[INTERVIEW] NK's cybercrimes expected to prompt US to bolster crypto rules

An advertisement for Bitcoin is displayed on a street in Hong Kong, Feb. 17, 2022. The European Union's beefed-up cryptocurrency rules got the final approval from member states, May 16, giving the bloc an edge in regulating the freewheeling sector. The European Council adopted the package of rules, known as Markets in Crypto Assets, or MiCA, in the final step of the 27-nation bloc's legislative process. AP-Yonhap

This is the last in a two-part series of interviews with global experts in cryptocurrency investigations and cybersecurity as North Korea's illicit cyber activities represent an alarming new threat for Washington and its two most important East Asian allies, Seoul and Tokyo, amid Pyongyang's development of its nuclear weapons program. _ ED.

Intelligence sharing between Seoul and Washington key to tracing funds, halting money laundering

By Kim Yoo-chul

Last year alone, North Korea is said to have stolen at least $1.7 billion worth of cryptocurrencies, nearly four times more than the amount the Kim Jong-un regime pilfered in 2021, according to Chainalysis, a U.S.-based blockchain analysis firm.

Officials at the White House and security experts in Washington have said the impoverished regime, facing heavy economic sanctions, is clearly turning to cryptocurrency hacking to fund its nuclear weapons program.

Major controversies involving the burgeoning cryptocurrency sector have already caused financial authorities to increase requests for regulation. The EU's recent moves to introduce Markets in Crypto Assets (MiCA) law have been hailed as the world's first set of comprehensive rules aimed at bringing the unregulated crypto markets under supervision.

One of the main points of MiCA is that such a broad digital finance package, better known as the Digital Operational Resilience Act (DORA), is mainly intended to protect the financial services sector from any fraudulent activities and will become law in July of this year, said officials.

Ongoing efforts to regulate crypto markets and the volatile nature of the sector justify accelerated moves by U.S. authorities to focus more on policy initiatives concerning cryptocurrencies.

Amid the rise of the North Korean-backed hacking group, Lazarus, the United Nations Security Council (UNSC) earlier assessed that the North's hacking attacks on major cryptocurrency exchanges were rapidly becoming a valuable source of income for the regime.

FTI Law founder and CEO John Joy

Speaking to The Korea Times, John Joy, founder and chief executive of New York-based FTI Law, said North Korea's growing cybercrimes are becoming a trigger accelerating U.S. moves to bolster its cryptocurrency regulations.

"Putting aside the regulation of cryptocurrency trading for a moment, one of the key issues that the U.S. would want to see regulated, is the use of 'mixers.' The U.S. is likely to crack down on anyone running or using mixers and this is a topic on which I would expect to see a regulation in the not too distant future," Joy, who also has worked in New York and London representing clients before the Securities and Exchange Commission (SEC), the Federal Bureau of Investigation (FBI) and the Department of Justice, said in a recent interview.

"A mixer is a tool that allows the hacker to send the illicit proceeds to a wallet address, and get (almost) the same amount deposited back into another wallet from another address. This allows the hackers to exchange stolen crypto for 'clean' crypto, which hackers can sell on exchanges all over the world," Joy, a commentator on Bloomberg Law, LexisNexis, and an expert on the securities law, added.

According to Joy, mixers also make the transactions "untraceable" giving hackers a "critical tool" to turn stolen proceeds into cash. U.S. authorities have already brought charges against individuals and companies which run mixers and this was apparently motivated by the use of mixers by actors such as the Lazarus Group.

Lazarus Group is an extremely sophisticated hacking group and targets private institutions as well as government and military infrastructure. Regarding questions over the group's preferred tactics for crypto hacking, Joy said, "The group uses tactics such as data theft, monetary heists and even malware as the group is likely not in the business of targeting retail investors. It prefers to target institutional cryptocurrency projects."

USB bitcoin miners are seen at a stand during the Bitcoin Conference 2023, in Miami Beach, Florida, U.S., May 19. Reuters-Yonhap

Citing the Ronin Bridge hack, which involved the theft of $600 million, the CEO added that Lazarus Group usually identifies a high value crypto project and then tries to get access to the computer of a core developer who works on the project.

Joy supports a recent assessment by the top U.S. spy chief Avril Haines showing that North Korea uses money stolen from crypto hacking to finance the regime's nuclear weapons program. The North's nuclear program is extremely expensive and provides no financial return whatsoever for the country.

"Many of the resources needed for the program cannot be obtained locally meaning that they must be purchased internationally. In addition, many of the resources can only be used once, meaning they have to be constantly repurchased. This means that to keep the program running, North Korea needs a constant stream of international currency," the top executive at the company elaborated. FTI Law (www.ftilaw.com/about-us) is New York's only whistleblower law firm which specializes in reporting on corrupt practices in other countries.

But more importantly, the money obtained through cyber theft apparently needs to be converted into other currencies before it can be used.

Sharing intelligence

The U.S. sanctioned cryptocurrency mixers, such as Blender and Tornado Cash, last year with some experts saying those punitive measures have been quite successful. But such cybercrimes are still rampant.

But the tools available today need to be sharpened and upgraded to address theft and money laundering as increased intrusions have exposed the crypto sector as an appealing target for Lazarus.

Joy suggested close collaboration between exchange operators in South Korea and the U.S. to stop hackers from targeting exchanges. Preventive measures, therefore, are even more important given the repeated use of highly-sophisticated techniques.

gettyimagesbank

"I would expect that even without Washington's impetus, South Korean exchanges are likely take measures to ensure that they are not being used as a conduit for North Korean money laundering," Joy said.

"What one would hope is that Washington is sharing intelligence with South Korean exchanges on what wallets and IDs North Korean hackers are using in order to trace funds and shut down the laundering of illicit proceeds. When dealing with major actors such as Lazarus, it will be extremely difficult to stop hacks happening in the first place," the expert said, adding that policies need to be focused on preventing the hackers from laundering and using the proceeds.

In addition, according to Joy, it is crucial for both the U.S. and South Korean governments to work to shut down the use of mixers.

"For all the good that cryptocurrency may be able to offer society, it is hard to justify the use of mixers for almost anything other than the laundering of criminal proceeds and hiding money. These are tools which provide enormous benefits to hackers, but very little benefit to society. As a result, sanctions imposed by Washington on mixers and those who use them should be mirrored in jurisdictions like Seoul who are hoping to assist in fighting cybercrimes," Joy elaborated.

The managing attorney at the law firm said he would hope Binance, the world's largest crypto exchange, is working behind the scenes with Washington to track, trace and shut down the use of illicit funds obtained through hacking.