.jpg)
.jpg)


.jpg)
Mar 26, 2025 - 32min
EPISODE 79
TRM Talks: North Korea’s Cyber Army: How Hackers Stole $1.5B and What Comes Next with Jean Lee and Nick Carlsen
With Jean Lee, and Nick Carlsen, and and
North Korea just executed the biggest crypto heist in history, stealing USD 1.5 billion from Bybit. But how did they do it? And can they be stopped? On this episode of TRM Talks, Jean Lee (The Lazarus Heist) and Nick Carlsen (TRM Labs, Former FBI) join Ari Redbord, TRM's Global Head of Policy to break down:
- The making of a cyber army — how North Korea recruits and trains hackers from childhood
- The Bybit hack step by step — from infiltration to laundering strategies
- The role of Chinese money laundering networks in enabling illicit finance
- What governments and public-private partnerships can do to disrupt these operations
With cybercrime and national security threats on the rise, this is a conversation you can’t afford to miss. Click here to listen to the entire TRM Talks: North Korea’s Cyber Army: How Hackers Stole $1.5B and What Comes Next with Jean Lee and Nick Carlsen. Follow TRM Talks on Spotify to be the first to know about new episodes.
Ari Redbord
(00:02): I am Ari Redbord and this is TRM Talks. I'm Global Head of Policy at TRM Labs. We provide blockchain intelligence software to support law enforcement investigations and to help financial institutions and cryptocurrency businesses mitigate financial crime risk within the emerging digital asset economy. Prior to joining TRM, I spent 15 years in the US federal government, first as a prosecutor at the Department of Justice, and then as a treasury department official where I worked to safeguard the financial system against terrorist financiers, weapons of mass destruction, proliferators, drug kingpins, and other rogue actors. On TRM Talks, I sit down with business leaders, policymakers, investigators, and friends from across the crypto ecosystem who are working to build a safer financial system. On this TRM Talks, I am joined by Jean Lee of the Lazarus Heist and TRM's North Korea expert, Nick Carlsen.
(01:01): But first Inside the Lab where I share data-driven insights from our blockchain intelligence team. Today on Inside the Lab we're spotlighting Visa's collaboration with TRM and how we're working together to create a safer crypto ecosystem. Visa is a global leader in payments and has embraced digital assets by enabling seamless cryptocurrency transactions through its payment cards. This innovation brings crypto closer to the mainstream, but it also comes with unique risks including fraud, money laundering, and potential sanctions violations. To address these challenges, visa has integrated TRMs advanced blockchain intelligence into its compliance and risk management framework. Using TRM's analytics tools, visa can monitor and trace crypto transactions across multiple blockchains in real time. These tools help Visa identify potential suspicious transactions, assess risks, and ensure compliance with global regulatory standards. For example, TRM's ability to track the flow of funds between wallets allows Visa to flag connections to high risk entities or sanctioned individuals.
(02:06): By applying these insights, Visa ensures that its crypto card holders can't transact securely while protecting its ecosystem from illicit activities. Visa's proactive stance doesn't a compliance, it's using TRM's analytics to build stronger fraud prevention systems. By identifying trends and patterns associated with fraudulent activity, visa can stop bad actors before they cause harm. This not only safeguards users, but it also sets a high standard for safety and trust in crypto payments. Paving the way for broader adoption of digital assets through its partnership with TRM, Visa is redefining what it means to operate securely in the crypto space. By combining cutting edge blockchain intelligence with its global payment network Visa demonstrates how financial giants can embrace innovation without compromising safety.
(02:58): Now I sit with Jean Lee and Nick Carlsen. Jean, Nick, thank you so much for joining today.
Jean Lee
(03:09): Great to be here. Thanks for having me on.
Ari Redbord
(03:12): Jean, you have really one of the most interesting backgrounds of anyone, certainly any journalist who has dealt with North Korea, who has that expertise. Can you talk a little bit about sort of your journey to the role that you have today?
Jean Lee
(03:23): Yeah, thanks for having me back. I think we spoke about a year and a half ago, was it?
Ari Redbord
(03:27): I think that's right . . .
Jean Lee
(03:27): And so much has happened since then, but one thing that hasn't stopped is the Lazarus Group marching forward with their campaign to steal money. So yeah, I never expected to end up in North Korea, but I am a second generation Korean American. My parents were born in Korea actually when it was one country and moved to the United States when they were, were young adults, and I always knew that I wanted to go back to Korea. I assumed South Korea as a foreign correspondent, and it was on my first day of work as the AP Soul Bureau Chief when my boss told me, actually, we've got a secret mission for you and that is to open an office in North Korea. And just to put this into context, I was thinking, how do you even get into the country as an American journalist? This is a country that was still and remains at war technically with the United States.
(04:23): And so I spent years coming up with a strategy on how to get into North Korea and pulled it off, managed to convince them to let me open an office in North Korea. So there is an AP Pyongyang Bureau. Unfortunately, the AP hasn't been in for years, I believe, but we certainly made a little bit of journalism history by getting on the ground and opening the first and only US News Bureau in Pyongyang. I have to say it was both the most exciting and the most frustrating and the most grueling assignment of my nearly 20 years in journalism as a foreign correspondent.
Ari Redbord
(05:02): Would you talk through what it was like there to live, to be out in the world?
Jean Lee
(05:07): Absolutely. I just want to remind fellow Americans, it is extremely dangerous and technically there is a very strict travel restriction that prevents Americans from going without permission from the State Department. So I always feel like we get into that in season two of the podcast of the Lazarus Heist, to talk about the risks of Americans going to North Korea. North Korea, it's in many ways like stepping back in time when you go to North Korea. And the oddest thing, of course is if you know South Korea, which is one of the most modern or postmodern countries today, just pulsating with lights and activity and restaurants and culture, and then you go, and of course I had to go through China, so go through Beijing and land in North Korea. It's like you've gone back 50 years in time, a place where there are almost no advertisements, where there are very few cars on the street, there's very little electricity.
(06:00): So often when people ask me what it's like, I say, it's very, very cold. It is a place where we often didn't have heat, we had very minimal heat. I spent most of my time in the winter trying to stay warm where food was very scarce, hot water was very scarce, so a place of great deprivation, and yet you have this city, Pyongyang the capitol. And while I was there, I did also notice that in the midst of what I consider extreme poverty across the countryside, this is a country where often when I was driving through the streets, I shouldn't say I was driving, I'm not allowed to drive. Our driver was driving us through the streets of these villages. There was no light except for the light coming from our headlights. So very extreme poverty. And yet what I was watching in the Capitol was this very strategic investment in science and technology and certain groups of people getting access to computers and technology.
(06:56): I found that interesting. One of the stories, one of the early stories I wrote was called the Digital Revolution. I was seeing this as part of some sort of campaign. I saw it as a campaign to build loyalty. So I was there at a time when the former leader, the last leader, the previous leader of North Korea, Kim Jong-il, father of the current leader, was in his last few years. And we were seeing the campaign to drive up loyalty to the next leader of North Korea. At the time, we had no idea who that will be. We just saw a lot of signs on the ground that somebody had been selected and watching this investment in science of technology and thinking absolutely great for the country to modernize. But is there also another purpose for this? They have such few resources. They don't do anything without thinking carefully about how to maximize everything that they do. That did spark in my mind the question of is there another motive for this? Could they be investing in a future that could involve hacking? So the dark side of modernization. And so I was watching all of this unfold. Of course at the time I was preoccupied with the building of the nuclear program, but all the while in the back of my mind wondering where all this science technology would be taking regime and whether it become part of the illicit financing campaign to get around sanctions.
Ari Redbord
(08:17): Nick, how did this become a focus for your career?
Nick Carlsen
(08:20): Yeah, no, I mean it's kind of interesting listening to Jean and explain the backstory for her because for me, it's almost like this mirror image of that I had no connection to Korea. I was 17 years old. I joined the Army. I thought I was going to go learn Russian. That was what I was really interested in. I got orders to learn Korean. I didn't even know what the language code was in my orders. I was sitting there going, what the hell is KP? So I was a 17-year-old kid. I got to language school and I started learning Korean and I was upset about that. I did not want to learn Korean. It was not my interest. But the more I learned about it, especially modern North Korea and especially the 10 years prior, the nineties and the arduous march, I got really interested in it, really fascinated by it.
(08:58): And I spent a couple of years in Korea in the Army, up on the DMZ a lot, and there was speaking of the darkness, right? There was this really cold night in December, I remember this, and I was up on the engine river up on a hilltop and I'm looking behind and there was a South Korean drive-in movie theater, probably none of those left in South Korea, just like the United States. But I was watching this movie on the screen and I looked across the river and there was just nothing pitch black except these concrete buildings, these apartments without windows. They were there basically to give the impression of a prosperous country, and then they were not. And I really remember that moment thinking, I am just fascinated by this country and I want to go there. I want to see this and I want to see the regime gone.
(09:40): That was a contingent element of that. And so basically, yeah, the rest of my career, I have just worked on North Korea ever since. So I went to the university, I majored in Korean studies, I went to the FBI. I worked on this for 10 years, did a lot of interesting cases and came here. And now we track this money theft program constantly, and I'm just so sad that I still have not been able to go. I'm looking forward to that day when I can drive through the country like Gene did and see it and experience it.
Ari Redbord
(10:09): A couple of weeks ago, North Korea hacked by bit the second largest cryptocurrency exchange by volume, stealing about one and a half billion dollars, the largest hack in history by magnitudes, quite frankly. Nick, can you give us some perspective on just this huge hack?
Nick Carlsen
(10:25): Yeah, no, I mean this hack, it's basically like to 11, right? Everything has gone to the absolute maximum possible. It can be the amount of transactions that are going on. It's just mind boggling. We have pretty good software, helps you track this kind of stuff. It's pushed us to the limits and I think it's going to be like a big test. There's a bunch of protocols like Thorchain and the swap front ends and work on that. I don't know how that exists, how that comes out of the other side of this. And we say that's acceptable, that one and a half billion dollars can flow through stuff like that, and they make millions of dollars from the swaps and there's no legal consequence. I just can't imagine that. I mean the actual hack, basically the North Koreans, they were able to hack this software provider that the company Babit was using to ensure the security of their wallets. North Koreans are able to hack them and basically intercept these transactions and alter the outputs in a way that Bybit wasn't even aware of, right? They couldn't see this. It's also crazy is that software, it's used by thousands, tens of thousands of people around the world. The North Koreans could have stolen anybody who used that software as a front end or service, and they just stole this. And you can see why. I mean, it's 1.46 billion. It's a lot of money.
Ari Redbord
(11:34): Nick, can you just talk us through a little bit of the laundering that you've been literally 24/7 on the last couple of weeks?
Nick Carlsen
(11:40): So for North Korea, one of the key things they need to do is they have to get everything into an asset that can't be frozen. So when they first stole this, quite a bit of the money was actually, it's called wrap Ethereum. So it's assets that are issued as a token. Basically the company that issues it can freeze it. And so their first thing they have to do every time is get out of assets like that and as quick as possible. And they actually failed. So about $40 million, they were not able to swap it into an unfree asset. And so that money was captured, and we'll go back to the victim here, but from there, they want to get from Ethereum to Bitcoin because Bitcoin is basically the main arena for crypto. That's where all the volume, a lot of the volume is if you want to hide all the tools to hide exists there.
(12:25): For a smaller hack, they could use something like Monero, which is really difficult for people to track, but it doesn't have the liquidity. You can't move one and a half billion dollars into Monero. So Bitcoin for them is the only choice, and that's what they spent the last 10 days doing, right, is just lining up all these addresses and moving these funds across bridges to get it to Bitcoin. And th chain is this side chain basically that they use to do this, and it's really the only mechanism out there right now that can move that kind of money without any controls in place. So that's basically what they've been doing. Looking forward, I think it's most likely that they're going to try to use Bitcoin mixers. I don't think that'll work. There's just too much money at play here. Wasabi is probably the biggest Bitcoin mixer still, and it only has a daily volume of maybe eight to $15 million. So if they're going to try to keep moving at this pace, there's just no way that any of these mixers can shield them.
Ari Redbord
(13:15): Yeah, I think to just give people perspective on this, I mean it's this extraordinary cat and mouse game that's going on right now out there with investigators like Nick tracking and tracing this flow of stolen funds. But these are some of the most sophisticated cyber criminals and launderers in the world now, or at least working with some of the most sophisticated launderers in the world. Jean, how did we get to this point where North Korea has this level of cyber capability?
Jean Lee
(13:40): So the reason I mentioned watching the unfolding of this investment in science and technology is because I always remind people that Kim Jong-un when he came to power was unknown and he was a young man, and I think that part of his strategy for gaining the loyalty of his generation, the generation who would have to rise up with him, was to roar them with at least the elites with the appeal of science and technology. And we should remember that he's a millennial. Kim Jong-Un is a millennial. He's very young. He was educated in Europe. He saw which way the world was going. He saw how we were all getting online and using technology to do everything in our lives. I do think that he firmly believes is that unless his family's in power North Korea, the way his grandfather created it will not exist. And I think he's probably right.
(14:29): And so for him that was about the nuclear weapon building a nuclear weapon that he saw. They call it the treasured sword that would protect him, his regime, his country, their way of life, their system. But of course, his father and his grandfather had been trying for decades to figure out how to get around all the US-led international to try to stop that. I do think that Kim Jong-un has been trying for many years to figure out how to get around that. And you've got this brilliant opportunity with cyber both in terms of warfare, asymmetric warfare. It's a gray zone that is not covered by the armor's disagreement and is also this gray zone that provides so much ambiguity. And so I do think that for him, the idea that you invest in a group of young people who have asked their only task to figure out how to stay on top of the latest technology and how to take advantage of it, what we need to recognize and understand is that there's a very targeted investment in a very specific group of people to care with the sole mission of understanding how we live, bank work and do everything online and to take advantage of that they are spending day in and day out looking at the technology and trying to get ahead of it.
(15:50): Do we have an army of hackers to counter that? Does South Korea even have the counterpart to these North Koreans?
Ari Redbord
(15:58): Yeah, no, you do extraordinary job. And I think so much of it is that historical perspective. And Nick, I'm going to ask you for a little of that as well. I can tell you I had a front row seat truly to seeing you on really the biggest cases involving North Korea. It was honestly the first time I think I really started to try to understand Bitcoin was when you started talking about it as something North Korea was using to launder funds. But would you just go back and talk about some of those earlier cases for you? Bang of Bangladesh is a great example. Sony Pictures, North Korea, in other words, was like a criminal money laundering state long before they discovered cryptocurrency.
Nick Carlsen
(16:31): Totally. And I mean that's kind of the origin story, right? For you and me on this both was the Sony Pictures case because just speaking personally, I was horrified, right? This crazy scenario unfolds making terroristic threats against the United States. And I guess I'd always just assume that there was somebody in the back row who had a great idea about how to deal with stuff like this, and it became really obvious that nobody did. And the thing that we cooked up was go after their money. This is all motivated by revenue. And I think something that even today most people don't understand is that North Korea, basically every rogue regime out there, they really depend on access to US currency. And so as we kind of dug into this, we realized almost all of North Korea's illicit revenues were actually flowing through American banks. If North Korea wanted to go buy soybean oil from Indonesia, they had to pay in dollars, and that money had to come through a US correspondent, which gave us enormous leverage.
(17:22): If we could figure out the networks they were using to go after this stuff, we could actually interdict it. And we did. We had a bunch of huge cases, the Don Hongshan case, and then the Foreign Trade Bank case. We indicted 30 plus people seized like 70, $80 million. And then the British American tobacco case, this wild thing where basically this western company had a secret factory in North Korea and was running it through cutouts. But I think that also kind of cuts and segues over to why they do the crypto thefts now is these networks we looked at over a decade, they would move two $3 billion. Now they can make that much money in pure profit in a matter of a day. It's just wild for the North Koreans. They've never had access to money like this before. Talk about the Bangladesh heist, the case that basically started your big project Gene.
(18:10): How did the North Koreans get the money out? The 81 million, they actually, they brought it out with Chinese organized crime, and that's exactly who I think is working with them right now. There's nobody else in the world that can absorb a hundred million dollars a day of illicit money. But the Chinese triads, and I really feel like that talk about something that's not on a public consciousness is the degree to which from Mexican cartels to pig butchering to North Korean crypto thefts. The common thread between all of these things is Chinese organized crime, but the really key leg of all of this, right, is like a really interconnected international industry the way they wanted this money. And the key thing is dollars in the United States, the North Koreans basically they feed in the crypto liquidity, but it's drug cartels in the United States who feed in the actual dollars and the middleman is the Chinese and why did they have this industry? Why does Chinese underground banking exist? It exists to allow wealthy Chinese to get their money out of China and go buy homes in Los Angeles and Vancouver, Canada. And so it's within America's power really to crack down on this because if you kick out that leg of the stool, the whole thing collapses and nobody's doing anything about it.
Ari Redbord
(19:14): Incredibly important. And I'll say that in all of the sort of big conversations I've been in with Nick, with government officials globally, this is the hook. Who are these people?
Jean Lee
(19:24): There is a system in place just like plucking out the most gifted athletes and you see it. So on one of my first trips to North Korea, I did go to what they call the school children's palace where gifted students are plucked to learn the arts or learn skills, and they had dancers, they had kids doing TaeKwonDo, and then they had a computer room where kids got access to computers. It was very clear to me that there was this system for isolating and identifying students with potential. I was taken to a number of these academies and universities where select students from elementary school up through university were given access to computers. And they even showed me how some of them were given access to the internet, which is a very, very rare thing, and it's very closely monitored. So they do not have access to the internet the way that we do the world wide web. It's very closely monitored and very carefully dod out, but they do give some students the ability to play around with this. And I think it's a seduction, it's a way to seduce them into playing this role.
Ari Redbord
(20:35): Nick, look, North Korea has always laundered stolen funds differently, whether it's fiat or whether it's crypto. It's just trying to move it as fast as it can to get to be able to use it without concern of caught because there's really not a huge downside to that. Is that consistent what we're seeing in buy bit today or is the scale and speed of this thing different?
Nick Carlsen
(20:55): Yeah, no, I mean I almost wonder that they want the world to know. I think they probably take some pride in this, right? And they will leaving a signature on their cases so that it's fairly obvious who did what. Something really surprising about this case was that they started moving it immediately. So kind of in the past, typically what mure will do is they'll execute a few, HES in sequence, but they will work them sequentially. So they will start laundering the first hack and they will finish that. Then they'll start laundering the second hack and they move through it. And what they're doing basically is just trying to create enough doubt in between the beginning of the end that if that money gets interdicted, so say it's now in the hands of a Chinese broker and he's trying to sell it at an exchange, they want there to be basically plausible deniability at that point that, "Hey, I don't know if this is hack money, what are you talking about?"
(21:42): This is from my business partner. So that's basically the whole process and mechanism that they're doing here is just trying to make a fuzzy, questionable link in the interim. But ultimately, North Korea, like you say, you can't go buy missile components with crypto yet. For now, it's basically you need to have real money, and that can be Chinese yuan or that can be dollars or whatever. And so the end game of all this for North Korea is selling this somewhat dirty crypto at that point to a broker, and that broker will pay them in a bank transfer or in prepaid debit cards. It's crazy or bricks of cash. And that for us is the challenge point where the blockchain gives us a lot of clarity up to that. After that, it's really difficult and that's basically the domain only of governments that they can figure that part out.
(22:26): But yeah, ultimately for them, if they lose 10% from beginning to end, that's still over a billion dollars. That is crazy. Money from North Korea, pure profit. And that will go to everything. I mean, I suspect most other North Korean revenues, it's going to be funneled through this handful of banks, the foreign trade bank or the Korea Kangan Banking Corporation, and they're going to go out and they're going to buy whatever it is, north Korean needs. It's petroleum. That's soybean oil, that's food stuffs, that's alcohol, it's watches. It just becomes a part of the revenue stream.
Ari Redbord
(22:56): How do we combine the tracing that you're doing with the off-chain authorities that governments have? How do we address this problem?
Nick Carlsen
(23:03): To me, what we're doing right now, it's kind of trying to put the helium back in a pop balloon. It's just not practical. And at best you'll get a little bit of it. And I think by bit they does something really interesting. They have a bounty they're paying out instantly. So there's a lot of people who are following this money in the hopes of getting a taste of that basic. But to me, the real solution to this is not even in the crypto. It's good to know. It's good to understand, it's good to track, but the real solution is going after the networks that absorb it. So we have to go after the North Korean bankers and we have to go after the Chinese triad gangsters that they work with. That's the real target. And those are people, right? They're very targetable. You just have to point the eye of so on them. And I think we maybe waste too much resources doing what I do, which is actually kind of following the flow of the money, because at the end, the ultimate use of the money is what we care about. So go after that, stop trying to put that helium back in the balloon.
Ari Redbord
(23:51): Jean, what is your perspective on what is next for North Korea?
Jean Lee
(23:55): Yeah, I mean, I think that the diplomacy that unfolded in 2018 and 2019 between South Korea and North Korea, between North Korea and the United States, I had been fully expecting that at the end of 2017, we had Kim Jong-un saying he was satisfied with where the nuclear program was. And part of that was that he had used the tension in the early part of the first Trump administration to ramp up and justify testing. But then when he went into those negotiations, it turned out it wasn't enough. So they've spent the last five years stealing and building up the program. So now what I will say is that the hacking did not abate in any way during the diplomacy. And so that regardless of what happens going forward and regardless of the timeline for return to negotiations, if there is one, and I do think there will be one eventually, we should not be letting up at all.
(24:48): The administration needs to maintain pressure while leaving the door open for engagement, recognizing that if you look back at those years, I mean, there was no let up in the quest to steal money through crypto or cyber. So I think that that's something that I try to emphasize that even though things may seem quiet, they never are. I can guarantee you that if there is a negotiation, again, it's going to be far more difficult than it was five years ago because the weapons arsenal is far bigger. And also there's far less leverage because you no longer have China and Russia on board with international sanctions. So there are a lot of variables and a lot of factors. But the one thing I think is that we can be sure on is that the theft will continue and that they will continue to invest in the program. So with every day, that arsenal will just get stronger. So any eventual negotiations can be very, very difficult.
Ari Redbord
(25:43): Nick, let's just finish here. And that is, I think we recently put out an update to the Bybit hack, basically saying that we've now moved into this second stage of laundering, as you just described it a little while ago. Now we've moved all of that stolen ETH to Bitcoin and let the laundering the second stage, let the laundering process begin. Now in terms of Bitcoin, which we'll go through a series of mixing services, trying to clean that, move it around, look for off-ramps, any sort of predictions over where this heads over the next few weeks, months, years, in terms of the laundering, how successful they could potentially be just given liquidity laundering, networks, any of that?
Nick Carlsen
(26:21): Yeah, I mean, I think if the historical precedent holds, they're going to get away with most of this. Hopefully. I think like we mentioned earlier, this random, this bounty that Bywood has put out there, it might actually help. There'll be a lot more willingness, I think, to devote time and resources to countering this. But I mean, even if they get away with just 70% of it, that's still an incomparable haul of money for, and I think to what Jean was saying a moment ago, you go back to 2017, 18, there wasn't a ton of pressure on the regime. I mean, we really had choked off much of their revenue from outside. They had a lot of pressure to cooperate, and they didn't, right? I mean, ultimately there was no deal. So I think it would be a fool's errand basically to try to go again. And this time we come as a supplicant, that's not going to work.
(27:06): It's far better to speak through actions with the North Koreans than it is through words. Actions speak much louder. And I think another thing too, and this kind of goes even beyond the North Korea issue just generally, is that I feel like we're in the 1950s talking about the missile gap with the Russians. There is a hacker gap, right? The Chinese, you look at salt, typhoon, and these crazy hacks they've undertaken against US infrastructure. These aren't employees of the Chinese government. These are private hackers that are basically acting at the direction of the state. Russia are very much the same. These ransomware guys, they basically operate with the tacit acceptance of the government. They're not agents of the government. North Korea is slightly different in that these guys actually have uniforms and are employees of the government. But I think America, we're kind of asleep at the wheel here.
(27:48): We need to do much more to basically empower our tech industry, our tech sector, to counter this. And there are tools to do that. I know this is a little bit crazy, right? But I'm a big fan of letters of Mark resurrecting this authority from the Constitution to basically allow privateers to counter guys like this. I think that's probably the only way, and it's this crazy irony that we sit here, the North Koreans, right? The Stalinist communists, last vestage of the Cold War. They're the ones who are pursuing this really innovative tech-centric approach and are raising lots of money doing it. And we're sitting here basically asking these stodgy bureaucracies at the NSA and elsewhere to somehow whip up this super responsive and technocratic response to that. It's just the fool's there, right? That's not going to happen. We have to basically recognize what our enemies are doing and adapt to it.
Ari Redbord
(28:36): I love hearing from both of you. I could do this for a long time. Thank you so much for coming on. TRM talks for providing your perspective interest. I think for you said just like keeping this issue front and center, which is really, really where it belongs. I know I say this after every episode, but this honestly truly may have been my favorite or one of my favorite TRM talks that we've ever done. And I think it was because of the level and breadth of expertise. Jean is the foremost subject matter expert on what life is like in North Korea today and over the last decade or so. And her perspective on this cyber army, this army of hackers that is being built from children with math and science and technology backgrounds or expertise and turning them into the world's leading cyber criminals is it's extraordinary.
(29:25): And that story is so well told in Lazarus Heist, and she's sold it so well today. But look, Nick Carlsen and I, and people like Zia Faruqui and Chris Janczewski and Kyle Armstrong have been having these conversations for years. And that is alright, so we can follow the flow of funds on blockchains and have gotten really very good at that. And using sophisticated tools like TRM, we can trace in ways we never could before. But that doesn't mean that we can see every flow of funds off chain. And this becomes a cat and mouse gain between investigators like Nick and North Korea cyber criminals to move these funds through Chinese money laundering networks, ultimately to Chinese banks, even into the US financial system to cash out. And that is when the funds are able to be used for weapons proliferation and to destabilize the Korean peninsula. And I think to understand that threat, the true threat there, right?
(30:13): That beyond the crypto tracing threat is absolutely critical. And I think the question right now for the US and for governments around the world is how are we going to leverage our authorities, every single tool in the law enforcement toolbox, every single tool in the National Security toolbox to stop this threat from happening? And I think Nick is really the ultimate at explaining the seriousness of the issue and also the potential for actually solving it if we use every tool in our toolbox. I am, as you can hear in my voice, just so energized from being in that conversation. I think that I pinch myself every day that I get to have guests on TRM Talks who are the foremost experts in the world. Jean and Nick are absolutely the foremost experts on this.
(31:00): Next on TRM Talks, I'm joined by the Chief of the Virtual Assets Unit of the FBI, Patrick Wyman. If you love the show, leave a review wherever you're listening to it and follow us on LinkedIn to get the latest news on crypto regulation, compliance, and investigations.
TRM Talks
(31:20): TRM Talks is brought to you by TRM Labs, the leading provider of blockchain intelligence and anti-money laundering software. This episode was produced in partnership with Voltage Productions. The music for this show was provided by Eco X.
Ari Redbord
(31:37): Now let's get back to building.
About the guests
.jpg)
Jean H. Lee is an award-winning writer, commentator and expert on North Korea. She is co-host of the Peabody Award-nominated Lazarus Heist podcast for the BBC World Service and the Presidential Chair at the East-West Center in Honolulu, Hawai’i.
As a journalist, Lee led the Associated Press news agency’s coverage of the Korean Peninsula as bureau chief from 2008 to 2013. In 2011, she became the first American reporter to join the Pyongyang foreign press corps, and in January 2012, she opened AP’s Pyongyang bureau. From 2008 to 2017, Lee made dozens of extended reporting trips to North Korea, visiting farms, factories, schools, military academies and homes in the course of her exclusive coverage across the country.
During Lee's tenure, AP’s coverage of Kim Jong Il’s 2011 death earned an honorable mention in the deadline reporting category of the 2012 Associated Press Media Editors awards for journalism in the United States and Canada. Lee also won an Online Journalism Award in 2013 for her role in using photography, video and social media in North Korea.
Lee is a native of Minneapolis. She has a bachelor's degree in East Asian Studies and English literature from Columbia University, and a master's degree from the Columbia University Graduate School of Journalism.
She worked as a reporter for the Korea Herald in Seoul, South Korea, before being posted with AP to the news agency's bureaus in Baltimore; Fresno, Calif.; San Francisco; New York; London; Seoul, South Korea, and Pyongyang, North Korea. Reporting assignments took her across Europe, North America and Asia.
In 2015, Lee joined the Woodrow Wilson International Center for Scholars in Washington, DC, as a fellow, then served from 2018 to 2021 as director of the Hyundai Motor-Korea Foundation Center for Korean History and Public Policy, and then as a senior fellow until June 2023. She joined the East-West Center as a visiting fellow in 2023, and was appointed to the position of Presidential Chair in 2025. She serves as a non-resident fellow at the European Centre for North Korean Studies at the University of Vienna.
Lee is a member of the Council of Korean Americans, the National Committee on North Korea, the Pacific Council on International Policy and the Asian American Journalists Association. A sought-after policy analyst on Korea issues, Lee was invited to testify before the House Foreign Affairs Committee in July 2023.
Lee has served as a CNN contributor and has provided reporting and commentary to a wide range of media outlets, including the New York Times, NPR, PRI, BBC, NBC News and PBS Newshour and others. She also appears in the National Geographic series “Inside North Korea,” PBS’ “Dictator’s Playbook,” Netflix’s “How to Become a Tyrant” and others.
.jpg)
Nick Carlsen, Senior Investigator, TRM Labs, is one of the world’s foremost experts on North Korea’s illicit financial networks and cryptocurrency-enabled cybercrime. A founding member of TRM’s Global Investigations team, he specializes in tracking DPRK-linked threat actors, de-anonymizing mixing services, and uncovering complex money laundering operations across the blockchain.
Before joining TRM, Nick spent 12 years as an intelligence analyst at the Federal Bureau of Investigation (FBI), where he played a pivotal role in the US government’s largest investigations and disruptions of North Korea’s trade-based money laundering networks. His work directly led to:
- The indictments of dozens of individuals operating global North Korean sanctions evasion schemes
- The seizure of tens of millions of dollars in illicit proceeds tied to North Korean financial operations
- The largest-ever non-bank financial settlement ($629 million)
- The first-ever extradition of a North Korean national to the United States, an unprecedented move that led to the rupture of diplomatic relations between North Korea and Malaysia
Nick’s insights into DPRK’s cryptocurrency thefts and cyber-enabled financial crimes have been widely recognized, with features on CNN, The Wall Street Journal, Wired, and other leading publications.His investigative excellence has earned him some of the highest honors in US intelligence and law enforcement, including two FBI Director’s Awards (2013, 2017), the FBI’s top recognition for investigative achievements; two FINCEN Director’s Awards (2018, 2020), for excellence in financial intelligence and illicit finance investigations, and two National Counterintelligence and Security Center (NCSC) Director’s Awards (2016), for contributions to US national security.At TRM Labs, Nick continues to lead efforts in tracking state-sponsored cyber threats, identifying illicit crypto flows, and protecting the global financial system from nation-state actors.
More TRM Talks
Subscribe to TRM Talks
Subscribe to be the first to hear about new episodes, and to stay in the know about all things blockchain technology and crypto policy.