Lazarus Laundromat

Speaker 1: Somewhere on LinkedIn. CryptoCom is hiring a systems administrator with eight to ten years of experience. CryptoCom is one of the most widely known, used, and trusted cryptocurrency exchanges in Europe. Founded in 2011 with low fees and the best execution prices, you could trade major cryptocurrencies like Bitcoin. So a systems administrator gets this job offer on LinkedIn. They've spent the last five or so years working behind the scenes on the upkeep, configuration, and reliability of a network through which millions of dollars worth of cryptocurrency flows every single day. They're very good at their job, And from time to time, headhunters come knocking. This one is from a competing firm. One of the big ones. And the pay's pretty good. They're reading the job details in a doc file with some weird permissions because it's from Europe when well, you can probably see where this is all going. Because the trouble is, all around the world, in UK, The US, China, Germany, Russia, and South Korea, other systems administrators and other big cryptocurrency exchanges are getting this exact same message with the exact same job offer, with the exact same word doc, with the exact same funky permissions. It's It's a spear phishing attack trying to harvest that Syssteben Mins data so that the hackers can break into the cryptocurrency exchange and steal a bunch of money. Someone is going on a cryptocurrency crime spree and it's working. Lazarus are the people behind this string of attacks. And based on civil forfeiture complaints filed by the US Department of Justice last month, they have stolen over $250,000,000 worth of crypto from over a dozen virtual exchanges. Not just LinkedIn spear phishing attacks, they've gone deep with these things. In 2019, a major cryptocurrency conference was revealed as potentially being just one big honeypot to harvest data. Lazarus operates on a scale and scope rivaled by few other cybercrime operations. Buy now. We're all familiar with the idea of state sponsored hacking for political purposes, surveillance, counterintelligence. We know countries do this and we know the countries that do this. But Lazarus, Lazarus is interesting because they raise this question. What if a country used state sponsored hacking to steal? Like literally stealing money to enrich that country in the same way that other countries steal information for political purposes. This all brings us to North Korea. International econ experts estimate that around 15% of the North Korean foreign earnings come from crime. A lot of it's cybercrime and a lot of that cryptocurrency. And Lazarus, that hacking group, is the North Korean hacking syndicate behind among countless others. The twenty thirteen South Korean cyber attack, the twenty fourteen Sony breach, and the 2017 WannaCry malware that infected over 300,000 devices worldwide. But in the last few years, Lazarus seems to have narrowed their focus from big bold political gestures to this vast but targeted cyber theft operation bringing in hundreds of millions of dollars per year to the North Korean state. To understand Lazarus you need to not just understand their methods but the economic sanctions that depending on who you ask either drive or are justified by all this cyber criminal behavior. But before we get to any of that, we gotta go back to our crypto systems admin who just got spear phished with that sick job offer. We gotta go back to the country that hacked them. Because the question isn't just, how do you steal a couple $100,000,000 in cryptocurrency? The question is, how do you launder it once you've got it? This is Lazarus Laundry, here

Speaker 2: on Hacked.

Speaker 1: So question. Answer. It's a question I ask you a lot. If you had effectively unlimited resources, how would you steal hundreds of millions of dollars worth of cryptocurrency?

Speaker 3: Well, I think if I just looked at how people are stealing hundreds of millions of dollars of cryptocurrency, I would set up a crypto exchange and then just disappear with all of the crypto.

Speaker 1: Oh, you're talking about the abscond with all of the other people's money type thing.

Speaker 3: Yeah. The fake your own death, you know, move to Thailand model.

Speaker 1: Yeah. It's a pretty good one. It's been working for a pyramid scheme kinda set up.

Speaker 3: I feel like there's, like, you know, 10 BBC articles about people that have done that. You know, $200,000,000 in cryptocurrency goes missing and founders' whereabouts unknown. Talk about a Madoff. Yeah. Kind of. A little. It's more of just like straight up theft where like Bernie Madoff is a like a proper, you know, fraudulent scam.

Speaker 1: Sure. This is just give me your money and then I'll I will just flee with it.

Speaker 3: Yeah. Eventually, I will just have so much that I won't be able to I feel like crypto attracts certain types of people. And if you're listening to this and you're one of those people, don't take offense to this. But I feel like crypto is just like drugs.

Speaker 1: Mhmm.

Speaker 3: And

Speaker 1: I

Speaker 3: don't think the people that do drugs frequently have a lot of self control, and I feel the same way about people that trade crypto.

Speaker 1: Mhmm.

Speaker 3: So, eventually, the people that are in crypto businesses, when you have that much drugs, it's hard to say no to just taking them all. You know what I'm saying? Mhmm. It's a weird weird analogy, but but I think you get the picture.

Speaker 1: No. No. It attracts. So you're saying that your first your first approach to this would be, is there a way to get people to just consent, like consentingly give it to me and then take it for myself?

Speaker 3: Yeah. Quote, unquote, lose it. Get hacked. Whoops. And then I guess, you know, if you wanted a lot of it, instead of quantity over quality, maybe go quality over quantity. You know, you could target the exchanges. You can set up your own exchange and just leave, or you can steal from other exchanges. You know, places where it's like a bank heist. You know, an exchange has a lot of it on hand, and if you can get access to it, you can take a lot of it. You know, if I can spend my days cracking Jordan Blumman's Bitcoin wallet, I might get, you know, 28 US dollars worth. But if I can get into a massive exchanges, you know, accounts, I probably can get millions of dollars worth.

Speaker 1: Is that how you would go about doing it if you had, like, your level of resources or effectively unlimited resources, if you had a nation's worth of resources to throw at the problem?

Speaker 3: Yeah. You know, if you've got teams of of, you know, hackers, quote, unquote unethical hackers, who work for you, yeah, why not just steal it? You can do quantity over quality and quality over quantity. You can do it all. So what do

Speaker 1: you do once you have it, though?

Speaker 3: Fake your own death and move to Thailand.

Speaker 1: North Korea faked its own death and moved to Thailand.

Speaker 3: I think they did that recently, didn't they? Not moving to Thailand, but the whole faking your own death thing, I think, came up.

Speaker 1: Quality over quantity, quantity over quality. According to a report published by the UN, it is estimated that cyberattacks have earned North Korea somewhere around 2,000,000,000 US over the last three years. Money that has largely gone towards nuclear and ballistic missile programs. We're gonna talk about that a little bit more later. Cybercriminals on the Pyongyang payroll have launched attacks going after two big buckets of potential revenue. The first is crypto, which as Scott just explained means going primarily after crypto exchanges, that kind of quality over quantity approach. You see, even with vast man hour resources, it doesn't really make a ton of sense to go after individual wallet holders when similar targeted attacks against admins on exchanges have potentially way greater yields. Overall, between 2017 and 2018, at least 571,000,000 was stolen in the hacking of five cryptocurrency trading platforms. So, you got north of half 1,000,000,000 crypto. How do you launder it?

Speaker 3: If I'm a nation that has a pile of stolen digital currency, what am I gonna do with it? That's a great question. You need to turn it into real money at some point so that you can, you know, acquire things on an on the international stage, weapons, equipment, infrastructure. I'm not sure how you would launder money at that scale.

Speaker 1: I'm gonna tell you all about that, Scott. Perfect. Thanks, Jordan. As Scott said

Speaker 3: You need to turn it into real money at some point. To explain how

Speaker 1: to do that, I'm gonna have to do the one thing I promised myself I was never gonna do on this show or in life and that is explaining what blockchain is. But these are unprecedented times. So, a blockchain is essentially a chain of blocks containing information. The term was coined by researchers in 1991 largely unused until Satoshi Nakamoto adapted it in 2009 to create the cryptocurrency Bitcoin. Without getting into the weeds of what's contained inside of that block, which for those who are interested is a little bit of data, a hash for verification, the hash of the previous block, to understand the blockchain in the context of cryptocurrency, really all you gotta do is think of it like a public document recording which wallets Bitcoin is moving from and to. It's a ledger. It's public and close to mathematically impossible to falsify. If a Bitcoin gets moved from one place to another, it is visible, which makes laundering Bitcoin pretty tough.

Speaker 3: You need to turn it into real money at some point.

Speaker 1: So how does North Korea do it? How on a ledger that is engineered to be public do they turn hundreds of millions of dollars worth of Bitcoin into dollars, pounds, euros, or yuan? A brief aside before I dive into a lot. I find cryptocurrency really interesting, but I'm not what I would call a crypto guy. And I have a feeling there might be some crypto people listening to this. I'm going off research, not experience, but I do love being told that I'm wrong. So if you catch me confusing a concept, do not hesitate to reach out on Twitter at hacked podcast. Let's get down to it. Tactic one, peel chain. Our first laundering tactic called appeal chain is where to disguise the origin and destination of your stolen cryptocurrency, you move that coin in rapid automated transactions from one wallet to another, hundreds if not thousands of times. So, say you steal some crypto, the theft of which is publicly recorded on the ledger, which your victim can see. To hide it, you start bouncing that coin insanely fast, automation fast, so many times between so many wallets in so many different places that it's basically impossible to keep track. Now, this is kind of intuitive, but as many of you may noticed, in order to do this you need hundreds if not thousands of accounts across which you can bounce, which isn't really a small operation. Either need to be a country that can recruit an army of hackers or you gotta use something called a mixing service, also known as a tumbler. According to a very long and very technical research paper called An Analysis of Bitcoin Laundry Services, quote, Bitcoin laundry services are open, like most modern technologies, to dual use. They are employed by regular users who do not engage in any illicit activity and simply want to improve on the anonymity features of Bitcoin. On the other hand, they can also be used by cyber criminals for laundering ill gotten gains before exchanging them into traditional currencies such as dollars, euros, or sterling. It is common for stolen Bitcoin and for ransom money to be processed by one or multiple tumblers to reduce its traceability. In either scenario, Bitcoin laundry services play a central role in the Bitcoin economy, but they've been relatively poorly studied, and their operation is not well understood. End quote. Some bargain basement, tumblers include Darklaunder, Bitlaunder, and Coinmixer. The kind of bigger players accessible via Tor include Alphabay and Helix, but the report really importantly concludes that almost all of them have some pretty big security issues relating to either user privacy or coin safety. And when they typically make their money by say taking one or 2% of all transactions, if you are a state sponsored hacking group trying to launder 500,000,000 in crypto, you are peel chaining by hand. Tactic number two, chain hopping. Let's imagine you are trying to launder old school currency, American dollars. Option number one is traditional money laundering, which is kind of a lot like the last tactic, peel chaining. You're really just obscuring the nature of those American dollars by obscuring their origin. But say you could turn those American dollars into a different currency altogether. Say you could turn it into pounds or gold or real estate, which you could then convert back into whatever currency you wanted to use totally clean. This is chain hopping. Instead of moving between currencies you move between blockchains, which is to say different cryptocurrencies. The stolen Bitcoin is converted into a different crypto, typically a less visible, more anonymous, arguably murkier option like Monero, Dash, or Zcash. Hop between enough different blockchains, enough times, and the trail goes cold. So congratulations, you've laundered $500,000,000 in cryptocurrency. You've got good clean internationally recognized fiat currency you can use to fund ballistic missile programs all dang day. But if you remember a little bit earlier, it is estimated that cyber attacks have earned North Korea somewhere around 2,000,000,000 US over the last three years. 500,000,000 in crypto is kinda just a drop in a $2,000,000,000 bucket. So where does the rest of that money come from? What do you do with it? We'll get to that after this break. Starting something new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10 of all e commerce in The US. From household names like, well, hacked podcasts merch to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button is used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, or getting abandoned in the parking lot and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 4: No one goes to Hank's for spreadsheets. They go for a darn good pizza. Lately though, the shop's been quiet, so Hank decides to bring back the $1 slice. He asks Copilot in Microsoft Excel to look at his sales and costs and help him see if he can afford it. Copilot shows Hank where the money's going and which little extras make the dollar slice work. Now Hank's has a line out the door. Hank makes the pizza. CoPilot handles the spreadsheets. Learn more at m365copilot.com/work.

Speaker 5: Well, compared to Singapore, Bangladesh's handling of its finances has become news fodder, especially now that some hackers were able to steal $81,000,000 from the country's central bank.

Speaker 3: Well, should we just talk about how governments make money?

Speaker 1: How do governments make money?

Speaker 3: Taxes. Literally, like, the only major source of income, taxes, fines, I guess. You know, there's a bunch of surcharges, things like that. You know, your car registration costs so much. But those are mostly cost recouping. But the bulk of a nation's cash comes from tax base. So, you know, private businesses, publicly traded businesses, obviously public employees, people that work for the government, cost the government money, where private employees get paid, and a portion of their income, you know, goes to the government, which then becomes general revenue to pay for government employees. So, taxes generally constitute most things. Obviously, the more successful your economy is, the bigger your business is, the more people get employed. All of those things generate more tax revenue. So most money comes from taxes.

Speaker 1: Which is tricky in a country like North Korea.

Speaker 3: Yes. That has probably very, very, very low international exports. So that's another big thing about getting money into an economy is the higher your exports are versus your imports, the difference there. You know, you probably heard Trump complaining about it in the last election. The more exports you do, the imports is essentially a net gain for your economy. So that's a big key thing. And as a country like North Korea, we'll probably who has one trading partner? China? I might be wrong on that. But I'm pretty sure they have one trading partner. Probably has very little export. I don't know a single product that anyone can buy in the world that's from North Korea.

Speaker 1: The answer to my earlier question, as to where the other 1,500,000,000 in cybercrime revenue comes from, it's pretty obvious. If not cryptocurrency, it must be normal currency stolen from the normal place we normally keep it. Banks. Banks all over the world targeted by the hackers in Lazarus and Bureau one twenty one, a part of the Reconnaissance General Bureau of North Korea's military, essentially the in house alternative to the arm's length Lazarus. Over the last couple years, all of these different groups of hackers all under the umbrella of North Korea, have aimed their crosshairs at a core system in international business called the Society for Worldwide Interbank Financial Telecommunication or SWIFT. This system, SWIFT, has been around since the nineteen seventies. It's used in 11,000 financial institutions in more than 200 different countries to process tens of millions of dollars of transactions per day. This, purportedly, is how North Korea managed to steal all of that money from Bangladesh mentioned in the clip at the start of the section. This is how they've managed to steal 1,500,000,000 from banks around the world over the last five years. It wouldn't really be worth talking about how they launder that money because it's normal money. So the answer is money laundering. But then, like, a week before this episode came out, hoo boy, did some shit pop off in the world of normal money laundering. And wouldn't you know it, North Korea is right there in the middle of it.

Speaker 6: A leak of US Treasury documents has linked Australian banks to billions of dollars in suspected money laundering. The big four and several other Australian banks are mentioned in hundreds of of times in the documents dubbed the Finzen files. Shared by the international consortium of investigative journalists, the documents detail money flows worth over 2 and a half trillion dollars suspected of being the proceeds of crime or corruption.

Speaker 1: That was from Australia's ABC News, hence the focus on Australia's banks. But, essentially, 09/21/2500 leaked documents, most of which were exchanged between banks and The US authorities over a seventeen year stretch, revealed some pretty startling insights into how criminal organizations launder money through banks. The most startling or at least startling depending on how numb the current state of the world has you feeling is how aware banks are when they're being used to launder money, and how very cool with it they are if it's enough money. HSBC allowed criminals to move millions of dollars of stolen money around the world even after it had learned from US investigators that it was a scam. JPMorgan allowed a company to move more than 1,000,000,000 through a London account without having any idea who owned it, but most importantly for our purposes. The FinCEN docs revealed that North Korea carried out an elaborate money laundering scheme for years using a string of shell companies, with help from Chinese companies, moving money through prominent banks in The US. The answer to the question of how North Korea launders money is by putting it in the same bank you use. Banks like banks in Luxembourg?

Speaker 3: I think that that's, you know, that's just, you know, sad reality. That's how a lot of corporations operate. And I guess you could look at the North Korean government as a form of corporation or at least their their theft. They're trying to reduce, essentially, when the whole I don't know if you remember, would have been about six years ago, somebody from, I believe it was PWC in Luxembourg leaked they were negotiating private taxation deals with the Luxembourg government on behalf of major corporations. And, essentially, if you headquartered, moved your money into Luxembourg, giving them a higher economy and all the rest of this jazz, they would essentially sign a sole tax agreement for IKEA. So IKEA would have its own tax act that was drafted and negotiated, which is something you don't see anywhere, really. But if you're a company that's as large as IKEA and has operations in every business or sorry, in every country, you know, reducing your global taxation becomes a huge part of it. You know? Some jurisdictions are tax friendly, some are not. That's why you see states like, you know, Delaware. Delaware is a state. Right? Yeah. We're Canadian. That have these, you know, economic incentives to try and bring head offices there because they they want those businesses to relocate into their jurisdictions so that they get increased tax revenue, but to bait them in, they'll reduce their taxation rate. You know? So it's the fact that taxes are now a market, market negotiated thing, your tax rate, is a really bad thing for societies in my mind, because what you're seeing is is even though a business can operate in a in a jurisdiction, access its commodities, take out its revenue, it will still pay employees there, which will then feed the local tax system, but the larger corporate taxation will, you know, quickly be shuffled off and moved somewhere else where there's a lower tax rate.

Speaker 1: Mhmm.

Speaker 3: And And then if you wanna talk about, like, headquartering offices, why would you put your headquarter of your business in a place that had a 35% corporate tax when you could put it somewhere that has a 2% corporate tax? Mhmm. And it's like, you know, that becomes a market factor that corporations have to take into consideration to deliver the highest value to their shareholders. And then boom. You've got crazy tax acts in Luxembourg.

Speaker 1: Yeah. And if a bank will move those kinds of mountains to reduce, the tax burden on a corporation's, gains, why wouldn't they do the same thing for our countries? I guess, regardless of how that corporation or country got it.

Speaker 3: Yeah. They're gonna charge fees and do all kinds of things that make sure that it's in their best interest because they're looking out for their shareholders and their employees and, you know, their their profits.

Speaker 1: We've been zooming out throughout this episode. Right? Like, first, we chatted about how North Korea engages in cybercrime to steal and launder cryptocurrency, then how they engage in cybercrime to steal and launder normal currency. And And I think it makes sense to conclude on the bird's eye with the kind of highest elevation, how North Korea engages in all form of crime outside the bounds of cyber space and why they do it. Because cybercrime, all 2,000,000,000 of it, is again just a drop in an even larger bucket. Especially when you end up looking at all the money that ends up flowing through that laundromat they've engineered in conjunction with the legitimate banks around the world outlined in the FinCEN documents. North Korea makes a lot of its money through crime. They've been making cash over fist counterfeiting other countries' currencies since, like, the nineteen seventies. Between '77 and 2003, more than 20 North Korean diplomats, agents, and trade officials have been implicated, detained, or arrested in drug smuggling operations, mostly amphetamines and opiates produced in the country with the knowledge of the government. We've got human trafficking. We've got counterfeit pharmaceuticals and drugs and arms trading. And here's the thing. Countries do illegal shit for profit all the time. It was novel at the start of the episode when we were talking about cybercrime specifically, but as I said, zoom up far enough and the lines start to get blurry. What's relevant here is just how much North Korea does it, to the point that it's one of their chief exports. And with just how effective cybercrime is proving for them, how likely they're to do it more and more and more. The question all of this brings us to is why? And the short answer is sanctions, and the behavior that those sanctions resulted from. Push someone far enough into a corner, this is what they do. But that doesn't really capture the entire picture.

Speaker 3: I think the other big difference for North Korea is that, you know, being that they are the friendless kid on the playground, there's not a lot of aid flying their way. Where other countries who might start starving probably still have other friends who will feed them. And, you know, I think that there's just given current situations and stuff, I think there's a pretty good, global understanding that there's gonna have to be a lot of give and take between different places and geographies and stuff. We haven't seen a ton of it yet, so hopefully we do. But, I think North Korea is in kind of a world of their own. You know, North Korea essentially has no friends. They have no trade partners. They have no economic activity. They probably have very little exports. They're in a unique situation where everybody hates them already. Why would they care? You're not gonna see the United States government start stealing cryptocurrency from other countries because they wanna keep the world somewhat in order. They need to keep trade up. They need to keep those exports coming from America to other countries, and sanctions will quickly limit those. So with North Korea, when you've already got it sanctioned up, like, really, I guess a better parallel to this is, like, you know, is North Korea stealing bread to eat? Do you

Speaker 1: have nothing to lose and something maybe to gain?

Speaker 3: Yeah. They're not, you know, they're not an economic superpower. They're not even an economic power. And they're essentially starving, literally. So I I think the more powerful essentially, what I'm saying is if you're privileged enough to be powerful, you can get away with a lot more, And North Korea is not very privileged.

Speaker 1: Why stow cryptocurrency when you can steal land? Exactly.

Speaker 3: Or whatever you want. Steal elections.

Speaker 1: Yeah. We got a country that did some stuff that pissed everybody off, so so everybody puts sanctions on them. So they get really, really desperate because there's sanctions on them, so they start doing worse stuff so we put more sanctions on them. Sure.

Speaker 3: It's just like yeah. It's a prison loop. Yeah.

Speaker 1: It's a prison loop. A 100%. Yeah.

Speaker 3: North Korea is a lifetime offender who can't break the cycle.

Speaker 1: Thanks for listening, everybody. If you like the show, show your love on Patreon, patreon.com/hackedpodcast or get in touch on Twitter at hacked podcast. It's been a pretty crazy time here in the studio with some different projects, so there's a lot of me chitchat in this one. Tried to keep it pretty focused research wise, but we did end up covering a pretty unwieldy set of topics, try to get into all the stuff we thought was interesting about this story. Hope you learned something. Thanks as always for listening. And thank you to our new patrons in September. I'm talking about you Sean McNeil. Talking about you Christian Lassen. Talking about you Zarin Stone. Fucking great name Zarin. Talking about you Zach Bennett. What a bunch of cool people. Thanks for listening. And as always, be sure to share the show.

Speaker 3: Catch you

Speaker 1: in the next one.

Speaker 2: Ryan Reynolds here from Mint Mobile with a message for everyone paying big wireless way too much. Please, for the love of everything good in this world, stop. With Mint, you can get premium wireless for just $15 a month. Of course, if you enjoy overpaying, no judgments, but that's weird. Okay. One judgment. Anyway, give it a try at mintmobile.com/switch.

Speaker 7: A Upfront payment of $45 for three month plan, equivalent to $15 per month required. Intro rate first three months only, then full price plan options available. Taxes and fees extra. See full terms at mintmobile.com.

Speaker 8: Athletic Brewing Company crafts award winning nonalcoholic beers for those who wanna be part of every round. With over 185 flavor awards, they're exceptional NA beers that fit your lifestyle and any social occasion. Summer's full of good times and athletic fits right in. Go to athleticbrewing.com to have brews delivered to your door or find them at a bar, restaurant, or store near you. Near beer, athletic brewing company, fit for all times.

Speaker 9: Still waiting in line? Again? That's time you'll never get back. Save time and money with stamps.com. Over 4,000,000 businesses have skipped the line with stamps.com. Join them to save up to 90% off carrier rates from your computer or phone right now. Print postage for certified mail, registered mail, and packages in seconds, then schedule a pickup right from your home or office. For a limited time, go to stamps.com and use code podcast for a free welcome gift. Taxes and fees apply.