3 ms·

SEAL Advisory on DPRK Threat to Crypto Exchanges

38 points by transpute 2y ago

Animats 2y ago
> Use an isolated device (such as a Chromebook) for signing transactions Can a Chromebook function as an isolated device for long?
- gs17 2y ago
  They at least used to work fine offline AFAIK, except for the initial setup which did require Internet. Not a great option, though.
- Onavo 2y ago
  Not in the UK that's for sure.
  - maeil 2y ago
    Nor anywhere else, being an American company bound by the CLOUD Act. [1] [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
petesergeant 2y ago
> This can come in the form of a technical interview, where the target is instructed to clone a git repository [containing malware] and to install the dependencies and/or run the project Jesus
ty6853 2y ago
Ironically DPRK would probably make the most money if they just ran honest banks and exchanges without the FATF and KYC nonsense, as a sort of refuge from regulation that island nations used to provide. There is massive demand and few options.
- rabite 2y ago
  I don't understand how banks in a country that is completely cut off from the international financial system would be profitable.
  - ty6853 2y ago
    I vouched your comment, it appears yours are dead by default. Being cut off from the financial system I'm interested in hearing your opinion on what that is like. Unfortunately I'm afraid to venture too far into how/why I think it would work and being Virgil Griffith'd, and intentionally leaving it as a pure speculation on a hypothetical.
  - csomar 2y ago
    Crypto is cut-off from the international financial system but can be bridged by P2P. DPRK could allow, for example, exchanges without KYC that accept US customers. There is "sky high" demand for such a product (as in trillions). Russia used to have eBTC and it was one of the highest volumed exchanges. My guess is that despite the DPRK appearing to be independent (nuclear et al), it really is not. NK envisaged starting not just an exchange but a whole "deregulated/free" city but China prevented them from doing that. They do have other free enterprises, for example see: https://en.wikipedia.org/wiki/Rason_Special_Economic_Zone https://en.wikipedia.org/wiki/Rason_Special_Economic_Zone
    - lesuorac 2y ago
      How is this working? A random US Citizen cannot wire USD to NK. Their bank is not going to allow it. Their credit card company is not going to allow it. If you try to mail physical USD the USPS is going to confiscate it [1]. So, this leaves a US Citizen buying crypto on a KYC exchange and then transferring it to the NK exchange. Why? Just keep the crypto on the KYC exchange at this point. [1]: https://pe.usps.com/text/imm/il_015.htm#ep1639364 https://pe.usps.com/text/imm/il_015.htm#ep1639364
      - csomar 2y ago
dang 2y ago
Related ongoing thread: Bybit loses $1.5B in hack but can cover loss, CEO confirms - https://news.ycombinator.com/item?id=43130143 https://news.ycombinator.com/item?id=43130143

38 points by transpute 2y ago

> Use an isolated device (such as a Chromebook) for signing transactions Can a Chromebook function as an isolated device for long?

gs17 2y ago
They at least used to work fine offline AFAIK, except for the initial setup which did require Internet. Not a great option, though.
Onavo 2y ago
Not in the UK that's for sure.
- maeil 2y ago
  Nor anywhere else, being an American company bound by the CLOUD Act. [1] [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act

petesergeant 2y ago

> This can come in the form of a technical interview, where the target is instructed to clone a git repository [containing malware] and to install the dependencies and/or run the project Jesus

ty6853 2y ago

Ironically DPRK would probably make the most money if they just ran honest banks and exchanges without the FATF and KYC nonsense, as a sort of refuge from regulation that island nations used to provide. There is massive demand and few options.

rabite 2y ago
I don't understand how banks in a country that is completely cut off from the international financial system would be profitable.
- ty6853 2y ago
  I vouched your comment, it appears yours are dead by default. Being cut off from the financial system I'm interested in hearing your opinion on what that is like. Unfortunately I'm afraid to venture too far into how/why I think it would work and being Virgil Griffith'd, and intentionally leaving it as a pure speculation on a hypothetical.
- csomar 2y ago
  Crypto is cut-off from the international financial system but can be bridged by P2P. DPRK could allow, for example, exchanges without KYC that accept US customers. There is "sky high" demand for such a product (as in trillions). Russia used to have eBTC and it was one of the highest volumed exchanges. My guess is that despite the DPRK appearing to be independent (nuclear et al), it really is not. NK envisaged starting not just an exchange but a whole "deregulated/free" city but China prevented them from doing that. They do have other free enterprises, for example see: https://en.wikipedia.org/wiki/Rason_Special_Economic_Zone https://en.wikipedia.org/wiki/Rason_Special_Economic_Zone
  - lesuorac 2y ago
    How is this working? A random US Citizen cannot wire USD to NK. Their bank is not going to allow it. Their credit card company is not going to allow it. If you try to mail physical USD the USPS is going to confiscate it [1]. So, this leaves a US Citizen buying crypto on a KYC exchange and then transferring it to the NK exchange. Why? Just keep the crypto on the KYC exchange at this point. [1]: https://pe.usps.com/text/imm/il_015.htm#ep1639364 https://pe.usps.com/text/imm/il_015.htm#ep1639364
    - csomar 2y ago

dang 2y ago

Related ongoing thread: Bybit loses $1.5B in hack but can cover loss, CEO confirms - https://news.ycombinator.com/item?id=43130143 https://news.ycombinator.com/item?id=43130143