How This DOJ Strike Force Hunts Down Cryptocurrency Criminals - Ep.195

Transcript

[Music] hi everyone welcome to unchained your no hype resource for all things crypto i'm your host laura shin a journalist with over two decades of experience i started covering crypto five years ago and as a senior editor at forbes was the first mainstream media reporter to cover cryptocurrency full-time subscribe to unchained on youtube where you can watch the videos of me and my guests go to youtube.com c unchained podcast and subscribe today crypto super app that lets you buy earn and spend crypto all in one place earn up to 8.5 per year on your btc and more than 20 other coins download the crypto.com app now to find out how much you could be earning

today's guests are magistrate judge zia faruqi and jesse brooks assistant u.s attorney in the national security section at the united states attorney's office welcome xia and jesse hello thank you thanks for having us you've prosecuted a number of federal criminal and civil forfeiture cases including cryptocurrency involving cryptocurrency including some of the most well-known ones such as the welcome to video case which led to the takedown of one of the web's largest child pornography sites in a case involving the north korea-affiliated lazarus group plus another one involving hamas and the al-qasam brigades how did you two come to prosecute so many cases involving cryptocurrency

i i i can go first and then i'll let zia sort of explain because i think our roots are actually very different i started and cut my teeth in the superior court division at our office prosecuting mainly domestic violence and sex offense cases during my time prosecuting sex offense cases i learned an expertise in the revenge porn world which is where individuals sort of use cyber techniques to put out explicit photos of people that either broke up with them or upset them in some way and i got really interested in the cyber world and then when i moved to the national security section i was lucky enough to team up with zia who had already

developed this amazing expertise in this field and from there it sort of took off zia and his team that he had developed and then i got to jump in and help develop as well had created this amazing world that's leading the forefront of doj in these kinds of cases sure yeah thanks so much so as you said i'm now a judge so i'm no longer a prosecutor so i can speak not in my role as a judge but talking about as a prosecutor starting in 2008 until uh september 11 20 uh 20 uh was prosecuting cases kind of what led me to the path of cryptocurrency was uh my focus was on money laundering and asset recovery for victims and it seemed very clear

you know early on there was like people who started a lottery money in second life or there was this uh initial sort of trend of like you know is virtual currency uh something that criminals would get into uh and one of the the most fun things about being a prosecutor is seeing the ingenuity of criminals like they're finding new and fascinating ways you always think oh man if they'd only channel these powers for good think of all the things they could do but it is it's like a game of chess and you know between uh prosecutor investigators and uh people who are violating the law that they're you're always just trying to catch up and keep up with them and so uh you know several years ago about like five or six years ago another couple prosecutors over from maine justice uh particularly one alden pelker

and then jesse uh and i then also worked with another colleague chris brown uh who was at the done a lot of big cryptocurrency cases including currently uh cases that are charged uh in the district court like uh mixing cases and things like that uh we all just sat down like we need to have like a more coordinated way of coming at this problem and different agencies of different expertise irs is at the forefront they're super smart about getting in like working the blockchain and hsi is really good with undercover and fbi has this national security portfolio and so uh we kind of formed our own informal strike force uh which we called because we thought it sounded cool and we wanted to make t-shirts that said that strike force and so um it was i think like anything in federal

service it's like there's a lot of um elbow room to kind of grow and try out new things and you just want to find people who are mission oriented and like excited about trying those new things and so we were able to kind of organically find a group of people who are interested in cryptocurrency and uh kind of uh each had our own different strengths that we could play on each other on i like the strikeforce thing it you know doesn't sound exactly how like government normally work you imagine it would typically be very bureaucratic but i like that idea that you just called it back because it sounded cool um so let's dive before we dive into the details on these cases let's actually just establish some facts for the listeners because i think even before um you know

researching this i didn't really know some of the stuff but most if not all of these cases are civil forfeiture cases what is civil forfeiture and what happens in a case like that sure i could take that one uh so civil forfeiture um is interesting because it's you know it's so different than your normal criminal case like in a criminal case it might be the united states versus the for rookie right like that's against a person but civil forfeiture is against the thing it's you know united states versus 220 cryptocurrency accounts or united states versus one ford truck uh it's a way to go after things it's a less punitive way of enforcing the law you don't have to actually arrest a person and try to take their property you can just go directly

against the thing and then people um you know the burden of proof is still in the government uh but that people then can come forward and say like hey actually this thing belongs to me and there's a process by which then the court then says like has the government met its burden of proof to show this was involved in the crime or proceeds of the crime uh and if it is then the person sells a defense to say like look i had no idea someone was using my car to commit this crime i had no idea if someone was using my bank account to do this and then they get that the property returned to them if they can prove that and if i could just add there's a whole spectrum of civil forfeiture i mean it can start as small as someone you know

forfeiting your property and after they seize it you know at a at a stop of some sort to the kinds of cases that we deal with which is seizing a domain that might be um proffering terror spot terrorist finance or child pornography so there's a whole range and you know they can differ in many ways but at the end of the day it's a civil forfeiture kind of action and so i i and maybe this is sort of just um part and parcel of what we were just discussing but um you know what like if you know that a certain person is affiliated with one of these properties then why wouldn't you just make that person a defendant is that just a different type of case

or how does it work when when you have that connection sure well i can start and see if you wanna you know go from there and add um to it there's a lot of reasons for it first of all there's a different level of proof um for civil forfeiture and criminal charges um and it most importantly probably goes to what zia just said which is that the civil action is against the property not a person and the criminal action is going to be against a person and with a criminal action you have to prove a men's rea you have to prove which is an intent that goes with each statute and there's a lot of different steps that go with that um that lead to our high burden of proof that you know the government takes on proudly

um but with civil forfeiture it's all about the property like what is about this property that was involved in wrongdoing in some way so there are a lot of considerations that sort of differentiate the two and there are a lot of nuances that help prosecutors decide whether they want to go the civil route the criminal route or you can dual track it as well the one the one thing i had is that you know there's a lot of people who are uh have commented about department of justice actions that they um you know they do what's called name and shame indictments or there may be someone in north korea uh or there may be someone in syria that they can't actually get their hands on the actual person it's like what have you accomplished by doing that and so civil forfeiture is important because it's an actual way to

have concrete disruption in national security cases where in the kind of name and shame uh you know that that person's life is not necessarily impacted in a civil case like you might know someone in north korea has stolen these funds and things like that but they're not if they never leave north korea what is the point of criminally charging them necessarily um but the civil you actually go and seize the funds you're actually able to get the money uh so there may be instances many instances where you take the less punitive route of civil forfeiture because what is the point of adding those additional resources to criminally charge someone that you would never get um a chance to actually prosecute you can't criminally prosecute someone absentia they have to actually be present in the united states in the united states district courtroom all right so now let's turn to some of

these cases um there's one pretty interesting one um in which the government maybe uh at least you know from your from your work you were able to run a terrorist website for the first time um and that was involving a hamas group called al-qasam brigades why don't you just start by describing who they are sure the al-qasam brigades is the military wing of hamas and they're a designated terrorist organization by the us government which lends itself to certain types of restrictions which include sanctions and if you give any material support to them the material support charges

so that designation is is important and in that case it was sort of part of a larger campaign that zia and i led against taking down and dismantling um three separate cyber oriented terrorist campaigns um two that directly involved crypto involved cryptocurrency and won that tertiary involvement and what were they doing with cryptocurrency sure so each of the three terror groups was acting distinctly but to speak specifically to the al-qasam brigade since that's what you raised in that case and it all sort of started on twitter but the alka-sound brigades put out an announcement on their

twitter publicly asking for bitcoin donations from their supporters and what it started out with was a static address for the supporters to send to and then from there we and the doj and our investigatory partners at irs and hsi were able to watch as the alcason brigades developed and learned more about cryptocurrency so eventually they shifted their um finance campaign from twitter to their websites which were alkassam.net all kasam.ps and and on those websites they started to say hey supporters send us your bitcoin by clicking on this and

again on those websites it was just a static address but purportedly to avoid any government and law enforcement detection they then changed their techniques and started doing dynamic addresses so each individual who wanted to donate would click on the website and an address would be generated for that supporter to donate to and so throughout that process the terrorist group was able to raise a lot of money from supporters all over the world through a lot of work from our amazing law enforcement they were able to track both the addresses that the alka-san brigades was generating on this website as well as all the addresses that were sending to it and then through

our work there including multiple different legal techniques we were able to determine how the website itself was run and from there through judicial authorization was able to run the website for 30 days and how that exactly worked was that as part of our seizure action which is related to the civil forfeiture we seized the domain and sometimes when you seize a domain the domain name just is transferred to a splash page run by the government so essentially a splash page that says this website was supportive of terrorists or supportive of child pornography and so it's now owned by the government but in this case what we did instead was

redirect the website to a government-run website that was an exact mirror image of the prior terrorist website and through this our law enforcement and the government was able to run the website for 30 days and during that time people continued to visit the website and donate money to the alcason brigades throughout this until after that 30-day period when we filed our civil forfeiture complaint and the splash page was put up and just to go back to spell it out for the audience so why was it that they switched from just one particular address to these dynamically generated addresses because of jessie brooks because of jesse brooks that's right

yeah no because she went and got their money right it's the cat and mouse sorry go ahead jesse yeah i mean at the end of the day like terrorists are trying to avoid law enforcement detection too and they're learning while we're learning and they can tell that we're investigating their cases we're freezing their assets we're starting to figure out what's going on here and so we began to work with virtual exchanges to freeze assets and from there they decided that they needed to change their techniques and you know terrorists used to rely on financial institutions they still do but they're developing and now we're learning more about cryptocurrency they're we're watching them develop more and more and learn more and more about cryptocurrency which is in this specific

case they move from static to dynamic which is much more difficult to track but because we sort of already knew what was going on and we had a head start on it and so how were you able to find all the addresses that the generator was creating plus all the addresses that sent to them i mean well i guess maybe that part isn't as hard once you have the address but a magician never reveals their secrets uh they have to tune in to the sequel podcast when we uh we give the peak behind the curtain but yeah i mean i think it's as jesse said it's the tremendous work of the you know irs agents uh christian chesky the hsi agent bill capra i mean these guys were working a ton with the fbi partners uh to go through and really

figure out uh you know what was going on uh and they use you know sophisticated tools i mean you saw on a press release there was a reference as well chain analysis has done a couple presentations uh that they participated exigent was another contractor so i think it was you know just look i mean the agent spent a lot of time working it's not like um there's no one trick that just it's work right like they're working with using the legal tools like jesse was saying oh search and seizure warrants to get email content or get financial records from subpoenas uh leveraging relationships with overseas partners and then you know undercover work it's a little bit of everything and i think something that was really special about this action and the follow-up ones is that it was an interagency effort all run by people that actually really

care and are interested in cryptocurrency um and who sort of believe in what cryptocurrency is trying to do so we were all just trying to figure out who are the bad actors using cryptocurrency and how can we attack them because the doj and these other agencies are just trying to understand these virtual assets and make sure that they're not used for that and earlier when i asked about al-qasam brigades you said there were also other groups so what happened with those what were the how were they using bitcoin or cryptocurrency sure so i can um speak to that so there were two other campaigns that were rolled out as part of this large dismantling that zia and i led along with our law enforcement so the

second one was al-qaeda and they were using telegram so what was another interesting thing other than cryptocurrency is that in all three of these actions the terrorist groups were not only relying on cryptocurrency but also relying on social media and new techniques just sort of showing how they were becoming smarter when it comes to using cyber tools so al qaeda through telegram was raising money for really violent causes i mean not being shy about what they were asking for money for you know pictures of weapons pictures of military gear and seeking donations of different cryptocurrency um to help support that um and what was sort of upsetting and um disturbing about the whole thing was

that a lot of the telegram channels were hiding behind charity names and so uh the they made it sound like it was charity for individuals that were refugees or people that needed help in syria but when in fact they were really just raising money through cryptocurrency for um you know violent causes and so through a lot of the same agents and the same sort of interagency effort that was similarly completed all these telegram channels were tracked including all the different addresses that received cryptocurrency on behalf of these violent causes so those were seized and sought for forfeiture as well in a separate civil forfeiture complaint so that's the second one and then the

third one was an isis covid related case and so this was less centered around cryptocurrency although there's some cryptocurrency involved with it but this case was similarly devastating in that it was isis taking advantage of the covid outbreak all over the world but particularly targeting the united states creating a website and multiple facebook accounts that linked you directly to this website that was selling fake ppe and this website was created pretty soon after covid started spreading pretty wildly in the united states and there was very little shame in that they were selling to customers in the united states that had purported to serve hospitals nursing homes such such things

like that and so through our action same sort of interagency effort and just following um the social media campaigns we were able to seize that website as well as the facebook accounts as well and uh actually just to go back and ask uh you know and and this may be the case for all of them but i especially noticed it with the occasion brigades you weren't naming unhosted bitcoin addresses in your complaint meaning ones in which the al kasam brigades were the people who had the control of the private keys so how do you seize funds from an address like that in which the owner is you know really just the person who controls the private keys

i think there's a couple different ways we go after unhosted wallets right one is that we might be able to use legal tools like through warrants or uh through co-operators or someone who could get us uh recovery seeds uh who can get us a private keys uh you know we may be able to collect that information ourselves and get that uh in other instances uh it's more treating it like the stolen art model and so that we uh basically you know you think about what happens when a famous peace art is taken out of museum is that by publicizing that that is uh something that is illicit it collapses the resale value of that and then it also allows you you know so the person who then maybe stole the mona lisa it's worth you know 100 million dollars it's now worth maybe 10 million dollars or 50 million

something much less but then not only have you collapsed the resale value anyone that's legitimate that then does business with that they should be on notice and says like well you know they you know the museum that then or the uh then goes and rebuys it or something like that if they fail to do their due diligence and knowing that there is this in the art world there's a stolen art crime index like people check that first before they purchase it uh you know they could be subject to uh you know potential money laundering or other criminal charges so the same thing here with cryptocurrency addresses even for the unhosted wallets for the ones where the government can't go and recover it through legal tools uh you've not only now reduced the value of it uh because that now people know on the like that's the beauty of the blockchain

right it's all public you don't have to have this highly sophisticated stolen art crime index it's out there for everyone to see oh my gosh yeah this one address is allegedly part of a criminal terrorist scheme i'm not going to if someone on local bitcoin sets me up and says like hey i want to send you and do a currency exchange and then i see what address is coming from like you don't need to be some big bank with a sophisticated aml program this is something anyone can do from like the ease of their smartphone but moreover cryptocurrency exchanges absolutely are looking at those addresses and that they're looking at you know analysis elliptic trm all these other big uh it you know entities that are doing this sort of analytical work they're highlighting those addresses and pushing that out to exchanges so those exchanges know like

this is functional like an ofac sanctions list and what happens if they do something like send the money to a mixer or um you know is that something where then the mixer would reject the funds or how does that work i think it depends on the mixer right like no no different than a cryptocurrency exchange i mean some you know there are cryptocurrency exchanges that conduct no kyc uh and in fact are avowed and that they want people uh to come and bring their illicit proceeds there um you know the department of justice has charged a lot of those cases as i said uh we have one here in d.c that chris brown and that team from irs uh matt price's charge involving uh the graham helix case and so uh you know one of the allegations in those charges relates to

alleged money laundering or you know when funds come in uh not questioning the source of it uh so absolutely i mean i think you know in the sanctions context or other ones it's the financial institutions that are the gatekeepers and so doj has gone after them right you can't necessarily get to the individuals because of the volume but what you can go is to go to the gatekeepers and say look financial institutions and that at bottom is what a mixer is that's what this recent decision from the dc district court has said in that case but as well as from all our other cases and fincen has said as well it's like you when you're exchanging you're a financial institution you have to do aml work and if you don't you could get prosecuted and so now just to go back to the um isis and uh sorry al qaeda

case i wanted to ask a little bit more about that telegram group where you said that they were disguised as charity groups when people would go into the groups would they realize kind of what the purpose was of the donations or was that also masked once you were in the group so a lot of this is spelled out in the civil forfeiture complaint which is public but we can't possibly try and get into the head of everyone that went and visited or even the ones that maybe donated but at the end of the day um for it was pretty clear from the postings uh when there's a pic if it's called you know a charity xyz the posting would have a picture of a weapon and so raise money for purchasing this or raise money for this cause

so we don't purport to know what every single person was thinking but at the end of the day it was pretty clear from these telegram channels what the purpose was i think dovetailing on that just really quickly uh you know as a muslim american one of the things that there's always this fear i was like oh if you're donating to a charity is this charity one that's actually doing what it says to you and then frankly that's true of everyone right like when you donate to any charity uh but in particular um there have been charged criminal cases of charities in the past that were financing terrorism and donors sometimes like well oh my god i had no idea that's doing it so i think part of the work that the team did here was so important because there there were these charities nominally that we're doing that where

people may not have known that right and i think again to the credit of jesse and the team there weren't donors that were charged right it was just going after the institution that was collecting the money but part of again like that stolen art model now people are on notice like if you google that charity do any basic uh sort of foundational resource research on it you're gonna see like oh my god not only when i go in the telegram channel and like look three or four layers down do i see pictures of machine guns i'll see that they were named in a government complaint so i know that this is not like a safe space to donate uh funds to uh you know and they were highlighting the anonymity and things like that and so i think that it was you know uh apparent but now it is very

apparent that what they were doing yeah that's something that fascinated me a little bit about when you took over the alka son brigade's website all cause you know all cassand brigades could have very easily just told people hey we're not in control of that website anymore and i believe they tried to so what happened then why did people still go there and use the site yeah that's so interesting and i remember we sort of worked through that before it all happened like what if this happens is it really worth it should we just put up a splash page but at the end of the day people want to believe what they want to believe on the internet and on we had a website that looked exactly like the old website

and if people wanted to think it was the same thing great what actually happened was that the elkason brigades tweeted out um through using the methods of their original campaign financing that their uh website had been taken over but at the end of the day no one really knew if it was the twitter account that was hacked or the website that had been hacked and you know people continued to donate and part of it was you know maybe some people believed that and some people stopped visiting the website but we also wanted to sort of show that like the doj sort of knows what's going on here and when people go visit a terrorist website we want them to be uncertain whether they're visiting a terrorist website or the doj and maybe hesitate before they donate

money because one thing that's very important to us is that in these terrorist financing cases when we seize money it's uh we try and direct it towards this victim's funds that's for victims of terror and that's run by the doj and there's a few rules about how the the money gets in there but our hope is that at least a big chunk of the money that we forfeited here including from people that were donating to terrorists both when the doj ran the website and when it was actually a terrorist website is going to be redirected to victims that have suffered you know unimaginable crimes from terrorists and um so i know we already just touched on this very briefly about the face facemaskcenter.com and you know as you

mentioned the role of cryptocurrency here was fairly tangential but i still wouldn't ask so exactly how were they using cryptocurrency and you know i i just find it fascinating that they used this crisis with covid to um to try to perpetrate this scam again that goes right to the ingenuity they're they're always coming up with new ways and you know as jesse said the website sprung up just you know days after that covet crisis started and so the connection to cryptocurrency is that uh zubair shannaz was charged in new york uh about i think like a year and a half ago and pled guilty uh and so she was sending money to uh the person who is identified in uh the

forfeiture complaint uh and so uh what what she was doing was that she was getting through isis was getting stolen pii you know people they're stealing their personal identifying information uh and and credit cards in particular using those credit cards to buy crypto to launder it immediately turning around and selling that crypto exchanges and then that way having laundered it so they can say oh if someone asked them like where did you get this money from like oh well i i sold a bunch of crypto right then you know law enforcement or banks or virtual currency exchanges aren't looking one behind that to say well where did you buy that from oh it's from the stolen credit card and then that money was going to isis and so after shanaz gets arrested and pleads guilty about sending money uh over to the uh isis financier

um this immediately springs up right it's like it's almost like a relay race like they had this one path of using crypto to get stolen pii and buy crypto uh and then laundered into fiat currency and sent to isis that's it shuts down they started this website and you would anticipate again on the website they were taking money uh any which way it could come in so uh one would anticipate i think that there were some allegations potentially that they would accept cryptocurrency for the stock the fake ppe but more importantly it's the same scheme they just want someone to send them their credit card information send their pii they think that they're going to be buying you know you know a thousand uh masks but instead all they've done is given all that identifying information to isis and that they would do the same

thing again use that to buy more crypto launder to get into fiat and so that the goal is not to just make the 58 or 50 000 sale of the ppe that's never gonna come it's to get that information and use that to buy a bunch of crypto which they see clearly as a way to launder money quickly and efficiently and then you know just get a good exchange even if it's not like a great rate but then they've laundered it they think effectively okay but i mean you're saying that that's their assumption that law enforcement won't go beyond that one step of looking at where the bitcoin came from right that but obviously that's not the case because right yeah exactly exactly yeah yeah um we caught her um but yes

that is uh the assumption often that i mean that's what you know money laundering at bottom is you're just trying to put a bunch of logical steps in between the illegality at the beginning and where you are at the end and to try to like hide how the money got there but if someone you know the determined law enforcement team of the hsi irs and fbi team they continue to peek behind what's behind door one two three four five they finally get there uh and you know at the end of the day that's how they're able to they see like okay there's an illicit source but uh you know they're they're trying to go scatter shot and just put up one layer of uh concealment because that might be enough to get past a kyc check or a aml check at a bank or a cryptocurrency

exchange all right so in a moment we're going to talk about some cases involving north korea but first a quick word from the sponsors who make this show possible crypto.com the crypto super app that lets you buy earn and spend crypto all in one place earn up to 8.5 percent per year on your btc download the crypto.com app now to see the interest rates you could be earning on btc and more than 20 other coins once in the app you can apply for the crypto.com metal card which pays you up to eight percent cashback instantly on all purchases reserve yours now in the crypto.com app back to my conversation with zia and jesse so you also prosecuted a case involving

the north korea affiliated group lazarus and that involved 250 million dollars worth of cryptocurrency how were they able to amass such a large haul yeah no i mean it's it's fascinating to look in the complaint uh and again uh it really details out so we can't uh show it here but i encourage people to go check out the press release has a copy of the very detailed charts that uh the irs special agent chris yancheski drew up but it it showed i was impressed by the charts well i can't tell you how happy he is now that he heard you say that because nothing makes him happier than that um uh he recently uh told his wife that he was really excited someone had talked about greatest charts where and she was extremely unimpressed she just doesn't understand him or get

him but um you do so it's great and we do as well but yes uh you know so that hack uh it was a hack right and it was really interesting it happened after a previous hack that's allegedly attributed to north korea is that they went to a cryptocurrency exchange and said hey uh you know we have a bunch of whale clients that have a ton of money they want to come invested with your exchange we're just worried about these hackers out there and so we have an attached uh questionnaire to this email that's gonna review your opsec and things like that and make sure that yeah yeah that that you um that you are in fact secure and compliant and so in many ways they failed the test right one because they clicked on the attachment uh and two because then um when the attachment was there it had

a bunch of malware and so the complaint details how the language and the script language that's used is consistent with how uh north korean hackers have operated and through other things within the complaint uh where like their vpns were able to be penetrated by law enforcement and things like that where they where they were able to attribute it to north korea but it's just again that sloppiness uh you know of it just takes one bad mistake uh by someone in the security team or in the new the client kind of relation team at a cryptocurrency exchange that they were able to do a complete takeover and get to not only uh the hot walls but also get to some of the cold storage funds which normally you think shouldn't be able to happen uh but they just totally took over the system and so

from one exchange right one bank heist my favorite uh new yorker cartoon uh that we use in all of our presentations as a guy goes into rob a bank and the guy's giving the money over goes you know you can do this all online now right and so instead of one bank robbery where there's the risk of violence and like you know the security there this is from the the safety of the north koreans you know uh house or whatever they're sitting in they're able to steal 280 million dollars in one fell swoop and then you see in other hacks and it's describing the complaint and the second related complaint is that like they are out there just spear fishing all day every day looking for people who are um well known in the crypto world either to assume their identities or to go after those people to take over

their identities again with the goal of hacking exchanges or getting access to exchanges where they can get that kind of money yeah in general um you know their techniques just seemed um you know so basic isn't the word because it sounds um unsophisticated on their part but what i mean is it's not something where you need to know coding or have any kind of fancy computer programming knowledge it's literally just trading on people's gullibility or um yeah and so earlier though you said something about how it was in line with other north korean um i i didn't understand that like what what was it about previous north korean hacking behavior that lined up

so we looked at the actual malware we got a copy of that from the victim and when examining that malware the way that the scripts were written in it that allowed them to take over was consistent with other hacks that have been uh documented with north korea so we used a couple different things like we use as i said the penetration of the vpn and the language and the scripts and all these things we stack like they don't say at the end of the day it's us north korea um but like you know that the language that was used in the scripts uh additionally there was a couple things where we looked at some of the other information that they were researching and some of things were researching things about the north korean military so it's possible right it could be someone in kansas who just happens to use the same um

script language and uses a vpn that traces back to a north korean cell tower and also researches a lot of information about the north korean military but more likely right like it that that's reflective of the fact that it is in fact north korean actors all right and one other thing was that some of the money was these strange coins like proton token and olive and betherium i've literally never even heard of these so why would they do that yeah i mean uh in the most recent complaint uh you know there was uh algo tokens there was all sorts of uh different coins and there you know one of the things that chris talked about in the complaint is uh the chain hopping that occurs and that they're trying to move from one

chain to another i think no different than when someone has steals money from a bank they might try to exchange it into euros and then from euros into yen and then renimbi and back to dollars uh because they think again they're obfuscating the trail and to some extent they are right like we can subpoena uh well doj can subpoena uh the you know u.s banks and things like that to get that information but it's much more challenging to get it from foreign banks or things like that and so i think what chris talks about in that most recent complaint is that part of what chain hopping has done is to try to break the public you know blockchain ledgers and try to divorce things out so you can't see where things are moving from one currency to another so they might use a really rare

currency and remember they're willing to take pennies on the dollar like the reason that you i and jesse won't you know deal in these coins is because like they may not have the availability or like people may not be interested in them or you might get a lot less bang for your buck but when you have 280 million dollars like you're happy to get a 50 yield rate that is a bank heist uh that is unprecedented right if you get 10 it's huge and so not only um does it obfuscate what you're doing you know it may be an easier way to find some people who are willing to sell it but what's interesting is that chris draws back in that complaint uh is that they always come back to bitcoin right like because no one has heard of these coins and at the end of the day they do need

to get to fiat so like they may go through all this chain hopping and then they circle back to bitcoin and that's where chris and the irs team and bill and the hsi team and kyle and fbi team they're able to really leverage all of their expertise in the known bitcoin uh to then figure out like wait a minute we can you know going back to that example of let's go back three four four more to see where did this coin have never heard from well how did that coin get funded and so talk about that a little bit more like why it is that they always come back to bitcoin like you started to say it but just flesh it out for people because i mean yeah you know it's also the the blockchain that has often led prosecutors like you to the criminals so why would they do that

uh you know this is the question whenever anyone jesse and i talked uh uh when i was a prosecutor about like our practice in the fiat side of like uh you know terrorism financing north korean sanctions violations all we would say is like uh because north korea was allegedly buying this thing in u.s dollars they're subject to these punitive criminal penalties we've seized all their money and they always say like you know someone raises their hand like why didn't they just use like chinese yen or euros and the answer always like yeah they should have and if they did we wouldn't have had a case and and there's always people like oh my god well they'll just stop using the us dollar because if you keep prosecuting this it'll drive them to other currencies that people feel like that they can get away whatever they

want to but you know the uh that just never happened and the same thing with with bitcoin is that you know you can buy a tesla with bitcoin you can buy subway with bitcoin you can't buy them with those other coins that you know that no one has heard of and so as they still chain hop to obfuscate at the end of the day they need to get this into fiat currency that is still the choke point where law enforcement will come in and where cryptocurrency exchanges really can be very robust in their kyc and the same thing is true for law enforcement is that they are waiting and they see when they come back to the to bitcoin because they want to buy things or because they want to get a better return rate or because you know people are like too sketched out they're like well i've

never heard of this coin and like you have no trading history on like one of these exchanges and so like no way i'm not gonna deal with this it's too suspicious um but if someone who has no trading history has never done anything but it's on bitcoin which is well known and trusted they're like well i'm willing to do that because everything's public and so like i feel safer and so i think for the all those reasons they always come back to bitcoin and i think just to hop off that something that zia and i have talked about a lot is that criminals don't want to lose their money either right and they want to rely on institutions that are or coins that are a little bit more stable and so at the end of the day um even though criminals might work in these other coins we might not

have heard of they want to get back to bitcoin so they can feel solid in whatever they have there and so once they do have the bitcoin you know as we mentioned you often are kind of um law enforcement is often notifying exchanges of uh coins or addresses that are associated with criminal activity but how are they attempting to cash out like how is it how easy is it for them to do so when they have these stolen funds there's a lot of different ways and a lot of different techniques that they use something that the doj frequently looks at is unlicensed money service businesses so those are people that are buying and selling funds whether they be cryptocurrency

or otherwise without uh correct licensing from the us government from vincent and so how that works in the crypto world is that there are these people that um sort of take advantage of what zeo was talking about is that criminals frequently just want to get pennies on the dollar and so they do these transactions where each person that's running this business is taking a little bit and a little bit more and so they're hopping through these exchanges or hopping through these coins with the help of these unlicensed money service businesses and that's one way that we're able to track it is that there are some people that or organizations or businesses that are run by a few people that are doing a lot of this business for criminals i think one thing that's also interesting like to your question of

that's the i think that's the hound like the how difficult is it like it's it seems like it is right and the goal of work like what jess is doing is to make it more difficult right you're never going to make it impossible but you just want to make it more difficult and i think that north korea complaint the one that you talked about uh highlights that so there after the complaint drops on like a tuesday uh within 48 hours there's an amended complaint like so why did that happen and if you look at the document uh it goes into it what happened is that there were unhosted addresses that had sat for over 14 months with no activity the complaint drops and immediately they start going frantically trying to cash those out which caused them the government to go immediately within 48 hours and amend

their complaints they're like hey here are these all these other dresses here's where they moved to move to and that's no different than like you know jesse's experience or mine from like you know street level drug crime right like when you when they hear the cops knocking on the door everyone's flushing everything down the toilet throwing things out the window or just trying to get rid of it right everything's got to go fire sale and that's exactly what they were doing in this case the north koreans see right after the complaint comes out oh my god this stuff is really hot we've got to get rid of it and they're just trying to push as much out as quickly as they can before the exchange or someone catches up or the government and there you know it wasn't within a matter of 48 hours all those addresses are then identified

sent back to the one or two exchanges i mean there was largely two exchanges that are referenced there and you know the government tells them like hey these are still those same people um you know i think analysis at the same time did a report where they talked about uh some of the new addresses that were coming out and warning people like hey here's where they're moving to now i mean that's that's what's that's what's incredible about like the blockchain right like if someone stole 150 million dollars from a a traditional bank right and they took that money in there there is nothing the public large could do but after a bunch of these hacks you had people who are watching the blockchain and they say like hey we're watching this happen right now live right like it is happening right now and they're publicly broadcasting that

information so it is why cryptocurrency in many ways is a much worse vehicle for laundering money because you it's not just reliant on jesse and her team you can have people who are sitting at home and watching this stuff and giving you know jesse's able to outsource instead of her just having her four agents now she has thousands of agents it's all the people listening to this podcast were like yeah this seems weird i saw this the weird thing on the blockchain and then they tweet about it yeah yeah i have uh definitely seen online forums where people are watching stuff on the blockchain and commenting on movements in real time um one other thing that i found fascinating about this case was that the north korean hackers were also using stolen identities to try to cash out how were they trying to do that and

where did they get those identities yeah that's um you know again to jessie's point right like she described how al qasam evolved from a kind of basic to getting more and more sophisticated um and the same thing with the north koreans right on the uh first complaint that you know there are pictures in it of people you know some exchanges i want you to hold up kyc with the picture right next to your face uh and that the agents were able to show like if you looked at the t-shirt and like the body it was the same body with just a different face superimposed and they were able to identify who those were and so that's pretty basic right and that you see in the most recent forfeiture complaint that jesse uh and while i was at doj that we did with our partners

over alden and jessica peck at doj that they started stealing people's pii right because that's way more valuable because that's an actual um you know that will pass some of the kyc filters that that were picked up on like oh this is an edited pdf like it's the same t-shirt forget about it that is genuine um and so where they get it from i mean the complaints just referenced generally that you know uh the united nations has referenced that in their panel of expert reports that north korea is known to hack exchanges there's no reason to think when they're hacking exchange they're just stealing the money right there's also something of great value there just like with that isis campaign the pii is just as valuable sometimes as much of the money and so they are going and stealing data in addition to stealing money

and you know that those complaints highlight that they're using those for nefarious things and i think it also highlights to cryptocurrency exchanges that like you can't just do the basic kyc and say like this is a real license like you need to say like you know do some follow-up questions or talk to the person you know people do like um skype and zoom chats now or they're talking to the person and it's not just like a photo selfie like so they can see because that is much harder to fake and get past aml control so i think you know industry will have to continue to catch up as law enforcement notes like you know your previous aml uh threshold your basement that's not enough now it needs to get raised yeah and i just realized we've been saying pii and i don't remember if we

told people what that stand for it stands for it's personal identifying information um so one other thing that i wanted to ask about was and you've mentioned it multiple times during the episode but you're you're um coordinating a bunch of different government agencies and often working with teams actually in other countries as well so how how do you make that happen um you know how do you figure out what are all the different agencies that need to be involved or which other foreign partners you need and how do you get in touch and also how do you i just make uh so many people across different um you know governmental agencies as well as jurisdictions come together to prosecute these cases i'll just start with that i mean it's all about finding the right

people and as a prosecutor your job is not necessarily to know every single detail of cryptocurrency or to know all the technical side of virtual currency exchanges but your job is to make sure that you are working with the right people and that you're using different agencies for what they're best at and understanding that some people have strengths in some ways and other agencies have strengths in other ways and at the end of the day and how i look at it and i know how zeal looks at it is like we're all on the same team you know we just want to ensure that terrorists don't get money we want to make sure that the cryptocurrency um and virtual currency exchanges are not abused so that terrorists and other bad actors can get money and so if you go into every

meeting and every email with that mindset everyone's going to want to work with you and everyone's going to want to accomplish that goal because that's why we're you know civil servants um and that's why we're you know going to work every day and so at the end of the day zia and chris put together an amazing team a strike force that i was lucky enough to be a part of and you know i will brag about zia and chris all day and and tell you how lucky i am to work with them um but from there we've been able to find people at a bunch of different agencies including hsi bill capper ryan landers and fbi kyle armstrong and also just people at the doj that really have the same goal that we do and try to avoid bureaucracy as much as we can in order to accomplish this goal

yeah one of the things that's sad about leaving is that you know i really enjoyed um getting to have the opportunity to meet with people so you know we went to south korea on the darknet child pornography case and um it's just really exciting to meet people from totally different backgrounds who have similarly motivated to like how can you try to make the world a better place right like it is cheesy but it's true like public servants i think in those roles um it crosses all boundaries and backgrounds and so like you know maybe something that you figure out late night over karaoke while talking to um a prosecutor or a police officer in korea you know we had partners from germany and from the uk and you know even here in the us like you know in the most recent action it

highlighted um that there was partnership with the united states cybercom and the department of defense and so i think um you know what's so different and unique uh about the job that jesse has uh that i used to work on is that you are the kind of uh center of that like you're just trying to be um find all the right players put on the right pieces on the chessboard to advance the mission um and that it's really fun to find those people because once you do it is organic you can't just say like it's one formula uh but once it happens you you go back to those people and you know they're just always willing to make sacrifices in their personal life and their work life they just want to get things across the finish line and just they're so motivated that it inspires you to work

harder as well yeah and actually we didn't really discuss it very much i just mentioned it briefly about the welcome to video which was i think one of your first cases if not the first involving cryptocurrency but actually why don't you just talk a little bit more about how you guys were able to prosecute that given that you know the person running that site was in a foreign country sure yeah so i mean that and that's a good example of one where we leverage both criminal and civil tools because uh we wanted to criminally prosecute uh because we did think there was a person that we could get into the united states uh and do that and so uh you know again that's the team at irs and then the homeland security agents out in colorado springs were working together

you know to jesse's points was about relationships uh you know we had a great relationship with the korean national police from a lot of the north korea work that we did uh and so we told them like hey you know the irs team after they did this great work in taking down alpha bay with some of their other law enforcement partners they're kind of like what's next and so uh you know very flippantly i remember having a conversation between uh one of uh the kind of people in our office who worked all these cases erie redboard and myself and were like you know what about child pornography and aries uh has a ton of experience in this and uh and so the irs team came back uh chris chancesky like two weeks later it's like yeah i haven't left my house in two weeks i found the largest dark

knight child pornography site uh and we should take it down and i remember i was just like wait what are you talking about he's like you told me to find a child pornography site because he said that's like the next big thing we should do and i was like yeah i mean i wasn't serious but okay i guess that's just you know be careful what you asked for and so um you know we quickly assembled a team uh again like the same thing jesse's talking about like you just gotta get good people and find them and so lindsey suttonberg was an expert in office on on child sex offense crime julie lee was an expert on cyber crime you know we had the investigators kim reese out in colorado and tom tamsi and as well as chris and then we you know we just got on a plane and we went

to korea and we said you know we had law enforcement partners there uh at hsi uh who had built relationships with the korean police and they said like here's what this dark knight investigation is and they've never really done a big dark net investigation but like everyone else they're like oh my god when they i mean you know don't want to get the details it's very disturbing but this is mostly infant and toddlers who are being victimized and so when people hear that everyone right almost everyone's just like how can i help what do i need to do tell me what i need to do i want to do this and so you know we had partners from the uk and germany as well who came along uh in particular uk that they were tracking on this and so kind of briefed them on the case came

back a couple uh pretty shortly thereafter and did a takedown where there was a full like you know korean police went they did a search warrant kicked down the door found the alleged uh administrative site on the site logged on which is always the key um you know they've done a lot of things to work to try to protect his safety because they're actually been some customers that had committed suicide privacy at previously after they had been discovered so they were very careful of that and you know the us law enforcement was watching uh via like remote to see what was happening while they're in korea and then you know immediately getting a forensic copy of the server you know we did a search warrant which you can do if the property is at a us embassy and so we're in the space there and then just recons we can constitute

the server there while we're there in korea and starting to build up lead packages for the hundreds of customers who are on this site you know and from that like this is why this is important is we found a new site and then we just prosecuted the administrator of that called dark scandals which was a site that showed not only child pornography but also uh videos of adults being raped uh all women being raped on it and being videotaped and getting paid in ethereum and bitcoin so again because we found one customer's site we then saw like where else is he sending money to these people typically this is not a limited habit and from that we found this other site and you know led to spin-off investigations there were 25 children that were rescued from actively being abused because the irs agent followed the money

right like because of the blockchain he could follow the money the hsi agents could go and you know exploit all of that data with their partners from exegen uh a private company that they worked with and chanalysis from that there are 25 kids today that are not being victimized and like you know there's no better feeling in the world than that than saying like you know what is a concrete thing that you can show that your work did well here's what hsi irs's work did is that they saved these kids and there are 300 potential pedophiles who are now not on the street because of them that's great that's amazing work i also did an interview about that with jonathan levin of chain alice's uh right when the news came out and i will link to that in the show notes um so how are you seeing the use of

cryptocurrencies by criminals evolve over time yeah i mean i think uh i'll hand it off to jesus i mean one thing is you know as again not a prosecutor speaking just in my former role we never really looked as much to policy and things like that we're more like here's the case in front of us we talk about what we see there but i think that we can give examples of what we saw right so like uh i'll let jesse talk about the terror finance uh campaigns but i can talk very briefly on north korea but we saw that they started i mean again i mean you don't want to say it's basic because obviously it's the the yield is so large but it's a bit basic i mean if i saw north korea i would tell them they're basic uh and that uh uh you know that

it it is slowly getting to maybe it's not an advanced yet but every day um there's there's there's steps forward because of jessie and her team and that their work that they're doing and so you saw the evolution from no kyc to um you know very badly edited kyc that was fake to stolen pi to who knows what's next and so i think that's just one example evolution i'm sure jesse from the tara campaigns maybe have some other examples sure and i mentioned this briefly before but like the fact that the alcason brigades jump from a static to a dynamic address generator which is not easy technology to create on a website particularly that big of a technological jump shows that they learned something or they got some more information and then you can just sort of watch you know i can't talk about really open

cases but you can see how criminals are starting to maybe just not direct deposit into the next address that they want to use but using mixers using tumblers but also just jumping through a bunch of intermediary addresses and learning to how to explain that process to the court is something that we are developing as well on our side because as the terrorists learn doj learns and virtual exchanges learn we're all sort of learning together and we have to figure out ways to teach the court as well that these new technologies are developing and that they're being used in improper ways and are you also finding that they're turning more to privacy coins i mean that's there's always the fear there right uh yeah um you know i think that's that's hard to say right that's

in part where the privacy coins have their appeal but i think you know kind of like we talked about earlier even when they go to that they still end up coming back to bitcoin because they need to cash out like they're not trying to just build up like a revenue i'm sorry they're not trying to build up like a federal reserve they need to spend money to buy things right and so um to the extent that privacy coins uh become more widely used and i think sure they're gonna continue to turn continue to turn to that but as long as bitcoin and ethereum dominate and people are just using that i think um you know again there's that they still have to find someone right like to engage in transactions either to exchange with them or to buy the thing they want and people are nervous i mean you know there's

obviously like some of the software platforms some of the big exchanges don't take they won't bank privacy coins and so i think that's no different than some you know big traditional banks will say like okay like i'll take in yen renimbi us dollar uh and euro but i'm not taking in like x y and z currency from another country because like i just think it's not reliable it's not safe like it's outside of my risk appetite so um there's still a lot of that i think and just to jump off that i mean at the end of the day what we're seeing criminals do is as cryptocurrency sort of expands and people know what it is more they're able to target more people as victims or as supporters so maybe 10 years ago if alka son brigade said hey supporters send me bitcoin there

wouldn't have been that many people who knew how to do that or really understood what bitcoin was now they can say hey supporters all over the world send me bitcoin or if you think about the twitter hack like hey let me just hack all these things and ask ask hack all these accounts and ask people to send us bitcoin 10 years ago that wouldn't have been possible so they're developing in that the rest of the world is catching up and understanding what cryptocurrency is um and also that can be a bigger way to hack into people's accounts and make sure that people are unbeknownst when they donate to these groups one thing i also wanted to ask about is this new trend with d5 which is obviously really taking off and um some people are saying that

decentralized exchanges could serve as mixers and make it easier for criminals and hackers to cash out what is your take on that and whether or not you know how do you think it is that the rise of defy could affect your ability to do this work yeah i think yeah just going back to the kind of previous ones like you know um we are limited in talking about like the cases we have seen and like what we've prosecuted and so kind of predicting what will happen in the future that's more like the people at treasury and policy kind of folks like i think they can really speak to that obviously there's a ton of stuff right now in d5 and um it's just so popular so you know when anything like this happens right like eventually criminals try to find a way to leverage that and so

i'm sure you know your next step podcast episode with jesse will be about a d5 money launderer and whether or not to act as a mixing service but i don't think probably anything that a valued i don't know jesse anything other than that yeah i just think that sort of what zia is saying like the regulations and the laws need to catch up to this as well like as new services and technologies are created we need to figure out how they fit within the current regulations and whether new ones need to be made and that's definitely a separate side of the government than us but you know we're here to sort of watch and enforce as needed and i also just wanted to ask you know there was a couple points in the discussion where one of you was saying that turning a cryptocurrency

is a bad idea for a criminal because it's easier for it makes it easier for people like you to do your jobs but in general you know as we're seeing the rise of um you know crimes using cryptocurrency obviously there's this whole trend the ransomware but you know then we've got these big state actors like north korea turning to cryptocurrency what in general would you say is the relationship between cryptocurrency and crime you know i i feel like one other thing i want to mention is that early on in cryptocurrency the narrative around it was that it was criminal money and clearly now you know that's not really the narrative i would say um we have all these big institutions that are getting in on it but i just wondered you know i really do think we're obviously still seeing that

criminals do enjoy it so i wondered what your take was on on that relationship i guess my sense is that there's still a false sense of security there um not everyone fully understands cryptocurrency or realizes that you know they can't hide behind a coin at the end of the day um and i think that that information has just not spread as widely as people in the world like we are um understand it and so although we've definitely moved past this whole like criminals are the only ones using cryptocurrency i think that's definitely true i think that um a lot of people are turning to it in order to be able to you know hide behind their current coins but at the end of the day criminals are still using fiat currency too they're just finding and shifting and

moving and you know taking turns in order to be able to try different ways and see what sticks yeah i think one thing you know it's fascinating jesse and i have uh there used to be this thing where you would get in this machine and go to another country it was called like international travel it's really hard to remember now but uh we've given presentations on cryptocurrency and it's amazing uh particularly when you're meeting people you know very sophisticated still understand cryptocurrency when they see the uh jesse with her doj insignia they're like why don't you i mean literally had people say like why don't why doesn't the us government just turn off like isn't this all criminals like people don't understand that like a that's not something that's possible but b my answer to them is always like you know people have been committing crime with

traditional fiat money for a long time and no one says to ban that so like i don't there's this huge psychic disconnect that i just don't get of like okay great like someone uses money to do something bad no one's talking about banning unhosted wallets and fiat that's called cash right like that's what cash in between someone's bed is it's an unhosted wallet right and criminals do that all the time jesse and i could tell you stories from when we had you know narcotics cases where you find 200 000 and someone's hidden in the floorboards of their floor i had a case with that once where it happened right and so like no one's like we should ban cash and so it's just it's a it's a false narrative and it's a question i think that it i hope that like you know if not you know years if not months and

days from now people will just stop asking like how much of crypto is um you know criminals like that's not the point right crypto is here people just need to learn to accept that and it sounds like as you point out big banks are starting to get that too right it's not just it's just not exchanges anymore and that like the problem isn't crypto it's a promise criminals and so like criminals will come commit crime with or without crypto the question is how can we you know as a society say like oh is this something that should or shouldn't be regulated i think that goes to jesse's point it's like doj is trying to find ways to follow up uh you know and i think their defense lawyers are doing a fabulous job of trying to say like wait a minute doj you're going too far

like this is not uh within that you you're using a regulatory framework for like western union sending money and that doesn't apply necessarily to someone just exchanging from one currency to another so there is this big open area right now for the law to get fleshed out um but that does not speak to the goodness or badness of cryptocurrency it's here to stay and people just need to learn to live with it i think my uh especially my more libertarian-minded listeners might really like your answer to that question um but in general probably my whole audience will because it's pretty level-headed and uh makes a lot of sense um all right well it's been so great having you both on the show where can people learn more

about each of you and your work uh well i think jesse now you can you can reach out to us on linkedin i think that's one thing we keep both i guess somewhat low profiles in general but jesse's got a bunch of big cases you can see i think doj press releases i don't know what else jesse yeah i think press releases are um probably the main way or linkedin i mean at the end of the day as as government workers we're part of a big team so every like success or prosecution or forfeiture that we have is the result of lots of people both named and unnamed so you know there's not any other way i guess to sort of track our our activity other than that but um we you know we want to thank you for having us here and also thank

everyone that helped us you know accomplish this and uh we hope to continue down this path great i mean one other comment i'll make is that you you guys did name a bunch of your other collaborators throughout the show so hopefully they um they will appreciate that um all right well thanks again and it was so great having you thank you so much thank you thanks so much for joining us today to learn more about zia jesse and the doj strike force check out the show notes for this episode don't forget you can now watch video recordings of the shows on the unchained youtube channel go to youtube.com podcast and subscribe today unchained is produced by me laura shin with help from anthony yoon daniel ness bossie baker shashank venkat

and the team at clk transcription thanks for listening you