
How North Korea's Launderers Try to Shake Off Blockchain Analytics
- Immediately after the Binance hack, on-chain analysts observed a massive, automated distribution of stolen funds: from 10 wallets to over 100, then 400, and even more addresses.
- This pattern appeared machine-driven and differed greatly from typical manual methods used by North Korean launderers.
- Trader Traitor (a North Korean hacker group) normally relies on Chinese-speaking third-party money laundering organizations.
- The rapid, scripted distribution aims to fool transaction monitoring software like Chainalysis, TRM, or Elliptic. These tools are based on attribution: if funds are traced to a known risky wallet, an alert is triggered.
- By shuffling funds across many wallets, the âtaintâ is removed and the money appears clean.
- Scripts for such operations are not new (used as early as 2017 in WannaCry), but the scale and speed of this case are unprecedented.
- AI greatly simplifies writing these scripts â analysts believe North Korea is likely using AI as well.
- North Korea's cyber operations are militarily organized under the Reconnaissance General Bureau (RGB) and the Workers' Party of Korea.
- There are multiple subgroups with different tasks: espionage, propaganda, crypto theft. Known crypto-focused groups include Trader Traitor (UNC4899), AppleJeus, Contagious Interview, and Dangerous Password.
- Trader Traitor is the most prolific group for major crypto hacks (Bybit, Ronin, KelpDAO, Bitget, LayerZero, Bithumb). Its name comes from trojanized trading apps used as lures.
- Typical attack method: Fake job interviews with multiple rounds where developers run a malicious coding test on their work computer.
- Detailed knowledge of each group's tactics, techniques, and procedures (TTPs) is crucial for faster response and better defense.
- Many companies underestimate the North Korean threat â analysts emphasize that deep understanding of these structures is indispensable.
This is an excerpt from the Unchained podcast with Laura Shin. The full conversation is in the show notes.





