace is working on this vision of the future. Sign up to stay up to date on the privacy enhanced compliance initiative and receive authoritative crypto AML reports quarterly. www.cyphertrace.com slash keep crypto clean.

Back to my conversation with Priscilla Moriucci. So North Korea perpetrates this attack around the globe to try to obtain Bitcoin. Bitcoin famously has this public blockchain. And yet, I believe the North Koreans actually were able to profit from the attack. So what did they do with those Bitcoins? Sure. So I think there's still some debate about what the goal of WannaCry was for the North Koreans. I mean, if you look at it from a revenue generating standpoint, by the end of the attack or when the accounts, the three Bitcoin wallets where the ransom was directed, right? By the time those accounts were cashed out in August of 2017, the value of those kind of 52-ish Bitcoin were about $142,000

US dollars, which is a lot, right? But not a substantial amount. And so I think a couple of years later when the US government kind of came out and publicly attributed North Korea to the WannaCry attack, their assumption was that North Korea had engaged in this sort of cause global chaos. Right? And it's possible that they didn't realize how far this piece of ransomware would spread because while the exploit they were using was relatively new and it had been a zero day prior, there had been time for some people to patch their machines.

So that's kind of the first step. So once, you know, as sort of one of the people was kind of following this at the time, looking back, a lot of people in the sort of information security community were kind of smiling because as WannaCry spread and the ransom note would pop up on people's machines, it directed people to pay the ransom to only three Bitcoin wallets. And people were pretty certain that we, the global we could track. these three Bitcoin wallets, we could keep an eye on them, we could track where the transactions were going, and we could then find out who is responsible. So if we fast forward from May, where everybody's kind of smiling to early August, August 2, of 2017, those three wallets were emptied within minutes of each other in six transactions. So

two transactions each emptied all of those wallets. What we know from there is that the transactions or the Bitcoin were then fed into what's called the mixer, right, which I'm sure your users will be aware of what a mixer is. And then when the coins come out on the other side, they were then converted to Monero. You know, as your listeners will be aware, Monero blockchain is much different than the Bitcoin blockchain. And each Monero transaction is encrypted so that only the user and the receiver can see the transaction. And that's essentially where the trail runs cold for researchers. And for me, what was really interesting about the way North Koreans moved the coins around

was one, that they were willing to take hits in terms of fees, Bitcoin fees, mixer fees, Monero fees, transaction fees, in order to maintain that anonymity. it seemed to be a conscious decision to move right after the coins were kind of run through the mixer to a sort of privacy focused token. Yeah, I feel like Monero is kind of a theme with North Korea because I believe that the main crypto jacking malware that's associated with North Korea was being used to mine Monero. Do you feel that this regime has a particular interest in Monero?

And if so, you know, how do you think they're using it and benefiting from it? Yeah, so we've seen the regime use three coins, Bitcoin, Monero and Litecoin. So for a while in 2018, we saw some really small scale Litecoin mining from North Korean leaders as well. That's has since ceased, right. But so we've got overall kind of a focus on Bitcoin and Monero. And you're correct that we do see Monero used by North Koreans, but also certainly not moving away from Bitcoin. My sense is that North Koreans are using Monero because of the focus on privacy and anonymity,

even though Bitcoin can be utilized in a way that would make the end recipients of transactions virtually anonymous anyway. And I think, you know, from sort of our studies of the criminal community at large, Bitcoin is still very, very widely used and even preferred among many and sort of we would consider like the dark web, right? Or the Russian language, especially criminal underground because of the ease of use, right? There are so many, you know, sort of Bitcoin users, participants, and, you know, the, it's a quick, it makes for quick transactions. So Monero is sort of slower transactions, but again, I think it's really that focus on anonymity for

North Korea. So obviously, cryptocurrency is useful to North Korea. However, it's probably only useful once it's converted into fiat. So how does North Korea convert cryptocurrency into fiat? I can't imagine it's very easy for them. Yeah, that's the last mile in this whole dramatic story that we have the least insight into. I think there are a number of educated hypotheses and theories. So one, I used to get asked a lot about whether North Korea has this like huge stash of coins, right, that they're just kind of stockpiling and hiding, and they're just going to cash out whenever they want. My sense is that North Korea needs the money. So

within a short period of time, after they acquire the cryptocurrency, whether it be in a large scale theft from an exchange or through crypto jacking or wherever, crime, they need to be converting it into a fiat currency. So one, they're not kind of storing it. I'm not sure how well or not well they kind of play the market, whether they cash out all of their 2017 earnings in December, for example, when Bitcoin was at its peak or not. you know, I'm not certain, but I think we do know that they need the money. And there are sort of existing networks, we would call them physical networks that North Korea has established over the past 40 years. These illicit networks in countries in Southeast Asia, for example,

in Europe, as well, that these networks kind of exist in the embassies and consulates as attached to overseas embassies and consulates that have facilitated North Korean illicit activity for decades. Everything from drug smuggling to precious gem smuggling to counterfeit cigarettes in US dollars, these networks have facilitated that for decades. I strongly believe that these networks are also involved in exchanging cryptocurrencies for fiat currencies or even I'm not sure what you can actually purchase as a physical commodity with cryptocurrency these days. It's possible that someone somewhere is willing to take Bitcoin for coal, for example, or for an offshore

oil transfer. I think we just don't know how much you can really get right these days. So I'm going to read a bit from the AP report, which actually was about the UN report. They say, quote, according to a report from one unnamed country cited by the experts, stolen funds following one cryptocurrency attack in 2018 were transferred through at least 5,000 separate transactions and further routed to multiple countries before eventual conversion to currency that a government has declared legal money, making it highly difficult to track the funds. That's what's so sophisticated to me. So, you know, in general, from what you're seeing, do you feel like the North Korean hackers have a very

high level of sophistication and fluency with regard to cryptocurrency? Without a doubt. So, I mean, if you talk to some South Korean researchers, they have seen North Korean crypto jacking malware since 2015, right? When for most of the world, most of the world didn't even really know what Bitcoin was at that point. And the North Koreans were already creating malware, right? That would mine Bitcoin, right? Without users awareness. So there's been an underestimation in general by the global community of North Korean capabilities when it comes to cyber operations, North Korean knowledge around the banking system, for

example. And you can see this when you start to look at North Korean cyber operations, the sophistication of the North Korean bank thefts, for example. North Korea and the North Koreans who are executing these operations have a very deep understanding of how cryptocurrency and the crypto ecosystem works and how to mesh that with their physical networks, right? The physical people on the ground who are already understand how to launder money through casinos, for example, is a popular one. And it's this integration, I think, that really strikes me. In terms of North Korea, cryptocurrency doesn't just stay in the virtual world. It very much supports these real world outcomes and they integrate these two networks to make it just even more impactful. Yeah, and actually

that reminded me of actually what I meant to ask you earlier was I was surprised when you said that one of the ways in which they probably cash out is through networks in Europe, because in general, I think of Europe as being a place where it's mostly democracy. So are there any particular countries there that tend to work a lot with the North Korean regime? So in this case, it's not. from what we see anyway, it's not that the countries work with North Korea or even that the countries are aware that there are North Koreans conducting illegal activities in their countries. It's more of a using these countries for, for example, the financial system or for the embassies and consulates or for the networks that they've established with the criminal underground in those countries that North Korea is able to use

and exploit. Like if you look, for example, you take a look at the banking operations. So these cases in which North Korea has managed to gain access to the SWIFT, right? Which is the interbank transfer system, the SWIFT servers of banks and where all of their, or where many of their we call them like fraudulent transactions are directed, right? You have fraudulent transactions going to banks in Hong Kong, Southeast Asia, financial centers such as London, right? Some transactions in to banks in New York, for example. So I think there's a focus and an idea that there certainly is a large network of North Koreans in Southeast Asia, but certainly

in the West, There are also North Korean, North Korean collaborators, people who are unknowingly collaborating with North Korea as well, who is this large system of support, right? You know, we really have a hard time kind of putting our finger on and explaining because it's been cultivated for so long. And so I mentioned that UN report a couple of times, but can you talk a little bit more about how it was determined that this $2 billion that they earned in cyber tax was used to fund their weapons program? Yeah, so I think the $2 billion is the total for the cryptocurrency thefts and the banking operations. So this fraudulent SWIFT transactions from late 2015

up until early 2019. So about a four year period of time. And if I read the UN report correctly, I think the understanding is that that was funding the weapons program through looking at kind of the North Korean defense sector. And also to be honest, just through what I would call just high confidence assessments that, you know, when you look at North Korean funds, how the large majority of it does go to the military and these programs. Oh, I see. Okay. So, you know, as we talked about in the beginning, The general North Koreans do not have access to the internet. There's only this like very select few at the very

top who do have access to the global internet. So who is performing all these cyber attacks? How have they been trained in this way? Because clearly it's, they're probably not just like everyday North Koreans who you know, like here in the US, like somebody who becomes a very skilled programmer probably grew up playing with computers. But in North Korea, there probably aren't that many kids that grow up that way. So who are these hackers? Sure. So certainly in like the early days of the program, I would say they're probably maybe the next generation of North Korean hackers will have grown up playing with at least smartphones and will be sort of technology users, right, because of the internet and their mobile devices. But for the sort of the original

generation and to a certain extent still today, North Korea develops its kind of hackers in a kind of state run sort of, if you think of the Soviet Union's development of gymnasts system in which- I knew you were going to say that. I don't have another great metaphor because it's kind of bizarre. Like you have a proclivity, right? To math, for example. know and north korean kids they're identified at like the middle school stage right having a number of uh you know whether they have a good you know capacity for math they're then shipped into a one specific high school right and a car follow on a couple of different universities kimil sung university kimchack university for example where these North

Koreans are trained, right? I think there's some defector testimony that kind of in the early, early days, we're talking about like the 90s, the late 90s, users or students at the universities would learn how to code by typing on paper keyboards, because they didn't even really have computers or keyboards. What is a paper key? I don't even know what that means. It's always to be like a printout of a keyboard on a piece of paper, and they would type on it way back in the early days. They were well beyond that at this point. You see pictures of computer labs at these universities. No more paper keyboards, but in the way early days, that's how some people learned. And so, again, they have this

intranet in which you can learn a lot of basic computer skills, networking, coding, et cetera, just by operating on this intranet. And then for those that exhibit, kind of graduate from the program, either a seed into the military, which is in most cases what we think of, or the intelligence service, the Reconnaissance General Bureau, the RGB, will then send people overseas. And it's at that point that even, there's a lot of unique things about North Korea, as we talked about earlier, but this is particularly unique in which there's a substantial subset of North Korean cyber operations. these crypto scams, these crypto generation, the thefts, for example, some banking operations, some of the low level crime, that takes place in

countries overseas, not actually in North Korea. Let's talk about India and China, for example, where North Korea will send their students to study, to learn a little bit more, and then house all of their hackers in I don't know, the best word was like hacker dorms. If we take some defector testimony to heart in which there'll be 10, 20, 30 tens of cyber operators housed in kind of a warehouse environment. They have to purchase their own computer and it's their job kind of all day long under the eyes of their either intelligence or military minder to conduct operations to generate revenue for the regime. And from a volume perspective,

right, most of those operations are just kind of low level crime, low level crypto scams, IT work, like legitimate IT work. And then of course, you have the kind of big splashy stuff as well. Katie Robbert- And so why is it that they send these cyber operators overseas? Like, you know, I do this podcast from my apartment, like why does it matter where they are physically? So for a long time, North Korea has such limited IP space. So, you know, they're about anywhere between about three IP ranges, you know, that North Korea uses on a regular basis to access the internet. Those three IP ranges are very well known. They're as, as you know, our research has shown, right? people are aware of them, it's easy

to track. And in most cases, while there has not been like necessarily large costs to North Korea for being attributed to some of these attacks, they at the same time, don't want to be or they want to make it as hard as possible for researchers and for other, you know, governments, for example, to link North Korea to any of these attacks. So, so for one, when all of your operations come from a very small subset of IP addresses that are already well known to be North Korea, take some of the guesswork out of attribution. But second, also for a long time, arguably up until about 2017, North Korea had very few physical connections to the actual internet. And most of those were controlled by China or Chinese

companies, which meant that North Korea was subject to at any point, a Chinese decision to cut off the internet. So it's this idea that cyber operators and hackers, they were so critical to the regime, they have to send them overseas and take that risk. It's a risk that some of their most highly trained assets could be arrested in a foreign country because it was so important for them to be able to continue their operations unimpeded. Well, okay. Yeah, it just goes to show how how little I have the mind of a cyber attacker. But anyway, we're better.

So let's now discuss the sanctions piece, because obviously, you know, the reason why discussing North Korea's interest in cryptocurrency is especially timely right now in the cryptocurrency world is because of the arrest of Virgil Griffith, a researcher for the Ethereum Foundation, who was arrested for allegedly helping the North Korean government or attempting to help the North Korean government evade sanctions. And in some of the discussions in the crypto community on Twitter, people were saying to me that actually sanctions hurt the everyday people more than the regime. So I was wondering, you know, from your understanding of how North Korea works, what would you say about that?

Is that true? Yeah. So, I mean, there's always this back and forth argument when sanctions are imposed on a country about who is actually hurt by the sanctions. We have this discussion with Iran, for example, and I think there's no doubt that the population certainly suffers in North Korea when sanctions are imposed. But I think my counter to that argument is that the population was suffering anyway. The population even without sanctions, right? To a large extent, the Kim regime subverts the needs of its people, the physical needs, right?

Food, shelter, you know, those type of things, security, right? To the needs of the state. And they have policies in which their population are directed, right? And to subvert their own needs to that of the state. So, you know, the Kim regime doesn't support its population anyway. And I think certainly that sanctions do harm the population as well. But Kim himself in his 2018 New Year speech last year acknowledged that the sanctions were also harming the government and the military and their ability to execute their own goals. So I think my own personal view on the sanctions is that they're ultimately necessary if we as the

world believe that North Korea should not have a nuclear weapon. And we want to one day hope that to give North Korean people a better life. Yeah. And for listeners who missed last week's episode with North Korean defector, Yeonmi Park, I highly, highly recommend you listen to that. She suffered as a child under the North Korean regime. And when I asked her this question, she said, look, he wants the sanctions to be lifted. That means that they hurt him and that means that lifting them benefits him. And she said, you know, when I was living there, I was basically starving.

I was passing dead bodies on the street. I just thought that was normal. And she said, you know, even if they were lifted, it's not like he's going to, you know, be feeding people all all of the benefit of that will go to the elite. And she said it in a much more impassioned way than I just did. But it's such an incredible episode. I highly recommend people listen to that. So then I also wanted to ask about the Virgil situation specifically where, you know, so we don't know all the facts, but some of the facts that we do know, these are just public things that he was tweeting or posting on Facebook or whatever, were that he spoke at a blockchain conference in Pyongyang. He had permission from the North Korean government to travel there. And unfortunately, not from the US government, which is why he's in trouble. And that afterward, he was also in communication with what

he called the Pyongyang SciTech complex. And he talked about how he was helping them invite new people to talk there. So just even that alone, without going into whether or not what DOJ alleged was true or not, based on those things, what would you say would have been the impacts of what he was doing? Who could have benefited from his talk at this conference and, you know, the fact that he traveled there with the permission of the North Korean government, et cetera? Yeah. So, so from my perspective, you know, I think North Koreans have, as we talked about earlier, a very deep understanding of cryptocurrency and blockchain technology. But that doesn't mean

that every North Korean with a job that may tangentially relate to blockchain technology understands it as fully as some others do. So even the ability to have experts on site in person to bounce ideas off of or ask questions to, it's sort of like if you work remotely and you get in the same room as the rest of your team, there's a lot of value there, right? To be able to ask those questions and bounce those ideas off. So, I don't have a perspective or a viewpoint on whether what he did was right or wrong, but I do think that North Korea could have derived some value from his interactions. And you're saying that because

of how people were saying that the information he was giving was already public on the internet? Yeah, I think, I mean, the other half of that is like, you know, as we sort of spent much of our time talking about is like, most North Koreans don't have access to the internet. So they can't just Google something that they're having a problem with. You know, they don't have that ability, right? And especially some of the mid-level people, you know, that might be attending these conferences, don't have the ability just to hop on a computer and look anything up. So it'd be this idea of being able to ask, troubleshoot, bounce ideas, even to the extent that the foreign visitors may not really think what they're contributing is of value. There's no question that North Korea would not allow these

experts in if what they were contributing was not of value. Yeah. And when you say that, you mean the regime, not the everyday people. Right. There's arguments back and forth, but I think from the research and scholarly community, there's widespread agreement that the North Korean government controls visitors who come in and out. They approve visas and they're widely scrutinized any visitor who wants to come into the country. If it's not to the benefit of the Kim regime to allow this visitor into the country, they are not allowed. Yeah. Given everything that you have researched about North Korea's usage of cryptocurrency and also knowing,

you know, in general, kind of sort of the wider geopolitical things going on with, you know, the regime trying to maintain power and its pursuit of nuclear weapons, etc. Do you think there's any point in maybe like trying either to prevent North Korea from benefiting in cryptocurrency? Or is there just like anything that can be done to, you know, because I mean, I think in general, a lot of people would not say it's a great thing for them to have more nuclear weapons, you know, except for those few hundred people maybe that are accessing the internet from North Korea. So, you know, I'm curious if you have any thoughts on whether that can be done and if so, how? Yeah, sure. So, you know, the first is on the idea of sanctions and financial controls. For the most part, you know, most of the

international and the US sanctions have focused on territorial North Korea and on traditional means of revenue generation, right, or trade. So, for example, prohibitions against trading coal, right, or oil with North Korea, focused on North Korean companies that are tied physically, right, to North Korea. And I think what know, we in the research community have learned over the past, you know, several years is that much of the revenue that the Kim regime does generate is not tied to these sort of traditional means of generation. And, you know, that this, the internet is a much bigger tool, right, for a number of ways, cryptocurrency is one of them, than really governments realize and are equipped to deal with at this point. So

one, you know, either updating, right, the scope of sanctions or UN resolutions to allow countries or the UN or the financial system to bring these into the 21st century, track cyber operations, understand the cryptocurrency system. On the cryptocurrency side, there are attempts in a number of countries to instill some more regulation, like know your customer laws, for example. And that's something that would certainly help drive or maybe shine a light on North Korea and their use of cryptocurrency, but also sort of the criminal element in cryptocurrency broadly. Yeah, I wonder what this section of

the show is gonna, what reaction this is gonna elicit on Twitter because There's definitely the cypherpunk element where they're going to be like, what? You suggested more KYC, more AML. Right, right, right. Yeah. I mean, like this is my position as a researcher who studies North Korea and who really, that's just one perspective. They can hate it or love it, but my interest is in outing North Korea and making sure the Kim regime doesn't continue to bring in hundreds of millions of dollars a year to repress its people and, you know, fund a ballistic missile program. Yeah.

Yeah. And, and for sure. I mean, and, you know, and I interview a lot of, I interview a lot of people on both sides, you know, they're obviously the companies that are working exactly in that area. Um, you know, many of them are my sources and, you know, I talk to them a lot. So, and so there is that group in the crypto community as well. So last question, because of those types of people who I have listening to my show, you know, cryptocurrency investors and developers and builders of startups and other general enthusiasts, for people who are interested in using such skills to help the situation in North Korea, what would you suggest they do? That's a great question.

I think for the most part, most of these blockchain technologies are not aware of North Korean interests or usage, right? Most of the people who run them or develop them or use them are not aware. So certainly there are some basic things that you can do if you're interested in like the technology perspective and just these really low level things. Like for example, if you have blockchain updates, or if you run a blockchain company and there are connections to your resources from North Korean IP range, you can block those. Because as we said, for the most part, those will be the most elite, the most senior leaders in North

Korea, not the people that we're trying to help, but the people who are actually trying to circumvent financial controls and support the missile program. So there's some basic technological blocks that you can institute. And certainly understanding who your user base is, right, to the extent that you can. I think that those are sort of the only ways to get around it. All right, great. Well, where can people learn more about you and Recorded Future? Sure. So we publish most of our research at blog.recordedfuture.com. We've got another report coming out shortly on North Korea. So come check it out there. Great. Well, thanks so much for coming on Unchained. Thank you so much for having me. This was

great. Thanks so much for joining us today. To learn more about Priscilla and Recorded Future, check out the show notes inside your podcast player. If you're looking for a fun holiday gift, or if you just really love the show, check out our new merchandise shop at shop.unchainedpodcast.com. Unchained is produced by me, Laura Shin, with help from Factual Recording, Anthony Yoon, Daniel Ness, Josh Durham, and the team at CLK Transcription. Thanks for listening. you