Crypto Confiscation as a Service
summary
Documents state North Korean groups convert hacking into revenue streams: $620 million Running Bridge, Bybit $1.5 billion and smaller scams like ThorChain $1.35M and Drift ~$250M. Operations use fake job interviews, Telegram phishing, malicious front-ends that trigger blind signing, supply‑chain baiting, fan‑out and peel chains, DEX/AMM swaps, bridges, flash‑loan blenders, mixers, OTC desks, gift‑card and NFT self‑sales to convert stolen crypto into spendable fiat without needing zero‑day exploits.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:13Why North Korea turned to decentralized finance
- 3:39Crypto as state revenue
- 4:212022 thefts and laundering
- 6:07Trust and desire as attack vectors
- 8:12Blind signing and Web3 traps
- 10:19Supply chain attacks
- 11:00Decentralized value redistribution
- 12:24Monero limits for state thefts
- 14:49Lazarus on-chain obfuscation
- 17:56Asset reshaping to cross-chain
- 21:42Cross-chain bridges and laundering
- 24:12Mixers and custom deployments
- 26:19Off-chain laundering tricks
- 29:07Airdrops and gambling platforms
- 31:14Swap services and OTC desks
- 34:00P2P laundering systems
- 36:27Off-ramp to physical world
- 38:34Malware relies on human error
- 39:16Threat intelligence attribution limits
- 40:21Crypto’s state survival tactics
- 41:23Summary and call to action
related talks
12mIs Your North Korean IT Worker Quiet Quitting?
42mHow to Fight the Lazarus Group
38mScammers Who Scam Scammers, Hackers Who Hack Hackers: Exploring a Sub-economy on Cybercrime Forums
57mWhat we can learn from the World's Biggest Heists
46mThe State of Blockchain Security - 2023 Edition
35m"We Are About to Land": How CloudDragon Turns a Nightmare Into Reality
30mProfessionals hack people, not systems
47mThe Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud