The US Department of Justice (DOJ) has charged two Chinese nationals with laundering more than $100 million in cryptocurrency as part of an exchange hack orchestrated by North Korean perpetrators, according to a release. The laundering allegedly took place between December 2017 and April 2019. Multiple virtual currency exchanges’ know-your-customer (KYC) controls were duped by submitting doctored photographs and falsified identification documentation.
According to the DOJ, the funds were stolen by North Koreans in 2018. According to the pleadings, in 2018, North Korean co-conspirators hacked into a virtual currency exchange and stole nearly $250 million worth of virtual currency.
In the two-count indictment unsealed today in the District of Columbia, 田寅寅 aka Tian Yinyin, and 李家东aka Li Jiadong (usernames “snowsjohn” and “khaleesi”), were charged with money laundering conspiracy and operating an unlicensed money transmitting business.
The documents filed by the DOJ did not name the crypto exchanges where the defendants funneled the allegedly ill-gotten funds. But it did note that three out of the four exchanges were based in South Korea.
The complaint did state that the defendants utilized 113 different accounts and that law enforcement used commercial services offered by several different blockchain- analysis companies to investigate virtual currency transactions. The plan was to use a “peel chain” to obfuscate the path of the funds. A description of the peeling process is included in the complaint.
Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division said the defendants allegedly laundered the crypto to obscure transactions and to the benefit of North Korea:
“Today’s actions underscore that the Department will pierce the veil of anonymity provided by cryptocurrencies to hold criminals accountable, no matter where they are located.”
Assistant Attorney General John C. Demers of the Justice Department’s National Security Division said they had exposed a criminal network that had supported North Korea:
“This case exemplifies the commitment of the United States government to work with foreign partners and the worldwide financial services industry to disrupt this blended threat.”
U.S. Attorney Timothy J. Shea of the District of Columbia, called he hacking a grave threat to the security and integrity of the global financial system.
Internal Revenue Service-Criminal Investigation (IRS-CI) Chief Don Fort stated:
“North Korea continues to attack the growing worldwide ecosystem of virtual currency as a means to bypass the sanctions imposed on it by the United States and the United Nations Security Council. IRS-CI is committed to combatting the means and methods used by foreign and domestic adversaries to finance operations and activities that pose a threat to U.S. national security. We will continue to push our agency to the forefront of complex cyber investigations and work collaboratively with our law enforcement partners to ensure these nefarious criminals are stopped and that the integrity of the United States financial system is preserved.”
Assistant Director Calvin Shivers of the FBI’s Criminal Investigative Division said the FBI will continue to actively work to identify and mitigate illicit movement of currency.
“This case shows how important robust partnerships across the U.S. Government are in disrupting criminal actors,” stated Acting Assistant Director Robert Wells of the FBI’s Counterintelligence Division.
The forfeiture complaint seeks to recover the funds, a portion of which has already been seized.
The charges in the pleadings are merely allegations, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) also imposed sanctions on Yinyin, Liadong, and numerous cryptocurrency addresses related to their involvement in activities facilitating North Korean sanctions evasion based on their services and support for malicious cyber-enabled activities linked to North Korean actors.
The investigation was led by the IRS-CI, the FBI, and HSI. The Korean National Police of the Republic of Korea provided assistance and coordinated with their parallel investigation.