FLIPPING COINS

Hackers working for the North Korean regime are laundering stolen crypto through mining services to throw tracers off their trail.

IN THE CRYPTOCURRENCY ecosystem, coins have a story, tracked in the unchangeable blockchains underpinning their economy. The only exception is cryptocurrency that's been freshly generated by its owner's computational power. So it figures that North Korean hackers have begun adopting a new trick to launder the crypto they steal from victims around the world: pay their dirty, pilfered coins into services that help them mine clean new ones.

Cybersecurity firm Mandiant recently published a report on a prolific North Korean state-sponsored hacking group it calls APT43 (also known by the names Kimsuky and Thallium). The group, whose activities suggest that its members work in the service of North Korea's Reconnaissance General Bureau spy agency, has been primarily focused on espionage-hacking think tanks, academics, and companies worldwide since at least 2018. Its typical MO is phishing campaigns designed to harvest credentials from victims and plant malware on their machines.

Like many North Korean hacker groups, APT43 maintains a sideline in profit-focused cybercrime, according to Mandiant, stealing cryptocurrency to enrich the North Korean regime or even just fund the hackers' own operations. And as regulators worldwide have tightened their grip on exchanges and laundering services that thieves and hackers use to cash out criminally tainted coins, APT43 appears to be trying a new method to launder ill-gotten funds and prevent them from being seized or frozen. It pays the stolen coins to "hashing services" that allow anyone to rent time on computers used to mine cryptocurrency, harvesting newly minted coins that have no apparent ties to criminal activity.