Hackers stole billions in crypto to keep North Korea’s regime afloat

1 day ago (wsj.com)

If cryptocurrencies are self-regulating, aren’t the techniques used by these hackers actually the best and most effective way to play the game by its own rules? Calling this behavior “cheating” smells of sore-loserism.

  • There is a certain Bitcoin evangelist who will preach the gospel of a self governing currency that via a system of rules will automatically validate transactions between trust-less parties in a decentralized manner over a globe-spanning internet protocol but then complain when that same system does not prevent them from accidentally sending the entire contents of their "wallet" to an address in North Korea.

    The system does not represent ownership the system only tracks of the validity of transactions and if the North Korean government proposes a valid transaction of your BTC or ETH to an address they control and a mining-node includes that transaction in a block which a majority of the network accepts then those assets are no longer yours they belong to North Korea.

    The properties of the crypto-asset ecosystem which allow it to be ungoverned also make it ungovernable.

    • I would imagine exchanges these days routinely monitor incoming and outgoing transactions, and if they suspect the funds are stolen, they are freezed. I would imagine North Korea doesn't have really an easy job laundering that BTC they have stolen.

      7 replies →

  • "The shocking theft at WazirX, India’s largest cryptocurrency exchange..."

    Oddly I am not in the least bit shocked. Now if we found out that this was an inside job I would again not be the least bit shocked.

  • It appears crypto is just speed-running the last few hundred years on their way to modern financial regulation

  • These are but pricey bug bounties. This will lead to a more efficient and secure cryptocurrency market, as participants will insist on better financial controls, threatening to flee to the regulated fiat markets if their needs are not met. /s

    • > These are but pricey bug bounties.

      This isn't sarcasm to me, but the rest of your comment is.

This is the only promise that cryptocurrency held. Avoid government barriers. So we should celebrate the fact that it was not a complete scam.

  • I disagree. There's a tremendous amount of waste in the economy related to reconciling different companies' records of who owes what to whom and then getting that info to the bank and then hearing back from the bank about whether the debt was fully or partially paid and then relating that to whether the service continues to be rendered.

    Moving from an accounts-receivable/accounts-payable model to a insert-coin-receive-service model would be a huge advantage.

    It just hasn't happened because the vibes are wrong and it appears that they'll stay wrong for a while.

    • > There's a tremendous amount of waste in the economy related to reconciling different companies' records of who owes what to whom and then getting that info to the bank and then hearing back from the bank about whether the debt was fully or partially paid and then relating that to whether the service continues to be rendered.

      Is all that really a tremendous waste, in the days of databases and instant communication? How much waste are we talking about here? I'd wager a lot of money it's at least one order of magnitude less than the literal heat waste produced by validating bitcoin transactions. Crypto is much more wasteful.

      > Moving from an accounts-receivable/accounts-payable model to a insert-coin-receive-service model

      The monetary system isn't what's preventing this. You can't provide a service and also charge for it in the exact same instant. If I hire a contractor to renovate my bathroom, there's a ton of negotiation, possible disagreements about whether the work is "done" or not, payment deadlines, etc., and crypto vs. fiat currency changes none of that.

      3 replies →

    • >Moving from an accounts-receivable/accounts-payable model to a insert-coin-receive-service model would be a huge advantage.

      Why would the method of payment affect how you track accounts payable/receivable in your books?

      1 reply →

    • i agree smart contracts are the way forward, but you don’t need crypto or blockchain to implement them. You do need a trusted third party, to adjudicate when things go wrong.

      7 replies →

    • > It just hasn't happened because the vibes are wrong and it appears that they'll stay wrong for a while.

      No. A civil society needs to be able to issue judgments that override transactions / seize assets. And therefore they cannot have automatons determining where the assets belong.

      When criminals are caught with their hand in the cookie jar, we can't just shrug and say "gee I wish we had a way to get that money back."

      I'm a big fan of bitcoin and to some extent cryptocurrency. I think it has real value. But I'm not deluded enough to think it can somehow replace all ledgers everywhere.

      1 reply →

  • And pretty unique online irreversible near instant transactions. For this reason it was often the cheapest way to buy bullion online in a way that cleared in less than an hour, since most banks charge for a wire and credit cards (or vendor risk departments) charge high vendor premiums on bullion transactions.

> Hackers then send the ether to “mixers”—crypto platforms that co-mingle tokens from various users, obscuring their ownership. After that, the ether is swapped for bitcoin and then converted into tether, a token whose value is linked to the U.S. dollar.

Good timing for the US to lift sanctions on Tornado Cash [0].

Too many people think "lock them up" is the solution to crime, without considering that crime relies on certain types of infrastructure to remain in business. And that people who are "tough on crime" often have good reasons to keep operational the things that facilitate said crimes.

[0] https://home.treasury.gov/news/press-releases/sb0057

  • North Korea launders its stolen cryptocurrency through every available means. Including Tornado Cash, quite aggressively, which is why they were sanctioned. It is very hard to understand why the Trump administration would reverse those sanctions unless they are trying to aid this kind of money laundering.

  • adding sanctions to a smart contract address that cannot appeal itself was not a winning position in the US courts

    and determing that a smart contract deployment was a "foreign asset" was also not a winning position in the US courts, as its not clear if it was deployed on a node outside of the US to begin with, or if the person that actually sent the deployment transaction was a non-US citizen

    The Treasury with its new head just short circuited that challenge and stopped wasting taxpayer money on this

    yeah, stick with prosecuting the actual crime instead of the laziest approach of calling everyone a criminal for using a sanctioned smart contract

Why are North Korean hackers so skilled? Are their technical skills top-tier?

  • They work for a government that can help with the threats, bribery and social engineering required to get access to employees of exchanges.

The issue of cybersecurity in crypto is becoming more critical by the day. The scale at which nation-state actors are targeting the crypto world shows just how vulnerable many systems still are.

Before there was crypto North Korea stole 1000 Volvo cars from Sweden. They simply ordered them and never payed.

It's pretty incredible that a sizable percentage of North Korea's GDP derives from crypto theft. Actually about the same percentage as Spain was pulling from the Americas at the end of the colonial period.

Something tells me that WazirX's cold wallet wasn't actually cold - it was multisig but hot. The only thing that leaves the hardware running a cold wallet is a signed transaction that is limited in scope to the signed amount and recipient.

I thought this was one of crypto's primary use cases? A kind of "anything goes, anything you can get away with is allowed" sort of approach.

  • Sure, in the same way that a primary use case of cash is that somebody can punch you in the face and take your money and whatever you can get away with is allowed.

    • The primary use of cash is to buy goods and services. That's not the primary use of crypto. The primary use of crypto, as far as I can tell, is to try to make money appear out of thin air whether via speculation or fraud. And, admittedly, to occasionally buy JPGs.

Kim Jong Un's keys: Kim Jong Un's coins.

Blockchain is a perfect, transparent trustless global ledger that can't be hacked, so it's a misnomer to characterise these transactions as "cheating", "crimes" or "theft".

  • If you unlawfully or immorally gain access to information, such as my private keys, and then use that information to move money, you have absolutely committed a crime, cheated, and/or stolen from me.

    If you deceive me into executing a transaction voluntarily by misrepresenting the destination (which is immoral and often illegal), you have absolutely committed a crime, cheated, and/or stolen from me.

    • I'm sorry, on the Blockchain we don't recognize legacy concepts like dead-tree nation state laws or ancient superstitions purporting to define morality. The future is all about registering ownership information in digital ledgers.

      If you wanted to retain control of your keys, you should have encoded them in a secure, nonfungible image of monkey on the Ethereum Blockchain. That way, everyone would know those keys belonged to you.

    • What laws are a North Korean subject to that they have broken? Who decides when a transaction was cheating or stealing without a central authority and enforcer?

      1 reply →

    • To add to the other comments: do you really have a right to whatever it is that the bits unlocked by that key represent? Who granted you that? AFAICT, it's the systems running the blockchain that grants you that, and it's not governed by any contract outside the blockchain.

      1 reply →

    • What NK hackers are alleged to have done here is fraud, something that the US head of state has been convicted of, by courts in his own country. NK on the other hand, has not been tried nor convicted.

      What possible legitimacy does the US even have to mark others as "thieves"?

      2 replies →

    • Don't crypto advocates claim it needs nothing at all from government?

      What's the basis of unlawful? What contract is controlling these concepts and their adjudication?

When i look around at all the positive innovations cryptocurrency has failed to deliver, it really does seem like they invented a currency exclusively useful for doing crimes.

  • I got into bitcoin around 2011ish for some time. I was never a True Believer but I was a 'soft believer'. At the time, when people asked me if Bitcoin is the future I would always say "I think it or something like it will be very useful". Fast forward 10 years and there's been no actual use of crypto. No killer app. No disrupting the finance world. It seems to be used exclusively by smart people as a means of extracting wealth from people who don't understand it.

    • We built useful, legitimate services off crypto (think paying people out for doing work online). But the regulation became insurmountable.

      I will admit however, almost everyone "interested" in crypto has never made a transaction.

      1 reply →

    • > It seems to be used exclusively by smart people as a means of extracting wealth from people who don't understand it.

      How is that any different from other financial markets? A fool and his money are easily parted, while targeting desperate people with get rich quick schemes are also an easy play. The crypto/stocks/etc are just different tools to achieve the same result.

      1 reply →

    • > It seems to be used exclusively by smart people as a means of extracting wealth from people who don't understand it.

      I'm all for an era of crypto feudalists

    • The killer app is crime. Old scams have flourished. Entire new forms of scam have been invented. Crypto currency has been a game changer for criminal organizations.

    • > Fast forward 10 years and there's been no actual use of crypto. No killer app. No disrupting the finance world.

      Just today I answered call on my mom's phone from unknown number. Regarding payout from blockchain investment account. Not the killer app and disruption we deserve, but the only one we got.

  • My pet theory is some government agency created bitcoin for one of two reasons:

    Tracking financial transactions (open ledger).

    Funding dark ops.

    The whole Natoshi riding into the sunset after bitcoin booms, like an old Western movie, is not very plausible IMHO.

    • It is certainly odd there's been nothing from the inventors not even using the vast wealth they have squirreled away. The alternative which is honestly kind of funny is that they lost their keys so can't access the coins and thus coming forward as the inventor would just put a target on their back for people who might want to steal their keys.

      3 replies →

  • Obviously - if you are doing things that are legal - you have no need for Crypto.

    Now, I think some crypto people will argue that there are many good and ethical things you could do which are illegal that you now can do with crypto.

    However, all none of those things are happening. All that is happening is speculation and unethical crime.

  • The only obvious mainstream "success" to come out of crypto is stable coins (Tether/Bitfinex is something like the 5th or 6th largest buyer of US treasuries ...and amusingly keeps all the yield from them). Ironically, this use case also happens to be one that doesn't really require a decentralised ledger (would work equally well with a few cross-border validators, ala DNS root server approach) and lends itself very well to tradfi involvement (since you need pegging to fiat).

    For me crypto today looks like ~1998/~2000 ish internet. Big, powerful traditional entities have fully woken up to it and will now take it over and ensure whatever useful use cases exist will be controlled by them with profits also accruing to them. The speculative, lawless days of the crypto wild west (fuelled by oceans of QE & stimmy money); and promises of a satoshi enabled future are well and truly over.

    In terms of ushering in a new decentralised monetary order, it has failed completely.

  • This is so incredibly ill-informed it's hard to respond to. Thanksfully, it's incumbent on the person making the extraordinary claim...

    > currency exclusively used for doing crimes

    ... to provide extraordinary evidence.

    On my end, my home is financed by a trust-minimized loan against my BTC, using a stablecoin. And I greatly prefer stablecoins to wires for paying international vendors.

  • And how much money was made off of companies that were created to support cryptocurrencies?

    Does anyone around here know of any?

    Bueller?

  • I’ve never see a “good” crypto millionaire/billionaire.

    They’re always a smug racist/sexist/misogynist/ablist tech bro with fucked up visions of the future.

    • Hm, is that perhaps how you feel about all billionaires? Can you name one you think is "good"?

      I've made some money in the space, have kids and a family, and care deeply about special needs and access (partner is a former SpEd teacher, I've volunteered and donate to related causes), and have invested heavily in reproductive rights. Does that make me "good"?

      In my experience, and by my values, there are plenty of good and neutral people in the space. They aren't often the ones that ham it up for the media, but it should be obvious why that is.

      1 reply →

Apparently the title of this story changed at The WSJ. That word "Cheat" seems wrong, while the old title makes more sense.

  "How Hackers Stole Billions in Crypto to Keep North Korea’s Regime Afloat"

The archive link from the @Bostonian comment below has the original I guess: https://archive.is/1vkXG

Super skeptical of all hacking attribution claims made by MSM.

  • I've been skeptical ever since they were trying to claim the xz backdoor was from a state actor. All it took was 3 sockpuppet accounts, a lot of time and actual code contributions, something literally anybody with a computer science degree can do. Name: Jia Tan? Must be a CCP agent, never mind the fact that anybody can make their name and timezones anything...

Extraordinary claims with no way to verify, typical for WSJ. Now the question is which group benefits from policies aimed to combat this? Follow the money to see who misleads you …

  • Who benefits from policies aimed to combat this? Western society.

    • Nobody in western society benefits from KYC laws, they make life hard for small business and destroy financial privacy while the big players get away with a slap on the wrist. There's absolutely zero empirical evidence of KYC leading to a reduction in the rate of any kind of crime.

      1 reply →