2 Chinese charged with laundering money from exchange hack

[Baofeng]

Two Chinese nationals who help North Korean hackers to launder $100 million out of the $250 million stolen from an exchange, using prepaid iTunes gift cards and other methods.

Two Chinese Nationals Charged with Laundering Over $100 Million in Cryptocurrency from Exchange Hack
Forfeiture Complaint Details Over $250 Million Stolen by North Korean Actors
          WASHINGTON – Two Chinese nationals were charged with laundering over $100 million worth of cryptocurrency from a hack of a cryptocurrency exchange.  The funds were stolen by North Korean actors in 2018, as detailed in the civil forfeiture complaint also unsealed today.

          In the two-count indictment unsealed today in the District of Columbia, 田寅寅 aka Tian Yinyin, and 李家东aka Li Jiadong, were charged with money laundering conspiracy and operating an unlicensed money transmitting business.

          “The hacking of virtual currency exchanges and related money laundering for the benefit of North Korean actors poses a grave threat to the security and integrity of the global financial system,” said U.S. Attorney Timothy J. Shea of the District of Columbia.  “These charges should serve as a reminder that law enforcement, through its partnerships and collaboration, will uncover illegal activity here and abroad, and charge those responsible for unlawful acts and seize illicit funds even when in the form of virtual currency.”]

https://www.justice.gov/usao-dc/pr/two-chinese-nationals-charged-laundering-over-100-million-cryptocurrency-exchange-hack


In relation to that,  US Department of Treasury added 20 known BTC address of the two

The following individuals have been added to OFAC's SDN List:

LI, Jiadong (Chinese Simplified: 李家东) (a.k.a. "blackjack1987"; a.k.a. "khaleesi"), Anshan, Liaoning, China (Chinese Simplified: 鞍山, 辽宁, China); DOB 10 Jan 1987; nationality China; Gender Male; Digital Currency Address - XBT 1EfMVkxQQuZfBdocpJu6RUsCJvenQWbQyE; alt. Digital Currency Address - XBT 17UVSMegvrzfobKC82dHXpZLtLcqzW9stF; alt. Digital Currency Address - XBT 39eboeqYNFe2VoLC3mUGx4dh6GNhLB3D2q; alt. Digital Currency Address - XBT 39fhoB2DohisGBbHvvfmkdPdShT75CNHdX; alt. Digital Currency Address - XBT 3E6rY4dSCDW6y2bzJNwrjvTtdmMQjB6yeh; alt. Digital Currency Address - XBT 3EeR8FbcPbkcGj77D6ttneJxmsr3Nu7KGV; alt. Digital Currency Address - XBT 3HQRveQzPifZorZLDXHernc5zjoZax8U9f; alt. Digital Currency Address - XBT 3JXKQ81JzBqVbB8VHdV9Jtd7auWokkdPgY; alt. Digital Currency Address - XBT 3KHfXU24Bt3YD5Ef4J7uNp2buCuhrxfGen; alt. Digital Currency Address - XBT 3LbDu1rUXHNyiz4i8eb3KwkSSBMf7C583D; alt. Digital Currency Address - XBT 3MN8nYo1tt5hLxMwMbxDkXWd7Xu522hb9P; alt. Digital Currency Address - XBT 3N6WeZ6i34taX8Ditser6LKWBcXmt2XXL4; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Phone Number 8613314257947; alt. Phone Number 8618004121000; Identification Number 210302198701102136 (China) (individual) [DPRK3] [CYBER2] (Linked To: LAZARUS GROUP).
 
TIAN, Yinyin (Chinese Simplified: 田寅寅) (a.k.a. "snowsjohn"; a.k.a. "tianyinyin0404"), Nanjing, Jiangsu, China (Chinese Simplified: 南京, 江苏, China); DOB 12 Jul 1986; nationality China; Email Address 417136259@qq.com; Gender Male; Digital Currency Address - XBT 134r8iHv69xdT6p5qVKTsHrcUEuBVZAYak; alt. Digital Currency Address - XBT 15YK647qtoZQDzNrvY6HJL6QwXduLHfT28; alt. Digital Currency Address - XBT 1PfwHNxUnkpfkK9MKjMqzR3Xq3KCtq9u17; alt. Digital Currency Address - XBT 14kqryJUxM3a7aEi117KX9hoLUw592WsMR; alt. Digital Currency Address - XBT 1F2Gdug9ib9NQMhKMGGJczzMk5SuENoqrp; alt. Digital Currency Address - XBT 3F2sZ4jbhvDKQdGbHYPC6ZxFXEau2m5Lqj; alt. Digital Currency Address - XBT 1AXUTu9y3H8w4wYx4BjyFWgRhZKDhmcMrn; alt. Digital Currency Address - XBT 1Hn9ErTCPRP6j5UDBeuXPGuq5RtRjFJxJQ; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Phone Number 8613621583465; Identification Number 321284198607120616 (China) (individual) [DPRK3] [CYBER2] (Linked To: LAZARUS GROUP).

https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20200302.aspx

[dothebeats]

I still find it amazing how NoKor keeps on pulling the strings to make their moves outside their country and not get caught sooner. Their relationship with large banks and other organizations/institutions is unbelievable too, so much that they managed to amass hundreds of millions of dollars through illegal activity without hitting any red flags. That's why I always look up to the North Koreans as extremely cunning and dangerous even though their country is deprived of anything to the outside world. Good thing their moves are snooped by the authorities even though they initially used bitcoin to cover tracks first. I just wonder what certain cryptocurrency ezchange are they talking about anyway?

[Kemarit]

I still find it amazing how NoKor keeps on pulling the strings to make their moves outside their country and not get caught sooner. Their relationship with large banks and other organizations/institutions is unbelievable too, so much that they managed to amass hundreds of millions of dollars through illegal activity without hitting any red flags. That's why I always look up to the North Koreans as extremely cunning and dangerous even though their country is deprived of anything to the outside world. Good thing their moves are snooped by the authorities even though they initially used bitcoin to cover tracks first. I just wonder what certain cryptocurrency ezchange are they talking about anyway?

And that is why up to this day, North Korea has survived from the massive trade embargo from the West, they are so resilient, and we could say self sufficient and saw crypto as a way to circumvent whether arms or trade sanctions.

It didn't mentioned the exchange, but I will assume that it is a South Korean exchange, which they frequently targeted.

Edit: Hacked Exchanges since 2011.

[bhabygrim]

It is a great news at least the government are still able to arrest those hackers.
Is still a great sign that in the future there would be more crypto hackers that would be arrested?
But any way good job for them on finding those two and maybe soon they would also find out the other members of this group.

[minairia3]

I still find it amazing how NoKor keeps on pulling the strings to make their moves outside their country and not get caught sooner. Their relationship with large banks and other organizations/institutions is unbelievable too

Instead of "amazing" I would use the word terrifying. Imagine how this country has huge wide of connection with this big transactions. I wonder should those affiliated with them must be investigated more as more partners or collaboration medium to big enterprise could be connected too. Scary how they operate and penetrated the cryptoindustry with massive funds at stake. Crypto is indeed being used by other countries for these kind of scheme. Im not shocked why US is strict when it comes to cryptocurrency.

[Wind_FURY]

I still find it amazing how NoKor keeps on pulling the strings to make their moves outside their country and not get caught sooner. Their relationship with large banks and other organizations/institutions is unbelievable too, so much that they managed to amass hundreds of millions of dollars through illegal activity without hitting any red flags. That's why I always look up to the North Koreans as extremely cunning and dangerous even though their country is deprived of anything to the outside world. Good thing their moves are snooped by the authorities even though they initially used bitcoin to cover tracks first. I just wonder what certain cryptocurrency ezchange are they talking about anyway?

For the right price, cartels/criminals would be happy to help them with anything. Plus with Trump imposing more sanctions in the Mid-East, Iran might be happy to do research and development on Nuclear weapons for NoKor. For the right price.

[Darker45]

I still find it amazing how NoKor keeps on pulling the strings to make their moves outside their country and not get caught sooner. Their relationship with large banks and other organizations/institutions is unbelievable too, so much that they managed to amass hundreds of millions of dollars through illegal activity without hitting any red flags. That's why I always look up to the North Koreans as extremely cunning and dangerous even though their country is deprived of anything to the outside world. Good thing their moves are snooped by the authorities even though they initially used bitcoin to cover tracks first. I just wonder what certain cryptocurrency ezchange are they talking about anyway?

Something tells me that these North Koreans couldn't have made this hack successful if not with the assistance of experts from other countries. This launder attempt by Chinese individuals in behalf of the North Korean hackers who stole the funds speaks of possible connections other than this one. They could have been partners way back then. A hundred million USD won't be entrusted to these Chinese for laundering if they were not very trusted individuals.

I have serious doubts that ordinary North Koreans can pull off such huge operation all by themselves. It is either they are connected to their government itself or at least supported by certain powerful persons inside or they have the backing of foreign nationals, probably Chinese, who are knowledgeable enough about such operations.

[TravelMug]

[snip]

Something tells me that these North Koreans couldn't have made this hack successful if not with the assistance of experts from other countries. This launder attempt by Chinese individuals in behalf of the North Korean hackers who stole the funds speaks of possible connections other than this one. They could have been partners way back then. A hundred million USD won't be entrusted to these Chinese for laundering if they were not very trusted individuals.

I have serious doubts that ordinary North Koreans can pull off such huge operation all by themselves. It is either they are connected to their government itself or at least supported by certain powerful persons inside or they have the backing of foreign nationals, probably Chinese, who are knowledgeable enough about such operations.

They have the Lazarus Group, which believed to be state sponsored cyber criminals group inside North Korea. They have stage a lot of online hackers, prior to targeting South Korean exchanges, or any crypto related exchanges for that matter. So North Korea alone is very capable to pull this kind of heist specially against their nemesis.

But they colluded with the Chinese identified in the indictment to launder $100 million out of the $250 million they have stolen. So obviously, there are connections amongst thieves.

[squatter]

It didn't mentioned the exchange, but I will assume that it is a South Korean exchange, which they frequently targeted.

This wording implies by omission that there were multiple exchanges hacked, not all of which were South Korean:

According to the pleadings, in 2018, North Korean co-conspirators hacked into a virtual currency exchange and stole nearly $250 million worth of virtual currency.

The pleadings further allege that between December 2017 and April 2019, Yinyin and Jiadong laundered over $100 million worth of virtual currency, which primarily came from virtual currency exchange hacks.

The pleadings further allege that the North Korean co-conspirators are tied to the theft of approximately $48.5 million worth of virtual currency from a South Korea-based virtual currency exchange in November 2019.

As far as 2018 hacks go, BitGrail claimed to have been hacked for $195 Million of XRB. Coincheck for $530 Million of NEM. The $250 million number doesn't ring any bells.

The 2019 hack was obviously Upbit:

Upbit is the latest hacking victim after losing $49 million at 9:00 UTC on November 26, 2019. An "abnormal transaction" resulted in a 342,000 ether loss in a few minutes. The exchange said that the loss didn't come from user funds and that it has suspended all functions for at least two weeks.

It's strange that they unsealed the indictment without naming any of the exchanges.

[Darker45]

[snip]

Something tells me that these North Koreans couldn't have made this hack successful if not with the assistance of experts from other countries. This launder attempt by Chinese individuals in behalf of the North Korean hackers who stole the funds speaks of possible connections other than this one. They could have been partners way back then. A hundred million USD won't be entrusted to these Chinese for laundering if they were not very trusted individuals.

I have serious doubts that ordinary North Koreans can pull off such huge operation all by themselves. It is either they are connected to their government itself or at least supported by certain powerful persons inside or they have the backing of foreign nationals, probably Chinese, who are knowledgeable enough about such operations.

They have the Lazarus Group, which believed to be state sponsored cyber criminals group inside North Korea. They have stage a lot of online hackers, prior to targeting South Korean exchanges, or any crypto related exchanges for that matter. So North Korea alone is very capable to pull this kind of heist specially against their nemesis.

But they colluded with the Chinese identified in the indictment to launder $100 million out of the $250 million they have stolen. So obviously, there are connections amongst thieves.

North Korean hackers are learning a lot from their mentors who are outside their hermit kingdom. It seems that they are now capable of standing on their own feet.

From the link you have given:

North Korean hackers are sent vocationally to Shenyang, China for special training. They are trained to deploy malware of all types onto computers, computer networks, and servers. Education domestically includes the Kim Chaek University of Technology and Kim Il-sung University.

From students of China, North Koreans are now not only capable of learning the skills, they are also offering them in their own universities. As you've said, state-sponsored. It seems the country is not only developing nuclear weapons, they are also raising an army of hackers.

[XCANA]

This can be related to the sanctions from USA to North Korea, they're finding other means to get out of the sanctions laid on them. Hope North Korea understand their movement as the group can be use against them in the future. For them to opening involved in training hackers at such level told us how desperate they're to embark on their Nuclear Weapons agendas, this huge sum of money can be use to fund some illicit projects against mass destruction. I wonder why the Chinese citizen joined in this mess because they will face the music squarely according to law. 

[kryptqnick]

It's good that the criminals finally got caught. Money laundering is something often put forth as an argument against Bitcoin, so it's important to distinguish casual Bitcoin users from people using it for their dirty business. I wonder what will happen to all that money. It's seized by the government now that these people are caught, right? Or is it just that the addresses are known but access is not granted? It seems from the report that at least some funds are seized. I wonder why in these situations the US government doesn't return the money to people who filed official complaints about being scammed. Auctions don't seem like a perfect solution in this situation to me.

[omone1]

I hope the government can help recover the rest of the fund, and see how to refund the victims. There must have been some level of conspiracy with some regulated organization in this deal. It's good to know that people kept track on the stolen funds. They thought it was already a bygone issue.

[gentlemand]

Interesting. As far as I know this is the first time anyone's mentioned North Korea's methods. I often wondered how they turned their hacks into money they could use. Seems a bit amateurish to me but if it gets the job done then so be it.

[davis196]

I still find it amazing how NoKor keeps on pulling the strings to make their moves outside their country and not get caught sooner. Their relationship with large banks and other organizations/institutions is unbelievable too, so much that they managed to amass hundreds of millions of dollars through illegal activity without hitting any red flags. That's why I always look up to the North Koreans as extremely cunning and dangerous even though their country is deprived of anything to the outside world. Good thing their moves are snooped by the authorities even though they initially used bitcoin to cover tracks first. I just wonder what certain cryptocurrency ezchange are they talking about anyway?

North Korean hackers (which are most likely connected to the North Korean regime) can't go anything without the help coming from China.Anyway,I don't care about Kim Jong Un and his minions.It's good to know that there is justice and any crypto exchange hackers that manage to steal cryptocurrencies worth millions of dollars,will eventually get caught and punished by the law.There is a big black market of crypto/gift card buying and selling.I wonder why big companies like Amazon and Apple(owns iTunes) won't just stop selling their gift card codes.

[BrewMaster]

In relation to that,  US Department of Treasury added 20 known BTC address of the two
The following individuals have been added to OFAC's SDN List:

what exactly is the point of this?
they aren't moving the coins to any centralized place (such as exchanges) for anyone to be able to block the coins. not to mention that these addresses could easily changed (the coins send to new address, maybe run through a mixer) specially now that it is publicly announced!

[eaLiTy]

I have serious doubts that ordinary North Koreans can pull off such huge operation all by themselves. It is either they are connected to their government itself or at least supported by certain powerful persons inside or they have the backing of foreign nationals, probably Chinese, who are knowledgeable enough about such operations.

The stakes will change because these sort of huge hacks will be state sponsored and North Korea is a nuclear power and if a country can have those technology then they can have a cyber army who can exploit any loopholes and they are doing that for years and with all the sanctions imposed on them i will not be surprised if they carry on these hacks sponsored by the state. 

[Yaunfitda]

In relation to that,  US Department of Treasury added 20 known BTC address of the two
The following individuals have been added to OFAC's SDN List:

what exactly is the point of this?
they aren't moving the coins to any centralized place (such as exchanges) for anyone to be able to block the coins. not to mention that these addresses could easily changed (the coins send to new address, maybe run through a mixer) specially now that it is publicly announced!

We really don't know, I'm also baffled, maybe they are going to monitor those addresses, similar to @whale_alert, and then track it down. They have all the tools, they could hire third party blockchain analysis company like Chainalysis or Ciphertrace to follow and see where the coins are moving.

[Slow death]

I wonder what the prison sentence will be for these guys? 30 years? 50 years? or will they stay in prison for life? which is unacceptable Is that the North Korean regime still exists in this world. I think that all countries in the world should come together to fight regimes like those in North Korea

with all the sanctions imposed on them i will not be surprised if they carry on these hacks sponsored by the state.

I am of the opinion that more severe sanctions should be imposed on all North Korean leaders

[figmentofmyass]

In relation to that,  US Department of Treasury added 20 known BTC address of the two
The following individuals have been added to OFAC's SDN List:

what exactly is the point of this?
they aren't moving the coins to any centralized place (such as exchanges) for anyone to be able to block the coins.

the way the DOJ describes things, they have been cashing out through centralized exchanges this entire time, going back to 2017:

The North Korean co-conspirators circumvented multiple virtual currency exchanges’ know-your-customer controls by submitting doctored photographs and falsified identification documentation.

not to mention that these addresses could easily changed (the coins send to new address, maybe run through a mixer) specially now that it is publicly announced!

true, but chainalysis and similar companies integrate peeling, mixing, and coinjoins into their analysis too. they analyze activity dozens of hops in either direction to see when outputs are re-merged.

the designated addresses put pressure on exchanges to do the DOJ's job for them, and to refine their AML process in general. most exchange TOS show they are terrified of violating OFAC sanctions, so this sort of thing shakes them into compliance.