Lazarus Group laundered $200M from 25 crypto hacks to fiat | Hacker News Reader

Lazarus Group laundered $200M from 25 crypto hacks to fiat

zachxbt.mirror.xyz

268 pointsnoch209 comments

Serious question, if the United States decided to unilaterally cut North Korea off from the Internet, how hard would that be to do? Could we just knock out a few cables?

North Korea pretty much only uses the Internet for scams Or to make money in violation of sanctions. They certainly don’t allow their citizens to use it for anything else, and they don’t allow their citizens to leave the country because they would never come back.

Even if it were only temporary, suddenly cutting off the Internet to the country would expose all of those remote workers to the people who employ them and don’t realize they are employing North Koreans when they all disappear at once.

Is this just not logistically feasible? or are we just too afraid it would be unpalatable to our allies? I can’t be the first person who has thought of this.

Most of North Korea’s traffic is routed through China so it’d require cutting the latter off from the internet. With the amount of submarine cables connecting China to other countries, it wouldn’t be very feasible.

Not to mention that lots of data is sent wirelessly.

You think they are doing this from NK ip blocks/asn? Their physical links are more or less enemy of enemy with US, so they have no incentive to block. Its impossible to keep them off the internet.

Oh I’m not imagine anyone helping us. Im wondering why we aren’t cutting undersea cables or drone bombing land based ones.

All the “international sovereignty” responses are humorous to anyone whose paid attention to the last twenty years of the American military.

Because China really wouldn’t like it, and that’s all there is to it.

Is it technically feasible? Yes.

> drone bombing land based ones

How do you imagine that a drone will be able to find and damage an underground cable?

This is not Afghanistan, a drone will not live long past China’s/Russia’s air defences.

I imagine pretty easily. They likely don’t have to find it, nothing gets dug in North Korea without US watching it via satellite. Chinas air defenses likely don’t exist in North Korea.

I have no doubt the US has plans to cut them (and probably anyone else you can imagine) off in the event of war.

Apparently China's navy is stronger than the US navy these days.

So it might not be a great idea to start doing stuff like that in their back yard? ;)

It's probably of higher intelligence value to let them connect and intercept everything than it is to cut them off and not know what's going on. If you look at their border with China, it's only tens of meters from fairly populated areas, so setting up high bandwidth microwave links wouldn't be hard. Also bombing a sovereign nation is an act of war and comes with consequences.

First consider that the internet was designed to withstand and endure attacks upon it. So long as at least one connection remains, the nodes thereof remain accessible.

Next, consider that the authority of US sovereignty ends at US borders. The US legally cannot unilaterally do anything to anything outside of its own borders.

Next, consider that both North Korea and more importantly China have no damns to give about what the US wants.

Next, consider the first point again. Any actions made domestically can and likely will be circumvented by people who do not agree with them. An obvious example is people running their own DNS servers configured in defiance of US government orders.

So to answer your question:

Is it legally feasible? No.

Is it politically feasible? No.

Is it logistically feasible? No.

Is it physically feasible? No.

Is it good that this isn't feasible? Yes.

> First consider that the internet was designed to withstand and endure attacks upon it. So long as at least one connection remains, the nodes thereof remain accessible.

Tell me you haven't worked in network infrastructure without telling me you haven't worked in network infrastructure.

> Next, consider that the authority of US sovereignty ends at US borders. The US legally cannot unilaterally do anything to anything outside of its own borders.

I mean, sure, officially, when all laws are followed and in a friction-less plane this is correct. However the United States does all kinds of shit unilaterally outside it's own borders, literally all the time, not the least of which every war we've been in post WWII, and incalculable numbers of other tom-fuckery carried out on all levels of secrecy and non-secrecy by all manner of organizations identified by three letters, most commonly the CIA.

>Tell me you haven't worked in network infrastructure without telling me you haven't worked in network infrastructure.

Am I wrong, though?

>I mean, sure, officially, when all laws are followed and in a friction-less plane this is correct. However the United States does all kinds of shit unilaterally outside it's own borders, literally all the time,

You can just say we went and blew up Nordstream, you know.

> Am I wrong, though?

Yeah. Congestion makes a single-node Internet unusable.

Yeah we’ve been drone bombing other countries, even ones we’re not at war at, for 20 years. If most Americans Google which countries we have troops in they’ll be shocked to find we’re invading countries they don’t know about.

There are some good reasons people have given here why we aren’t doing it, as I suspected, but I’m sure borders aren’t on the list.

Only an American would ever entertain this idea without being at least a bit tongue in cheek about it. The US doesn’t own the Internet.

Out of interest I looked up who controls the DNS root servers:

Europe (2): RIPE and Netnod AB. RIPE is Europe’s RIR, run as a conference by European ISPs. Netnod is a Swedish ISP.

Asia (1): Project WIDE, part of the Tokyo Institute of Technology.

US (9): Verisign, Cogent, NASA, US Department of Defense, US Army, the University of Maryland, ISC (as in the Bind9 people), ICANN itself, and the University of Southern California.

The last two seem to have some overlap and there is probably a lot of overlap between all of these organisations.

Verisign runs two root servers which is why the list has twelve entries but the root servers run from A to M.

DNS != The internet. You can still use the internet without access to the DNS root servers

You could also run the internet on smoke signals but nobody does it

If you think losing DNS root servers means that NK would have to use smoke signals then I think you don't understand how the internet works frankly. If you blocked your own computers access to the DNS root servers right now you probably wouldn't even notice the difference

smoke signals is a non-standard extension. however over avian carrier has its own rfc and is entirely legit:

https://www.rfc-editor.org/rfc/rfc2549.html

+1, One cab likely also presume that especially DNS at the root level is already handled locally for NK. They reportedly have their own intranet so presumably they also have common services like DNS hosted their.

just edit /etc/hosts or run your own bind, and point dns to 127.0.0.1, no DNS root server needed!

Of course but the contention is that Internet infrastructure, of which DNS is a fairly indicative example, is controlled by US entities.

It’s not, but it mostly is, and I wouldn’t be surprised if a lot of other centralised components — hardware, cables, numbering, protocols — were similarly organized.

It would be very easy to run without DNS. Just have someone bring a decent sized chunk of the world's DNS entries into the country in a diplomatic pouch every month.

The US owns the world, the same way any big empire does. Exersice of soft power when it works, and violently explosive power when it doesn't. Power flows from the barrel of a gun, not from who owns some DNS servers.

When was the last time they used that "explosive power" to good effect? They got humiliated in Afghanistan and Russia isn't even scared to act out any more. The only people who think America still rules the world is it's delusional populace.

Both conflicts were about punishment and troop training, and they achieved that. If they wanted to they could have razed every square km with conventional weapons alone.

Americans keep saying this and it makes me laugh every time, because you didn't learn anything from Vietnam.

Just like in Vietnam, the stated goal was to replace the government - in this case, to remove the Taliban - that's why you created the Afghan National Army and their flimsy democracy. All told, the US has spent $8 trillion and several thousand young men on the GWOT. Once the US pulled out, the Taliban strolled back into Kabul.

$8 trillion will reduce the US debt by 25%, or pay off all student debt, or build 80 million $100k homes. Wasted, and the only thing you have to show for it is nothing tangible, except more vibrant terror groups, and immigrants flooding Europe. Meanwhile, 8k US veterans die by suicide yearly.

You had the firepower but failed to achieve your political goals. Just like in Vietnam, Iran, Syria, Laos, Cambodia, and more countries than I care to mention. While ruining the lives of innocent millions, of course.

So, you failed. Admitting it might be hard, but it will bring the US to a place of humility and help you avoid adventures like this going forward.

And to be pedantic, no you can't raze every sq. km of 652,860 km². Assuming, even just 1000 tons of explosives per km2, that's nearly 700 million tons of explosives. At $30k a ton, you'd be spending $21 trillion on enough explosives.

> and immigrants flooding Europe

You are blaming the US for that?

Yes, for destabilizing Libya and Syria. Those millions of Syrian immigrants that suddenly started flooding Europe had been living contently in their homeland. What changed starting in 2014? Gaddafi was a major force in stemming illegal immigration through the Sahara. What changed in Libya in 2011?

The US hasn't destabilized Mexico, Guatemala and El Salvador, yet they get migrants from those countries. And Gaddafi also got screwed by Szarkozy and Tony Blair. The US probably had other plans which didn't quite work out as intended.

Hah! The US has a long and shameful history of meddling in Latin America: coups, outright invasions (Panama, Grenada, Nicaragua, Honduras, etc.) and overthrows or assassinations of democratically-elected leaders considered leftist.

Arbenz in Guatemala, Allende in Chile, etc.

Haiti: Historian Hans Schmidt notes that, “US Navy ships visited Haitian ports to ‘protect American lives and property’ in 1857, 1859, 1868, 1869, 1876, 1888, 1889, 1892, 1902, 1903, 1904, 1905, 1906, 1907, 1908, 1909, 1911, 1912, and 1913. Finally, tired of all those round trips, the U.S. occupied Haiti from 1915 to 1934."

Among others, in the 1980s, a Guatemalan military that received U.S. support carried out scorched earth campaigns that massacred upwards of 200,000 mostly indigenous people [1].

And that's before you count all the other American-trained and armed military juntas that systematically murdered, tortured, and raped millions of dissidents "leftists" with Uncle Sam's blessing.

Wikipedia has an entire page on it: go take a look. [2]

[1] https://repmcgovern.medium.com/decades-of-us-intervention-ha.... [2] https://en.wikipedia.org/wiki/United_States_involvement_in_r...

That was quite a while ago. You forgot about Nicaragua and the Contra war though.

1989 wasn't that long ago: https://en.wikipedia.org/wiki/United_States_invasion_of_Pana...

Not only in Latin America. The US also continues to keep their fascist allies alive in Europe, Asia, Africa and everywhere else.

Every leftist country will either be undermined secretly (Europe), will have fake elections to overcome this problem (Latin America), or endure another fascist coup.

In Europe this fascist US backed coups happened until the 70ies. Now the press is enough to vilify citizens and workers rights.

So the US is simultaneously a toothless non-power and the secret genius insidious power behind everything bad that has ever happened. Got it.

Wait, that's what you caught from all I just explained? I don't even feel the need to explain anything, but if you want to actually debunk any of the assertions I made, I'll be waiting.

> They got humiliated in Afghanistan

We gave up and left for political reasons. Any humiliation was self-inflicted.

America is unquestionably the foremost cultural, financial , and military power on earth. The fact that your best example is a war that america lost voluntarily because they were unwilling to engage in scorched earth tactics is pretty telling. Afghanistan was a quagmire with no real starting goal, no real end condition, and no motivation to fight. If america decided to drop a few platoons into the country and massacre civilians with mechanized infantry and close air support it would have been over in a month, but to what end? It would make them barely better than the Russians who tried to actually use those tactics and didn't have the resources to pull it off.

The land of democracy, ladies and gentlemen. Rights for us, nobody else.

Funny thing about American meddling is that it always comes back to bite the US in the ass. The War of Terror has cost $8 trillion and there's nothing tangible and lasting the US has to show for it. Groups like Al Qaeda, ISIS (esp. their networks across Libya, Iraq, etc.) are offshoots of American meddling in the region, growing healthily despite everything.

Afghanistan, Vietnam, Iran (now a rabid enemy), Iraq, Syria, and Libya, are all failures of that World Police ethos that the US refuses to disengage from.

The American way is creating problems and selling solutions.

They're not really selling solutions if it still costs them at the end. For the most part, US foreign policy is a net negative for America's pockets and many of their "allies."

They are a sophisticated money siphoning program. Socialize the cost of war (taxes), but privatize the gains (corporate profit).

There is no cost, overall it all raises US GDP. Military lives are not considered.

Digging a hole and covering it at a cost of $22 trillion will double America's GDP overnight. But it doesn't create value for anyone.

All it does is transfer money to the contractor doing the digging (in America's case, the military-industrial complex) while everyone else becomes poorer.

$8 trillion has been spent on the War on Terror so far. Like I said in another comment, that's enough money to build 80 million $100k homes, or reduce America's debt by 25%, or pay off all student loans, or build 400,000 KM of high-speed rail at $20M/km, or give every American taxpayer a one-time check of $48k, etc.

Every bomb dropped on Afghanistan or Iraq was money diverted from something else useful the US could have done.

> it always comes back to bite the US in the ass

Does it? So far millions of traumatised and in various ways challenging to deal with refugees are in Europe.

Hey, it's not all bad. We all got a movie out of it. ;)

https://www.imdb.com/title/tt0372588/

Now that you put it that way :)

It’s a dumb question simply because we know most North Korean cyber agents are working abroad- they literally live in China or somewhere else and setup infrastructure elsewhere to remote into.

The Chinese government had built the infrastructure for the Great Firewall, allowing them to block whoever they want. The US does not have this capability.

You certain all those devices in black rooms[0] like Room 641A[1] are entirely passive? I'm not.

[0]https://en.wikipedia.org/wiki/Black_room

[1]https://en.wikipedia.org/wiki/Room_641A

What makes you think the same equipment would have the necessary mechanics and capacity for realtime mass-filtering?

Even in America, I imagine there are many other budget priorities competing for a limited spook-fund, that would displace a "national censor-wall but indefinitely inactive and secret just in case we need it someday."

You know how the internet and things like Tor are products of the Department of Defense?

The State Department has been using the internet (and anonymization tools like Tor) to organize dissidents in foreign countries for various purposes, often coups. One example is the Arab Spring[1].

I'd wager they are very afraid of someone doing it back to them, and might have some capability in place. Even if it's just to shut the internet off for a time (like Pakistan and other nations have done during elections[0], maybe in response to US interference) or perhaps prevent connections to other nations/the rest of the world more generally.

[0]https://www.accessnow.org/campaign/2024-elections-and-intern...

[1]https://www.jstor.org/stable/10.13169/arabstudquar.35.3.0255...

So the issue isn't a PRC-esque Great Firewall, but instead a more generic "blanket interruption of service in some region for some time"? I feel those are significantly different scenarios.

For one, they're would be an enormous backlash if it were to somehow effect the many American businesses which rely on network access and have significant clout in our system. Most of the countries that have tried such things either (A) don't have the economic exposure or (B) limited the outage-scope to zones without the same stakeholders.

Another aspect is that such coarse interruptions are a lot easier to accomplish through a bunch of NSL-weilding lawyer-agents contacting ISPs, rather than spending money building dedicated hardware infrastructure, in advance, in secret, to support a Giant Red Button.

I'm not saying there's no possible Motive, but it's no substitute for Means and Opportunity.

Someone did it a while ago:

https://www.wired.com/story/north-korea-hacker-internet-outa...

don't bother with the above link if you're not subscribed to wired, use this instead:

https://archive.is/rWpjI

Taking you seriously: I’m pretty sure NK has non-oceanic interconnects with both China and Russia. So unless your plan involves attacking within the internationally recognized borders of either and living with the consequences, the answer is “not easy.”

I assume the US is willing to do this because we do it frequently, though not with China or Russia. I’m not sure about the DPRK, and was asking more of a technical question than a political one. Like, how many cables would we need to cut and how exposed are they? I’m aware they’re a nuclear power (ish) and the politics aren’t trivial.

I don’t think we go around frequently cutting international interconnects? Do you have a source for this?

This wouldn't work against the bad actors as they could just proxy through a friendly (to NK) country. And would set a bad precedent of using Internet access as a tool for sanctioning.

>Serious question, if the United States decided to unilaterally cut North Korea off from the Internet, how hard would that be to do? Could we just knock out a few cables?

You will have to cut cables going to Russia (and\or out of Russia) and China at least.

Not to mention wireless comms.

How many? Near as I can tell a few drone bombs could accomplish this. We love drone bombing other countries.

Not ones with nuclear weapons. Or one that manufactures all the toys that keep Americans happy.

That’s true, but are they really going to lob their two nukes at Maui just because we drone bomb a few wires? The Kims like being alive.

The Kims are likely the only reliable bet for people who would actually survive a nuclear war and the following nuclear winters, if the book Nuclear War by Anne Jacobsen is to be believed. They're the only ones that have built their bunkers deep enough (under mountains) that modern thermo nuclear weapons wouldn't destroy them, and they have years of supplies down there.

No. At least not because of that. But if they drone bomb Seoul, would you continue the escalation? Because the escalation can lead to that.

Also DPRK is threatening Seoul and Japan, not the USA.

I'm not sure drone pilots would cooperate. They are accustomed to live targets, after all.

Just need to add it as a new mission in GTA6 and there'll be no problem in 3 years time.

Ender's Game IRL

USA doesn't care about North Korea. We love to have Boogeymen. What would the military industrial complex do and be without our Boogeymen?

We care very much about North Korea as they have nuclear weapons and share a land border with our ally

They already partially operate from China. They would just do that more. They could even have their own connection to China and connect to the Internet from there. It's going to be a wack-a-mole thing that they easily win.

I wasn’t assuming it to be a strategy that was permanently feasible.

I think their main connection comes through china, but if that was cut off they could still use star links.

If you mean SpaceX’s Starlink they obviously can’t. Elon clearly controls who uses it where.

If you are just using the term generically and mean other satellite connections, maybe, but limiting them to satellite internet only where we couldn’t take out a dish would certainly be crippling to the crimes I’m referencing!

> They certainly don’t allow their citizens to use it for anything else, and they don’t allow their citizens to leave the country because they would never come back.

I never thought about it like this but it’s the largest open air prison on earth.

nope, earth is the biggest open air prison ;) and only guard it needs is the gravity.

Do other countries also experience prison like conditions?

Tell me you're American without telling me you're American :D

N.Korea is a Chinese weapon, unfortunately. To do something like cut off their internet would be considered an attack on China. China is their border where do you think they get connected to the internet.

Sure. As if they couldn't reroute through any other country. They're already cut off by their leadership, except for the state sponsored cybercriminal groups which don't need a NK IP.

  > cut North Korea off from the Internet, how hard would that be to do? Could we just knock out a few cables?
  > Is this just not logistically feasible?

NK shares a physical border with China and Russia. Not to mention that we can send data by means other than a physical wire.

Even if you were willing to block Russia and China from "the internet" (lol) it would be nearly logistically impossible.

Even if you were willing to destroy all sense of privacy and track every single packet sent (what a terrible dystopian idea), there's still going to be ways to fake this. It would only make it harder, not impossible.

>North Korea pretty much only uses the Internet for scams Or to make money in violation of sanctions. They certainly don’t allow their citizens to use it for anything else, and they don’t allow their citizens to leave the country because they would never come back.

Do you think that the only place north korean hackers operate from is inside north Korea?

This is impressive analysis, but have I overlooked the laundering part? Money laundering is providing an explanation about why it is clean, not hiding the reason that it might be dirty.

Most of the crypto world operates on "assumed clean" (blacklist) thinking so you don't have to fully clean anything.

and when the crypto passes through a government’s address it magically becomes clean :))

so the whole blacklist concept is dumb because the same funds have to be reset, but the old chains of transactions are still being passed around as if its a “gotcha” but theyre really irrelevant quickly and reintegrated back into the economy quickly

I don't see what's dumb about it. It seems like blacklisting is the digital equivalent of "I don't want to do business with criminals" - I wouldn't knowingly buy anything from a thief, or from a store that knows some of its suppliers are thieves. If law enforcement has seized the property and auctioned it, then the criminals aren't profiting, so I don't mind.

If you don't want to do business with criminals, don't buy crime futures. Because that's essentially what crypto are (unless not held and only purchased on demand for whatever oddball transaction you'd want to do that's neither speculation nor directly related to crime): demand outside of pure speculation (which is certainly by far the biggest part) must be completely dominated by demand for paying ransoms, purchasing illegal substances and so on.

Even if "your" tokens are perfectly clean, straight from an artisanal miner running their rig purely on solar surplus or something like that, their value still derives almost exclusively from crime use cases, hidden behind no matter how many layers of zero-sum speculation.

That is totally absurd.

> demand outside of pure speculation (which is certainly by far the biggest part)

> their value still derives almost exclusively from crime use cases

you contradict your self in your own post

> business with criminals, don't buy crime futures

Is your Crime same as my Crime?

Suppose I am a software developer living in Russia and I don’t want to pay taxes to a government that commits war crimes, is that a crime? Should a western bank be preventing that?

Suppose you were protesting in a dictatorship, and as a result your assets were seized, you have a criminal record, maybe you are collecting donations, should I as a western bank act to stop that ‘crime’?

Even simpler if you want to buy some weed, it’s a crime in country A but not in country B. Suppose so live in Country B, should I be concerned?

> Suppose I am a software developer living in Russia and I don’t want to pay taxes to a government that commits war crimes, is that a crime? Should a western bank be preventing that?

Yes, because that activity cannot be distinguished from thd Russian government evading financial sanctions. It sucks for the innocent party but there are many victims of their government with more serious grievances.

> Suppose you were protesting in a dictatorship, and as a result your assets were seized, you have a criminal record, maybe you are collecting donations, should I as a western bank act to stop that ‘crime’?

This has the same problem plus the gross negligence of advising anyone living under a repressive government to use a financial system designed to leave an immutable trail for the police to use when prosecuting them and everyone they know. The full retroactive deanonymization is incredibly dangerous for dissidents since it allows the authorities to prosecute them for transactions they made even before they were suspected of anything.

> Yes, because that activity cannot be distinguished from thd Russian government evading financial sanctions.

I am not sure this is true, but regardless I was going for a moral angle - the question was basically: Suppose a western bank was 100% certain that it was not Russian government avoiding sanctions, would that still apply?

I think in that hypothetical case you could say it’s morally okay with some debate over how much participating in the economy matters, but I don’t think that tells us much about the real world because how would you ever get anywhere close to 100% certainty that you are actually talking to the person you believe you are, they aren’t compromised, and that the government isn’t waiting to confiscate those funds? Unless the goal is just to stash money in a foreign account until you can escape the country there’s no way to avoid a fairly high level of risk trying to use it in country.

The point is that when a government seizes crypto funds and auctions them off again, the funds are clean for legal purposes but transaction history doesn’t change, it just has an additional transaction.

Software that flags aspects of transaction is nullified by the reality that it doesn't actually know that one subsequent transaction cleaned the whole trail. There are hundreds of thousands of governments around the world when factoring in municipal authorities, even governments you don't respect are cleaning funds in the eyes of governments you do respect. In the eyes of the requirements of exchanges that have these automated chain analysis practices. Right now, only a handful of governments do crypto investigations and seizures, but as this increases it only moves towards the nullifying chain analysis, as many funds will be comingled with a flagged transaction but unknown to the software about how these funds have been washed by a nation state’s blessings.

To be fair so does most of the traditional banking system.

This was the case maybe 20 years ago, but modern anti money laundering has moved the needle significantly in recent years. Where I live there are now rather strict limits on what consumers can do without subjugating themselves to what's called "Due-diligence". Which is in fact about NOT assuming cleanliness. Know You Customer is all about not blindly assuming your counterparty is honest.

Yup. This also why people should only use fintech banks (Revolut, N26, Bunq, etc) as a checking account and should keep the bulk of their money elsewhere.

Because of the relatively low-friction signup process, fintech banks are extremely trigger happy with account locks, and at that point you have to go through their permanently-overloaded customer service to get your money transferred to another bank, a process that might take months if you’re unlucky.

Also don’t keep money that that you cannot afford to miss in fintech because they are not banks at all.

The FDIC insured bank which actually has money when using these apps is somewhere in the backend and you get stuff like the synapse bankruptcy[1]

[1] https://apnews.com/article/synapse-evolve-bank-fintech-accou...

That’s just wrong. Revolut, N26 and Bunq all have banking licenses, which means funds are insured to €100 000, €200 000 if it’s a shared account.

It’s not that they “steal” your money, but unlike your local bank, their customer service is much less tactile which means that if you’re up shit’s creek getting out if it gets much harder.

The financial system runs on a soft-whitelist system with extra checking and a shadow banning system.

This is why everyone is always asking everyone to demonstrate the sources of funds in finance.

Obviously it is not 100% effective, but it is somewhat effective. You cannot just jog in from Iran and enroll as a JP Morgan client

> soft-whitelist system

A whitelist/allowlist is a system that defaults to rejecting everything, but allow someone to override that rejection.

A blacklist/denylist is a system that defaults to allowing everything, but can on-demand block/deny something.

Banking system for individuals today mostly have a blacklist/denylist for the common use case. Walk into a bank and ask to open an account, and they'll most likely allow you.

If you manage to trip up any alerts (big deposits for example), they'll ask you for more info, citing KYC/AML for the reason why.

> This is why everyone is always asking everyone to demonstrate the sources of funds in finance.

This usually happen after the funds have touched some account you own, hence it's a blacklist system. A whitelist system wouldn't allow you to deposit those funds until after you got verified somehow.

US/Canada 2024, $3 billion in fines by US regulators, https://rupakghose.substack.com/p/td-banks-aml-issues-and-fi...

> DoJ investigation found.. [banking] business had been used to launder more than $650m between 2016 and 2021 from US fentanyl sales for Chinese crime groups and drug traffickers.

Canada 2018, https://news.ycombinator.com/item?id=33918115

> An estimated $5.3 billion of laundered money into B.C. real estate in 2018 hiked housing prices 5 per cent, two special reports released Thursday by the provincial government show.

Australia 2015, https://www.macrobusiness.com.au/2015/06/stop-money-launderi...

> Credit Suisse estimates some $28 billion of Chinese money has been invested in the Australian housing market over the past six years

Is there any reason to believe the Australian investment is related to money laundering or drug sales?

No. The linked article admits they're wildly guessing and links to another report with recommendations but no numbers I saw from a skim. I hear this repeated regularly on HN but am yet to see a reliable source beyond "but it's Chinese money".

The FATF report goes into it in more detail [0], but to put it very simply - Australia doesn't have the protections it should, when it comes to money laundering.

[0] https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/Mutual-E...

In my empirical experience, its more to do with stashing the proceeds of state capture by politically connected individuals in China.

Another reason why we should only allow Canadian nationals to own real estate in Canada.

What about shell companies? Corporations are people too!

Governments will never remove that - it’s a super important construct to allow everyone except the average citizens to avoid all sorts of taxes.

Thats an easy fix: Only Canadian shell companies can own real estate in Canada! =)

Or, you know… build more houses.

We could drop western Europe into central BC / Alberta/ Sask. / Manitoba and not notice.

Or, we could destroy our small builders, import millions of immigrants incapable of construction / trade work, inflate asset prices, pay for their housing with government grants, lie about CPI inflation, and fix it all if we just…

“only allow Canadian nationals to own real estate”?

There are many things which could be done. I think ideologically it makes sense that if you want to own land in a country you need to be a citizen of that country. You need “skin in the game” so to speak, if you want to enjoy owning property in a location you need to make a commitment to that nation — the good parts and the bad parts.

> Australia

Don't worry, Australia's going to fix that! By making "harming public confidence in the banking system or financial markets" "serious harm" under the upcoming Communications Legislation Amendment (Combatting Misinformation and Disinformation) Bill 2024.

And by "fix", I mean "suppress discussion about", of course.

There's no shortage of things to complain about regarding the U.S., but its First Amendment is pretty great IMHO.

I wanted to comment that any country has something about freedom of speech in their constitution, the problem is usually that the government doesn't respect its own law.

But when I went to compare american and russian constitutions and if you only judge the text, the us is worded better. In russian it's simply "freedom of speech is guaranteed to anyone" while in the us it's more specific about not creating new laws harming freedom of speech.

> not creating new laws harming freedom of speech

Tests are helpful, when writing rules. US freedom of speech has been influenced by law on asymmetry of economic resources in groups vs. individuals [2010], allowing state propaganda in domestic media [2012], and gov-corp coordination of social media moderation [2024].

[2010]https://en.wikipedia.org/wiki/Citizens_United_(organization) [2012]https://en.wikipedia.org/wiki/Smith%E2%80%93Mundt_Act [2024]https://www.scotusblog.com/2024/06/justices-side-with-biden-...

It was once said by a famous african dictator:

“There is freedom of speech, but I cannot guarantee freedom after speech.”

― Forest Whitaker

So maybe it is like this. It's a funny thing to say, because in this mindset there is freedom literally to do anything. Consequences come after, minutes, hours, days, years, but after and not before, at least not until OpenAI-Google's new "PrescientCrimeCAItcher" comes online.

These "community guidelines" are quite frustrating because a major communication modality presently does not have freedom of speech, it has removal of speech it does not like. So that's an interesting loophole legalese-wise. Presently these are private sector companies running addicting entertaining boards from which they serve ads for profit. If these are instead made to be "utilities" like power or water, utilities of communication, I would imagine the calculus would change

Can't have malinformation that may make the so-called King(s) look bad..

> DoJ investigation found.. [banking] business had been used to launder more than $650m between 2016 and 2021 from US fentanyl sales for Chinese crime groups and drug traffickers.

According to the official CIA "world factbook" or whatever that is called: an estimated 3% to 5% of the world's fucking entire GDP is linked to criminal activities.

Blockchains are cool in that they allow to follow the laundering (so it allows for nice blog entries with good looking graphs, which I do appreciate), as opposed to traditional banks where it's all opaque.

But the amount of money laundered using cryptocurrencies is a drop in the bucket compared to size of criminal activities ongoing in the world (btw criminal activities predates blockchain by centuries or millenia).

And don't get me started on the missing billions when "aid" is sent to this and that country. Be it Ukraine or Haiti or whatever: there are corrupt officials and individuals at every single step of the ladder.

My favorite is the US loading a 747 with 12 billions in bills of $100 USD to "help the reconstruction of Iraq" and officially 9 billions of those 12 billions have been "lost".

Yup. Lost. That's official stuff.

So the $200m of the Lazarus group, compared to $9 billion in $100 USD bills: cry me a river.

Do you have a source for 'My favorite is the US loading a 747 with 12 billions in bills of $100 USD to "help the reconstruction of Iraq" and officially 9 billions of those 12 billions have been "lost".'

Your numbers seem a bit off, but it is definitely an outrageous incident.

https://www.latimes.com/archives/la-xpm-2011-jun-13-la-fg-mi...

"This month, the Pentagon and the Iraqi government are finally closing the books on the program that handled all those Benjamins. But despite years of audits and investigations, U.S. Defense officials still cannot say what happened to $6.6 billion in cash — enough to run the Los Angeles Unified School District or the Chicago Public Schools for a year, among many other things."

> So the $200m of the Lazarus group, compared to $9 billion in $100 USD bills: cry me a river.

I don't think the US cares about a $200m, whatever that $200m belong to. Their issue is that this money is enabling a regime they want to see inert (since the nuclear shield means that the DPRK is not going anywhere anytime soon).

I always assumed that bitcoin was propped up by purchases from money laundering - so that the total value of bitcoins more or less equalled the 3-5% of global GDP that is illegal / laundered etc.

Once upon a time when I looked at it the numbers seemed to stack up - everyone and their dog just used crypto as one stage in the laundering cycle is the assumption

Why would you do that? Unless your I'll gotten gains are natively already crypto (bitcoin ransomware) adding crypto to the process just makes it way more difficult and traceable. Massive financial machines well integrated into the world banking and political structures already launders money just fine on its own in truely massive quantities.

BOOK TO READ: Wilful Blindness: How a network of narcos, tycoons and CCP agents infiltrated the West by Sam Cooper - an investigative Canadian journalist, to get a deep dive into how long this has been going on.

This current government in power [9 years now; the Trudeau Liberal-NDP majority voting power coalition] has done nothing but to allow rampant fraud including this to continue; Trudeau himself on video has stated he admires China's basic dictatorship: https://www.youtube.com/watch?v=T8FuHuUhNZ0

The problem with "money laundering" is that its theory and its operation are the inverse of one another.

The theory is supposed to be that you make it illegal to conceal the source of money that is the proceeds of a crime, so you can prosecute criminals for money laundering even if you couldn't prove the original crime. Which, to begin with, is pretty sus. Basically an attempt to end run around the government satisfying its burden of proof for the underlying crime.

But that also doesn't work. The criminals just set up a legitimate business as a front, claim the money came from there and the only way to prove otherwise is to uncover the original crime. So in practice money laundering is overwhelmingly charged in one of two cases.

One, they already proved the original crime and tack on a money laundering charge which is pointlessly redundant because those criminals were already caught. Two, you get some innocent people who -- unlike career criminals -- don't understand how money laundering laws work, so even though they were doing nothing wrong, they do something which is technically money laundering (because the rules criminalize innocuous and common behavior), or trigger the false positive AI nonsense, and then get charged with money laundering or booted out of the banking system.

Meanwhile large criminal organizations know how to make their transactions look like innocent transactions and then the government yells at banks for not catching them, even though the banks have no real way to do that because the criminal organizations made their transactions look like innocent transactions.

This is a dumb law that does more harm than good. Just get rid of it and charge the criminals with their actual crimes.

So all the crypto went to paxful/noones, and was converted to fiat there. Should be pretty straightforward to subpoena them and get all data about their fiat accounts?

many of these services do not exist anymore (chip mixer) or increased security (sanctions on Tornado cash, more KYC, better chain analysis).

KYC

Know Your Customer, for anyone else unfamiliar with the acronym.

And:

ABC - Anti Bribery & Corruption

AML - Anti Money Laundering

CTF - Counter Terrorism Financing

FATF - Financial Action Task Force

KYCing should be illegal.

You’re going to have to try make a case for that one.

Because “Know your customer” is the government creating a plausible deniability shield for discriminating against a person or group of people.

It should be the government’s job to prosecute criminals by proving they commit crimes, which allow the accused to defend themselves in court, which hopefully results in less corruption.

With KYC, the intent is to not allow the accused a chance of defending themselves. It is a way to deny people rights without the costly hassle of going to court.

Is there evidence of discrimination ? Are banks rejecting services because of age/race/gender/ethnicity etc ?

KYC to reject basis legality of the source seems an acceptable tradeoff to live in a civilized society?

Age/race/gender/ethnicity and other legally defined protected classes are not the only possible instances of discrimination. An example is a person sending money to family in a country where there is less rule of law and they get suspected of terrorism (regardless of firm evidence), or someone selling sex services that gets dropped because a bank does not want to deal with them. Or it could just be errors in the programs and people flagging accounts and transactions.

Electronic money transfer is a vital function of modern life. It should be a constitutionally protected, inalienable right, even for anyone convicted of crimes, just like criminals are still housed and fed.

In an ideal world, would I like to see drugs or sex work decriminalized and legally transacted ?

Yes, but that is not the world we live in , most democratic elected governments have unfortunately not done that. unable to pay/receive for businesses related to them is sadly no different than any other illegal activity.

We don’t remove KYC to make these activities acceptable , we decriminalize them directly, removing KYC allows a lot of other illegitimate things we don’t want as well

Electronic or paper transfer is vital function of legal life, Monetary supply and regulation is core function of a government and it is under no obligation to support illegal activities.

Question from my curious mind. How are the Metamask instances of specific device getting replaced by modified/malware-d version? How does that even work?

Basically they first need to get a remote shell and are then able to replace the extension source with the modified one.

This article does a good job explaining it more in depth.[0]

0: https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is...

Thanks! That is some extensive level of social engineering, reconnaissance and exploiting. Takes a lot of patience and discipline to pull such sophisticated heist.

Thank god we have crypto or else we d never know

Indeed. We would have been sitting with our measly treasury bills, without a care in the world

How hope ZachXBT gets paid well for all his effort in catching scammers. Not sure how he eearns.

he has been paid pretty handsomely from various grants and individuals

This is probably related to Kim Jong Un's new Maybach GLS

I had to look that up.. damn, right in their faces:

https://www.nknews.org/2024/08/kim-jong-un-flaunts-new-200k-...

code is law, no?

Interesting to see that, apparently, Monero was never used.

Indeed, I would assume applications needing untraceability would use XMR

Because most of the crypto economy is on Ethereum. Monero's own hubris and "better than thou" mentality quarantined itself from the rest of the ecosystem.

Our own banks commit 10x more fraud than that. See TD Bank money laundering case ongoing, could reach $4 billion in fines. Wells Fargo $3 billion in fines for fraudulent charges on fake accounts. JPMorgan Chase $1 bil settlement for UST and precious metal futures fraud.

And those are just the ones I can remember from the last few years.

What about

Sad to see this getting downvoted. HNers hate to admit this because then they can't paint crypto has a technology enabling fraud.

Our banks don’t work with Iranians or North Koreans , with crypto it is also about who not how much

“don’t work with …”

You seem strangely certain of that.

It is unlikely that you should be.

I am fairly sure that there is no formal way to send money from United States to Iran or North Korea by an individual or even a business without special government authorization.

Happy to be proven wrong if there ways to send/receive money to countries via banks today.

When we say North Korean or Iran we generally don’t mean people with those ethnic background[1] or even citizenship who have legal, physical and banking presence outside[2] these countries. We typically mean legal entities (both individuals and businesses) who are present within these regimes

Are they sanctions perfect ? Of course not, but they are still far better than what crypto exchanges do today

[1] that would be racist that is not the purpose of those sanctions

[2] the governments of these other geographies persumably have controls and oversight into these people

Standard Chartered bank was fined $1.1 bil a few years ago for laundering money for Iran. They were fined for the same thing in 2012.

Deutsche Bank was fined $2 bil in 2023 for laundering for Russia. They were fined for the same thing in 2017. UBS was fined $4 bil for laundering and tax evasion in 2019. French bank BNP Paribas paid $9 bil in fines in 2014 for laundering for Iran. Credit Suisse has been caught / fined for laundering for Iran. And so on. Our banks work with all of these banks.

Looking outside the EU, I'd guess you could also transfer money to / from Iran by just making a stop over in Hong Kong or the UAE. But how would we know? The banking system is a black box of fraud.

they were caught and fined, that doesn’t happen with crypto exchanges?

While under the American umbrella of regulation neither bank is American is kind of notable I suppose.

Perhaps European regulators are not as strong is more a issue rather than regulations are not a good idea?

It took American financial systems for example to bring down the former head of FIFA Sepp Blatter , he was operating in Switzerland with no consequences and the history of Swiss banks working with nazis is not something one can forget either .

Why these Lazarus geniuses didn't use XMR at all, huh?

I like it, that somebody thinks $4B is a lot. If FIAT CASH was trackable as crypto, your head would explode.

Note that this has nothing to do with the FreePascal/Lazarus project…

Doesn't have anything to do with the guy in the bible either.

Yeah I was confused for a moment there.

I'd imagine it's pretty easy, too. You've already got the assets in a poorly-accountable and liquid state - now all you need is a chump to unload the bag on. Almost makes you wonder how many cryptocurrency influencers are in the pocket of sanctioned nations...

> makes you wonder how many cryptocurrency influencers are in the pocket of sanctioned nations

That's a wild thought that hadn't occurred to me.

With increased KYC and tamp down, where does this money go next?

In much the same way the internet interprets censorship as damage and routes around it, financial networks consider lost opportunity due to regulation as damage and route around it.

People will assume I mean buying drugs, but actually, I mean:

- when I had $10k in my US bank account but couldn’t access it while traveling because I ran afoul of whatever KYC at Western Union after losing my bank card; or,

- today, when I couldn’t prepay for OpenAI platform credits because I have the “wrong kind” of bank account for them.

Society views the fascistic impulses of those in control stifling innovation and growth as damage — and will perennially route around them to get the system flourishing again.

>In much the same way the internet interprets censorship as damage and routes around it

I think this is an outdated meme that has not proven very true. I won't go into a full rant unless you want, but long story short the architecture of the internet has turned out to be more fragile than expected.

>Society views the fascistic impulses of those in control stifling innovation and growth as damage

Maybe not society as a whole, but certainly sub-societies do, so yes. In this case, Lazarus group is a sub-society that is parasitic to society at large.

What do you mean?

The internet has successfully resisted multiple government-sponsored PSYOPs and allowed the formation of a revolution to fix society from its current trend towards fascism, unifying the liberation movement across continents — which I would argue is working far beyond expectations.

(Ed: I’d genuinely like to hear the rant, even as a tangent.)

> Maybe not society as a whole, but certainly sub-societies do, so yes.

All of society does.

Which is why regulation (and oppression) needs to be focused to be effective: if you want to suppress Lazarus group you can’t catch too many strays or you build up enough societal counter-pressure your regulation is subverted.

> when I had $10k in my US bank account but couldn’t access it while traveling because I ran afoul of whatever KYC at Western Union after losing my bank card; or,

Why would you first stop be western Union if you lost your bank card? Ignoring my confusion as to why you didn’t have a credit card handy, or a phone with a banking app handy if you’re well off enough to have $10k in the bank. Why would your first thought be going to western union, a well known haven for scammers everywhere. OF COURSE it set off all sorts of red flags with your bank. I’d be more concerned if they didn’t put up roadblocks to someone claiming to be you, in another country, trying to pull out large sums of money at a western union.

How do those things help?

I had both a credit card and a phone; you can’t get cash with NFC. I was stuck using credit card services and cut off from most of the economy of the primarily cash-based society I was visiting. To the extent merchants accepted digital payments, it was primarily in their local banking app.

> OF COURSE it set off all sorts of red flags with your bank.

Do you not understand why I regard me standing at a WU branch with my passport in hand and access to my authenticator app on my phone, but unable to actually use the service regardless, as a frustrating experience?

Roadblocks would have been fine: there was no road at all, no matter how many checkpoints I was willing to satisfy.

From the same bank who happily allows online transactions to drain my account in obvious patterns of fraud from well-known fraudsters (eg, chat.versailles) without a single roadblock — so they can harvest fees.

No ATMs nearby? Usually unless you are in some severely impoverished nation, ATMs should allow to withdraw(with some hefty fees sometimes) some local currency.

ATMs and banks (cash advances) supported cards and cards with chips, but not NFC.

My physical cards were lost together — which admittedly was dumb, but losing your wallet while still having your passport and phone/Apple Wallet shouldn’t result in “frozen out of banking”.

OpenAI isn't the government - yet.

> Society views the fascistic impulses of those in control stifling innovation and growth as damage

You think society sees financial regulations as fascistic impulses that stifle innovation? Where do you get that from?

I didn’t say that in what you quoted.

> Society views the 1:[fascistic impulses] of those in control 2:[stifling innovation and growth] as damage

I say that people who run our societies are fascists — and their impulses for control [1] then cause a stifling of innovation and growth [2]. Which a five minute conversation with someone that does business will convince you of better than I will.

However, you got cause and effect reversed in your reading: I said that fascists are stifling innovation with regulation, not that regulations are fascistic.

I also carefully said lost opportunity — because regulations become routed around precisely when they introduce more cost than benefit. Eg, some regulations boost opportunity by creating stable business environments.

And how many VCs heavily invested in Crypto startups?

And if any of them even realize it.

> I'd imagine it's pretty easy, too. You've already got the assets in a poorly-accountable and liquid state

Alright, so walk me through it because I don't see how it's easier to wash than other ill-gained funds like cash.

You robbed someone and now you sit on $200M worth of Bitcoin. How you unload them so you have cash you can use, when every transaction is traceable and any exchange willing to trade for those amounts do KYC and follows AML?

You run the bitcoin through mixers/online exchanges into monero/zerocoin and then to wherever to get out with fiat.

you still have to do the actual laundering at some point. just because you have $200 million now in monero (which you also need to get to first) doesn't mean you can just transfer them to your bank account. exchanges will KYC you for that, and you will definitely get flagged for a source of wealth / source of funds check to prove where you got it from

For $200m yes, but you’d be really stupid trying to do it all at once. Small amounts, multiple accounts, gradually over time.

It's really easy. Use casinos in 3rd world countries to certify your money as gambling winnings. There must be underground network for this. So it looks like you're gambling and you got lucky. Very dangerous though. I heard that they charge 13% total fee. You come in at 5M$. You play for 1 week.. Leave with 160M or something. Bring that cash into the bank and deposit it.

How to turn monero or Bitcoin into cash, I think is the hardest part.

Laundering it after that is, in fact, easier.

But the first problem still isn't solved with your statement I think.

Aren’t you supposed to show proofs of winning 160m when depositing into a bank? Even for just a few millions?

And a shady third world casino will happily provide that proof document in return for a 13% cut of your winnings.

I still think you’d get under an investigation (at least from the tax authorities, but I can imagine police too) after years of years consistently depositing millions of wins in your bank account.

I do not think shady people put their loot in bank. Most illicit activities and tax avoiding folks rely heavily on cash or other expensive exchangeable goods(rolex/jewellery/gems/gold bars/gold watches etc).

It's easier because mainstream cryptocurrency services support money laundering for privacy reasons, and will happily process withdrawals from known money laundering services like Tornado Cash until OFAC orders them to stop. Even if you trust that they're doing an honest inquiry into the source of large amounts - and I do not - they can't know that an arbitrary mixer output didn't come from casino winnings or Ethereum mining in the early days.

any exchange willing to trade for those amounts do KYC and follows AML

This is not true AFAIK and it used to really be not true. There were plenty of no-KYC exchanges or exchanges that offered no-KYC accounts if you had the right connections.

> This is not true AFAIK

Tell me one big exchange that'll accept a deposit of $200M USD worth of cryptocurrency without asking questions.

> exchanges that offered no-KYC accounts if you had the right connections

Yeah, and plenty of taxmen that will let you wash money if you pay them X amount, but lets try to stick to verifiable facts instead of imagining/assuming a bunch of things.

with clean funds launch a new token and create a liquidity pool on uniswap

with another set of clean funds in a second address you buy that token in the liquidity pool

with the dirty funds in the third address you also buy the token and dont stop buying, you use all the dirty funds

the second address sells, and you just are another lucky crypto trader with another 10,000% gain, indistinguishable from any other crypto that’s mooned that much. You, along with all the bots and copy traders and momentum buyers. Just sell into liquidity, withdraw the more liquid crypto on exchanges. Pay taxes.

If you do this, the dirty funds need to connect to a different RPC server than your clean funds

dont use infura or a node in a data center on the same IP address

if youre not using your own node on your own network, you need to mask your IP address and think about who knows it. Tor works better than VPN for this

If you think modern chain analysis can't look through those simple schemes, I'm happy the ecosystem seems more naive than I thought :)

Oh well, easier for criminals to get caught I suppose, so not much harm done.

All the indictments I’ve seen involve basically zero OPSEC while all the others go unindicted

Its not about the chain analysis, its about proof. Any random charting site will raise flags about the token buyers, but can the prosecutor use that? The cases arent being brought

> any exchange willing to trade for those amounts do KYC and follows AML?

Binance paid U.S. regulators a $4.3 billion for violating U.S. anti-money laundering laws a year ago. There are many crypto exchanges that have poor KYC or deliberately do it in a way that can be circumvented - Bitzlato was one example. I imagine if you have some dirty Bitcoin you can find an exchange today running in a non extraditable jurisdiction that will trade it for cash for cut.

https://www.reuters.com/technology/co-founder-seized-crypto-...

That's what the influx of shitty NFTs and "tokens" and "chains" are that keep coming up in Twitter ads these days. Criminals just building shitty bags to rip off dumb people while they launder away the profit underneath it.

Reply on news.ycombinator.com