China Is Fueling Crypto Crime, From North Korea to Mexican Cartels: TRM

What do North Korean hackers, Mexican drug cartels, Russian mobsters, and scammers impersonating your boss on Telegram have in common? They all depend on the Chinese black market to launder their billions in crypto, according to new research.

Despite crypto’s reputation as an uncensorable, borderless financial underworld, most major criminal groups utilizing digital assets wouldn’t be able to do so without the aid of sophisticated underground Chinese banking networks, according to blockchain intelligence firm TRM Labs. 

TRM’s leadership, which boasts decades of federal government experience, says U.S. policy has so far failed to address what the firm sees as an undeniable reality: From state enemies like North Korea on down to common crypto conmen known as pig butchers, the nefarious use of digital assets would not be possible on a large scale without the money laundering expertise of Chinese crime syndicates.  

Ari Redbord, TRM’s global head of policy, believes U.S. law enforcement has so far failed to address how these diverse criminal actors depend on the same illicit banking network to function.

“We’ve been treating fentanyl like a drug crime, we’ve been treating North Korea like a cyber crime, we’ve been talking about pig butchering like scams,” Ari Redbord, a former Treasury Department official and U.S. attorney, told Decrypt in a recent interview. “People need to stop talking about these things as siloed threats and start talking about the Chinese money-laundering networks facilitating all of it.”

Take one recent, prominent example: In February, North Korea pulled off the biggest hack in history, stealing some $1.4 billion worth of Ethereum from crypto exchange Bybit in a matter of seconds. 

While the record-shattering heist did sound alarm bells about North Korea’s elite hacking ability—and the potential complicity of third-party crypto exchanges in allowing the rogue nation to off-ramp stolen ETH—few at the time acknowledged it wasn’t even North Korea laundering those funds.  

“All the people taking Ethereum and turning it into Bitcoin through Thorchain and services like that are third parties,” Nick Carlsen, a senior TRM investigator and former FBI analyst, told Decrypt. “That’s not the North Koreans. Those are the Chinese money launderers.”

Carlsen argues the threat posed by exchanges that facilitated North Korea-linked transactions pales in comparison to that of black market Chinese bankers, who have turned converting stolen crypto into a fine-tuned service. 

These informal banks, which TRM says are mainly operated by Chinese organized crime syndicates called triads, take incoming crypto from various criminal enterprises, and swap it for fiat that Chinese nationals want to get out of the nation’s notoriously restrictive banking system. TRM’s on-chain research has shown as much.

“If you’re Chinese and you want to buy a million-dollar house in L.A., you run through these guys,” Carlsen said. “That’s how you get access to money in the United States.”

If that global system were somehow hobbled, Carlsen is adamant the development could cripple organizations like the Sinaloa Cartel—which, per TRM, depends on Chinese laundering of stablecoins, dollar-pegged crypto assets like Tether’s USDT, to operate. 

“It would be a gut blow,” he said. 

Could it be done? TRM says yes. Chinese money laundering networks currently rely on offshore safe havens in southeast Asian nations like Cambodia; those countries could be targeted by U.S. sanctions to eliminate the practice, the firm contends.

Earlier this week, a Reuters report suggested the Chinese government itself has begun cracking down on crypto-related money laundering in recent years. But Carlsen is skeptical. 

“China is a police state with incredible surveillance powers,” he said. “And yet this business thrives.”

Fundamentally, the former FBI analyst believes the most effective defense in dealing with this singular threat could be a good offense—aka, giving China’s financial underground a taste of its own medicine with aggressive on-chain maneuvers. 

“Do what the North Koreans are doing, but do it to them,” Carlsen said.  

Such a strategy would see the U.S. develop its own answer to North Korea’s formidable Lazarus Group—a division of tech-savvy government coders dedicated to committing cyber attacks against America’s crypto-wielding enemies. 

That’s quite a bold ask. But on the other hand, the U.S. government has long signaled one of its top priorities to be neutering the financial capabilities of enemy states like North Korea and criminal organizations like the Sinaloa Cartel. The latter, among other things, is one of the principal smugglers of fentanyl into the United States. 

And for years, existing policies at agencies like the FBI, DEA, and Treasury Department have failed to address Chinese crypto laundering as a single threat in need of a coordinated response, TRM says—a state of affairs that has allowed the issue to fester. 

Representatives for DEA and U.S. Treasury did not respond to Decrypt’s requests for comment on this story. The FBI declined to comment.

“It falls in the seams between all of them,” Carlsen said. “And so it goes unpursued.”