US pursues North Korea in crypto war games

Hello and welcome to the latest edition of the Cryptofinance newsletter. Today we’re taking a look at North Korea’s activity in crypto markets.

North Korea is often portrayed as a backward, economically stunted state, but if you believe US allegations it has a pretty sophisticated understanding of the crypto markets.

This week the US Federal Bureau of Investigation said Lazarus Group — a North Korea-backed criminal syndicate best known for the WannaCry cyber attack of 2017 — was responsible for a $100mn crypto heist against crypto platform Horizon Bridge last summer.

Like last week’s US clampdown on crypto exchange Bitzlato, the rest of the crypto market seem unperturbed. Perhaps it is more concerned with the Three Arrows guys returning to save crypto.

But again, this overlooked story tells us something important: North Korea’s crypto lifeline is under pressure and the Hermit Kingdom is scrambling to stay in the shadows.

To be clear, this is really important. Experts tasked with monitoring international sanctions said last year the money raised by North Korea’s criminal cyber operations help finance up to a third of the funds dedicated to its missile programmes.

Lazarus had previously been using a mixing service called Tornado Cash, until the US hit it with sanctions last summer. These services obscure the payment trails for cryptocurrencies, which would typically be viewable to the world on a blockchain.

The FBI said this week they had caught Lazarus using another privacy tool called Railgun to hide their trail. The funds from the June Horizon Bridge heist remained dormant until about $60mn of ether tokens were deposited into Railgun this month, said Elliptic, the blockchain analytics firm that helped the US authorities.

“North Korea had to figure out how to add another layer of obfuscation,” Elliptic’s David Carlisle told me over the phone. “To some extent, you could say it’s a game of whack-a-mole.”

Does this mean law enforcement will simply be forced into a never-ending and unsuccessful pursuit, like Wile E Coyote after the Road Runner? Chainalysis’s cyber crimes research lead Eric Jardine told me that privacy wallets such as Wasabi have seen the “lion’s share of growth” post-Tornado Cash sanctions.

“It’s just cut and paste, but just finding the new thing to use,” said Allison Owen, an associate fellow at the Royal United Services Institute, a UK defence think-tank.

There may be some optimism for authorities. The hackers are facing an increasingly uphill battle to hide their stolen crypto holdings because substitute tools are less popular, making it increasingly challenging to disguise illicit gains among a smaller pool of legitimate funds.

Just under 6 per cent of the total funds received by Tornado Cash were linked to North Korean hacks, Elliptic found. In comparison, roughly 70 per cent of the total funds received by Railgun have been associated with North Korean hacks.

“It’s easier to hide something in a bigger pool of stuff than in a smaller pool . . . it does potentially become harder to use for moving hundreds of millions of dollars as we have seen North Korea do before,” Carlisle said.

Perhaps North Korea is just becoming too big for the market, unless, of course, it’s already moving on to the next tactic.

What’s your take on North Korean crypto activity? Email me at scott.chipolina@ft.com.

Weekly highlights

• The Dutch central bank fined Coinbase €3.3mn after it said the US-listed exchange provided crypto services in the Netherlands without registration. The fine, made earlier this month, was first announced on Thursday and follows a similar fine levied on Binance last year.

• Republican senator Wendy Rogers has introduced a bill proposing to make bitcoin legal tender in her state of Arizona. The bill is unlikely to get mainstream support but it underscores the local links between crypto and politicians. Rogers, who was previously censured by the Arizona State Senate for calls of violence against political opponents, is not the first in the Grand Canyon state to cosy up to bitcoin. In a past life, I wrote about Ron Watkins, a leading figure in the QAnon movement, who once asked for bitcoin to finance his political ambitions in Arizona.

• Public prosecutors in Rio de Janeiro have opened a civil investigation into Binance following a series of complaints from users experiencing difficulty withdrawing funds. One complaint quoted by the prosecutors described how a user deposited more than $100 in the stablecoin tether to Binance and was asked to pay more than $6,000 in tether to release their funds. “I’m completely heartbroken,” they said. Binance said it did not comment on ongoing investigations but operates in compliance with law enforcement authorities in Brazil.

• Moody’s has chimed in on the outlook for centralised and decentralised crypto platforms. In its outlook for the year for crypto groups, the credit rating agency said decentralised finance products may win the long-term battle against centralised platforms. “In the wake of recent fraud and bankruptcies, investors may, over time, favour other channels if centralised finance does not become more transparent,” it said.

Soundbite of the week: Senator Warren pulls no punches on crypto

Elizabeth Warren is known as one of Congress’s most outspoken crypto critics.

The Democratic senator from Massachusetts has previously raised alarm bells on crypto’s carbon footprint, and in December last year, she co-introduced the Digital Asset Anti-Money Laundering Act, which one industry advocate claimed was “unconstitutional”.

During a virtual event this week with the American Economic Liberties Project and Americans for Financial Reform, Warren came down hard on crypto once more, after an unprecedented year of failure that has left a black mark on the industry as a whole.

“I can already hear it, the crypto promoters are tuning up. But I am not willing to trade the life savings of millions of retail investors, the integrity of our energy grids, the soundness of our banking system, or our national security for a bunch of hyped up promises.”

Data mining: Tether reigns supreme

It has not been a good month for crypto companies after another round of job cuts, more regulatory settlements and yet another high-profile bankruptcy.

But one company bucking the trend is Tether. The operator of the market’s largest stablecoin grabbed almost 49 per cent of the market, its highest share since October 2021, data from CryptoCompare shows.

It’s not as high as the 70 per cent Tether had garnered two years ago, but it comes as traders shy away from keeping their assets in stablecoins. There was a net outflow of $3.3bn worth of coins leaving exchanges in December, its highest level in more than a year.

In contrast Tether’s chief rivals USD Coin, Binance USD and Gemini Dollar fared worse, registering declines in market capitalisation in January.

Cryptofinance is edited by Philip Stafford. Please send any thoughts and feedback to cryptofinance@ft.com.

Your comments are welcome.