Norway finds a way to recover crypto North Korea pinched in Axie heist
- Reference: 1676610906
- News link: https://www.theregister.co.uk/2023/02/17/norwegian_authorities_found_59_million/
- Source link:
The Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim) has [1]called the seizure among the largest ever money seizures – and the largest-ever related to crypto – made by Norway.
"Økokrim are experts at following the money. This case shows that we are also good at following the money on the blockchain even though criminals use advanced techniques to avoid detection," [2]said senior public prosecutor Marianne Bender.
[3]
The agency said it would work with the owner of the Axie Infinity game, Sky Mavis, to return the funds to its victims.
[4]
[5]
Axie Infinity allows players to win Ethereum. Sky Mavis refers to the game as its "flagship product" and the "#1 game on Ethereum by daily, weekly, and monthly active players."
In March 2022, $620 million was stolen when attackers gained access to five out of nine private keys used by transaction validators for Ronin Network – the Ethereum-based DeFi decentralized finance platform used by Sky Mavis. The game publisher describes its Ronin side chain as "a tool that allows game developers to deliver the benefits of blockchain to their players without any of the complications."
[6]
Once the attackers gained access to the organization they approved crypto transactions, then immediately began to launder the money through Ethereum-based crypto mixer Tornado Cash, which is now the target of US sanctions. In September 2022, US authorities [7]found and seized $30 million of the ill-gotten gains.
Økokrim said it worked with the FBI to recoup another $5.9 million. "This is money that can be used to finance the North Korean regime and their nuclear weapons program. It has therefore been important to trace the cryptocurrency and try to stop the assets from being converted into regular currency," explained Bender.
[8]Where in the world is Terraform Labs' alleged crypto-crasher Do Kwon?
[9]Crypto mixer Sinbad looks uncannily like a remix of North Korea's notorious Blender
[10]Terraform Labs and crypto bro Do Kwon face $57 million court case in Singapore
[11]FBI catches up with infosec and crypto communities, blames Lazarus Group for $100 million heist
More crypto comeuppance
Thursday was a bad day for crypto crooks with ties to the Korean peninsula. On the same day, the US Securities and Exchange Commission (SEC) [12]charged Terraform Labs and its [13]wanted [14]fugitive leader, South Korean national Do Kwon, with defrauding investors.
"We allege that Terraform and Do Kwon failed to provide the public with full, fair, and truthful disclosure as required for a host of crypto asset securities, most notably for LUNA and Terra USD," said SEC chair Gary Gensler. "We also allege that they committed fraud by repeating false and misleading statements to build trust before causing devastating losses for investors."
The implosion of Terraform Labs's TerraUSD "stablecoin" and linked "Luna" tokens set off what has been called "crypto winter." The crash was marketed as impossible, because the cryptocurrency's value was pegged to the US dollar. But that was not true, and many investors subsequently lost huge sums of cash.
[15]
Kwon's last known address was in Singapore, but authorities in the city-state say he departed the island in September 2022. Since then, he has landed on Interpol's Red Notice list and the South Korean government has cancelled his passport.
Meanwhile, Terraform Labs continues to [16]announce developments as if it didn't almost bring about its own little Armageddon. Yesterday it launched a decentralized automation layer feature in its TerraLuna ecosystem.
Uncharacteristically, Kwon has kept quiet on Twitter. ®
Get our [17]Tech Resources
[1] https://twitter.com/Okokrim/status/1626131420987924481
[2] https://www.okokrim.no/record-cryptocurrency-seizure-in-the-axie-case.6585495-549344.html
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@9eVvuv@p7weRs4pph2JwAAAQM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@9eVvuv@p7weRs4pph2JwAAAQM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@9eVvuv@p7weRs4pph2JwAAAQM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@9eVvuv@p7weRs4pph2JwAAAQM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/09/09/cryptocurrency_lazarus_axie/
[8] https://www.theregister.com/2022/09/19/do_kwon_korea_arrest_missing/
[9] https://www.theregister.com/2023/02/14/blender_crypto_mixer_sinbad/
[10] https://www.theregister.com/2022/11/01/terraform_labs_and_crypto_bro/
[11] https://www.theregister.com/2023/01/25/fbi_lazarus_harmony_crypto/
[12] https://www.sec.gov/news/press-release/2023-32
[13] https://www.theregister.com/2022/09/26/korea_interpol_do_kwon/
[14] https://www.theregister.com/2022/09/19/do_kwon_korea_arrest_missing/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@9eVvuv@p7weRs4pph2JwAAAQM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.linkedin.com/feed/update/urn:li:activity:7031701019864522752/
[17] https://whitepapers.theregister.com/
Tornado cash
Unless I'm mistaken, proceeds of a theft can be seized and given back to the rightful owner regardless of whether the current owner knew about their origin — if a bicycle is stolen and resold to an unsuspecting buyer, it nevertheless belongs to the original owner, and it's technically on the unsuspecting buyer to get their money back from the thief.
The point of tornado cash is to mix and obfuscate the origin of the cryptocurrency, but the blockchain still remembers the origin of every single token. From the principle above, it would make sense to seize the exact tokens that were stolen, regardless of who's supposed to own them — as the process of theft, the legal ownership is still with the stolen party.
Re: Tornado cash
I had difficulty finding a precedent to cite either way but I would draw the distinction that these are fungible tokens. If the authorities were able to seize specific tokens now held by innocent parties with no mens rea then I would never hold on to bank notes again, on the basis that robberies of cash have happened in history and the serial number on my notes might be matched to a specific crime, leading to their seizure.
The precedent I'm looking for is an attempt by authorities to seize specific physical currency that has been previously stolen but has since passed through several innocent hands in otherwise legitimate transactions.
Return of assets
Unless it is a house in the UK.
Once the land registry is updated it is near impossible to revert the theft.
There are many stories on this.
Tenant updates land registry, sells house, runs away. There are some small protections at the registry but they don't make it easy.
Much more a threat to houses that are mortgage free.
In March 2022, $620 million was stolen [...] In September 2022, US authorities found and seized $30 million of the ill-gotten gains. [... ]Økokrim said it worked with the FBI to recoup another $5.9 million
That makes still $584,100,000 to find. A profitable operation for NK.