Name: Investigate Live with Chainalysis: Unmasking North Korea’s Crypto Laundering Tactics
Uploaded: 2025-08-28T04:18:13.211Z
Duration: 55 min 52 s
Description: Investigate Live with Chainalysis: Unmasking North Korea’s Crypto Laundering Tactics

Transcript for "Investigate Live with Chainalysis: Unmasking North Korea’s Crypto Laundering Tactics": Hello, everyone, and welcome to the August edition of our investigate which analysis webinar series. My name is Sandra Toms, and I'll be your host today. We're really excited to have you here and to dive into today's session. This series is designed to help you get the most out of channelysis reactor and stay ahead of emerging, emerging investigation techniques. Each month, we'll explore practical workflows, case studies, and best practices that you can bring back to your day to day investigation. Before we get started, a little disclaimer. This this material is provided for educational and informational purposes only. We encourage participants to consult with our own organizational policies and investigative guidelines when applying any of these concepts discussed. Before we get started, just a quick, a couple of quick housekeeping notes. This session will run for sixty minutes. We will have time for q and a at the end, so please use the q and a function throughout the session to submit your questions. This webinar is being recorded, and we'll share the recording with you afterwards. Today, we'll be focusing on the threat of remote IT workers out of North Korea. For anyone in the crypto, banking, cybersecurity, or tech industry, the activities of these individuals represent serious financial and data theft risk. But specifically for the remote worker groups, their main priority is to earn cryptocurrency and final work back home, feeding directly into the regime's weapon program, and sanction evasion efforts. So today, we'll be going through how North Korea uses crypto in a remote worker scenario, and then we're gonna go through, to tracing the funds that they have received from a job and see where it ends up on the blockchain, then look at how it is laundered and potentially cashing out at a few different places. I'm thrilled to introduce our speaker, Nathan Acary, who is our channelysis investigator based in Australia. And without further ado, I'll hand over to Nathan to do a quick introduction and to kick things off. Thanks, Nathan. Lovely. No worries. Thanks, Sandra. Hopefully, you can hear me okay. My name is Nathan. For those who have previously met me, I've, previously been in law enforcement, in digital crime and cybercrime. Everything from scams, money laundering, ransomware, drug trafficking, and, And, you know, across all these cases, the constant theme that kept coming up, especially in the last, you know, half a decade or so, is the growing role of cryptocurrency as a tool and a target for criminal activity. So my main role here in Chainalysis is to help law enforcement, regulators, financial institutions, you know, understand what's really happening behind crypto addresses and services and, you know, to support them mapping out risks and opportunities. So the topic we're talking about today is this, remote DPRK or North Korean IT worker syndicate. And, you know, one way that North Korea essentially brings in foreign currency and gets around the sanctions applied by, you know, OFAC, for example, is by renting out professional IT workers. And I'm sure you probably heard about it in the news. It gets a a fairly, decent showing on social media. And on mainstream news, thousands of trained developers, engineers who operate under fake or stolen identities, taking jobs with the Fortune 500 companies across the world. And, you know, North Korea isn't necessarily the type of place that would associate as being a specific tech hub or global IT talent. But behind the scenes, which feeds into the infrastructure as a large coordinated workforce, you know, it's managed to integrate itself into the global economy. So they'll land jobs or attempt to land jobs at crypto firms, tech companies, exchanges where they can potentially both earn funds to send back to North Korea and also gain access to or exfiltrate sensitive data. So, you know, some of these, workers are engaged in proper malicious activity like stealing cryptocurrency or probing and networks, this type of thing. Others are simply generating a steady income, working as remote contractors. And, you know, some of these workers are quite highly skilled, trained from a young age. There's credible reports showing DPIK workers often performing better than the average team members in those companies. So that's what keeps them employed. Good workers generally to keep the money flowing and ultimately funneling the revenue back to Pyongyang. And so like I said, it's mainly about sanctions evasions. So sanctions were, you know, essentially designed to cut off North Korea and their ability to earn foreign currency. That's pretty straightforward. But cybercrime and, IT freelancing have created an effective workaround. So every time, you you know, a North Korean IT worker is hired by a Western company, they've essentially opened up a tunnel through the sanctions and a flow of cryptocurrency or cash back to North Korea. You know, there's been some research recently that shows that some of them may be required to send back, a quota essentially hitting targets of up to, you know, hundreds of thousands of dollars per year. And it can mean consequences for their families if they don't as well, but it's also an opportunity. So, a lot of it's about survival. So they might take on multiple jobs, juggle several identities, and, you know, push to stay embedded in those companies because it's such a massive, pay bump for these families, of the IT workers themselves. And this is, I guess, a bit of a timeline of, the playbook, in general, a bit of background if you're not aware already. So their playbook has kind of shifted over time, but, essentially, the goal has always been the same and it's money for the regime. So, if you followed their evolution through time, you may have remembered in 2016, the Bangladeshi bank passed. They almost walked away with billions of dollars, but it was only a small typo that they put into one of the banking systems that flagged it to the authorities and they still walked away with, you know, I think about $81,000,000 in that one. WannaCry ransomware was another big, scheme that they came up with. That was a ransomware attack which affected millions of Windows systems. So they weren't just, obviously, in those days targeting, financial systems. They were targeting, you know, your your malware and ransomware, areas too. I guess in the last five or six years, we've seen this targeting towards cryptocurrency. So, one of the bigger hacks around the time was Ronan Bridge and Harmony Bridge, a couple of, decentralized exchanges, where basically they've been hacked. And you can see that, you know, the topology of of North Korea is, getting these funds and then using all sorts of obfuscation protocols and mixes and things like this to send money off to, you know, ultimately cash out. And then, you know, earlier this year, I think everyone on the call remember the buyback hack that was 1 and a half billion dollars, probably one of the largest exchange deaths to date. And it just shows that, you know, those centralized exchanges still remain pretty high on the priority list. But now they've evolved, you know, one of their tactics into a campaign they call the the trader trailer campaign, which is the remote IT workers embedding themselves into legitimate companies funneling money back. So, essentially, all this activity, they may be separate, you know, groups within within the machine, but, essentially, everything, flows back to to North Korea. And so they share infrastructure. They might share wallets. They might even share staff. So which is why, I guess, from a blockchain analytics point of view, attribution is very important and, you know, looking for those links is what enables us to, you know, follow the trails on on chain. And I guess a little bit about how they operate as these IT freelancers. Generally, they'll they'll start by building fake personas or identities, things traditionally where, data is linked from stolen data dumps, some cases even purchased identities from individuals, mainly in Western countries. Whether they're complicit or not, they may have a clean resume at that point. They'll create convincing LinkedIn profiles and enter platforms, you know, Upwork, we've seen Fiverr is another one, and they'll advertise themselves as software engineers or designers. And, you know, some of them are actually very good. So, well, as I said, research suggests that they outperform normal workers in terms of speed and and proficiency. So, generally, they operate multiple identities at once. They'll literally work with two or three laptops side by side, each one tied to potentially a different fake identity. Just recently, we've seen, an American prosecution where, a lady was caught running a laptop farm, dozens of laptops set up, which is what is pictured here. But essentially that enabled DPIK to, you know, show to their employer that they were in fact based in in The US. However, they are remoting in from, you know, places like China, Russia, this type of area. And then, you know, in terms of other footprints or fingerprints that we can see online, there's these little quirks that have been reported in open media. I think the Wall Street Journal found cases where, these North Korean operatives were using, minion characters as avatars and usernames. You know, and when you're seeing that kind of thing across multiple accounts, it becomes a pattern, with a bit of a fingerprint that can expose them as well. So fake identities, multiple personas, quotas, it's all unique and identifiable indicators and for us and maybe for your agency, some pivot points which you can use to identify and exploit. One more thing before we go on to, a bit of a case study here in in Reactor. And if you did wanna follow along in Reactor as well, feel free to open up your, Reactor instance and click along and follow along if you've not had a chance to do it already. So one of the things where we can use blockchain analytics to actually spot them is we're looking at things like wallet reuse. So workers might receive legitimate salaries, into addresses or, you know, wallets that have been previously connected either upstream or downstream to previously attributed actors or attacks. So whether that's known actors associated with the regime or other affiliates or services used frequently by these threat actors, any exposure here should be seen as a pretty serious red flag. So that's where, you know, your analytics tools can really track these connections across years of transaction history and continue to enable you to see future transactions and alerts on those as well. And second, I mean, the transaction patterns themselves, the IT worker salaries come in at regular intervals as you'd expect, mostly monthly for US companies, but potentially fortnightly or weekly depending on the jurisdiction or the company itself. So if you're seeing pay like, payroll like transfers going into unusual classes with strange exposures or to services associated with DPRK, that's a pretty big red flag as well. Timing is also important. So some of these workers claim to be based in The US. However, you know, transactional history may more closely align with their logins or activity times to, to Russia, North Africa, China. So if they're claiming to work in Europe or The US, you know, sometimes you can map their activity on chain to, you know, foreign UTC. And so individually, you're looking at lots of small signals that add up. You can combine them in to get a clear, I guess, a fingerprint that you can add to your your risk management. And this is what the idea of the store was about. This, you know, anyone in industry knows awareness is probably only about a third of of the puzzle here. You've got your process and your technology, which are also, you know, important legs of the of the store. So awareness means, you know, understanding the on chain and off chain tactics that these operatives might use. Process might be about embedding those that awareness into signals that you can use in your day to day workflows. And technology is where, I guess, Chainalysis might be able to add the most value for transaction history for clustering and attribution of, these addresses and continuous updates from our investigations and intel teams worldwide. So that's a bit of a background now, and I might just do a bit of a a walk through of a case study, which is which we've, published recently in the in the investigate with chain, area. If you've not had a chance to do that, this is, it's a pretty interesting one. So I'll just I'll flick over to my other screen now, and I'll just bring up Reactor. Bear with me. So, hopefully, you can see my screen here. Alright. So this, for those of you who are familiar with it, this is this is Reaktor. What we'll be doing here is looking at one of these DPRK IT worker addresses. And, you know, we can see one example here where an IT worker might have landed a job, got paid, and we're gonna be tracking where the funds, went, and see where it ends up on the blockchain, how it's laundered, and potentially cashed out. So this is our starting address, and the way I've got there is, you know, pasting an address up in the top box up here, which will give us a quick idea of, you know, the blockchains that it might be active on here on seven different blockchains. So by clicking on this address here, we can add it to the graph as our starting cluster. So we're gonna take some advantage of some of the newer features in in Reactor to track these funds more efficiently. You know, anything with DPRK or money laundering syndicates, whatever cartel or, you know, ransomware group you're looking at, money rarely moves in a straight line. It weaves through swaps and bridges and all sorts of paths, which can be confusing. So, I mean, when we first start looking at a cluster, we have a look at its overview and just see, you know, what we can glean about its, about its activity. So and one thing to flag here before we start is this all asset overview in Reactor now. So typically, when you're looking at a multi asset cluster here, which may have Ethereum, it may have Tether, it may have all sorts of tokens and native assets, Traditionally, you would go down into this whole asset view and select the asset, so you can see the activity on Ether. However, if you wanted to see the activity on USDC, you'd, you know, have to click on USDC, which is, one way of exploring the activity at a at a kind of a token level. And if you wanted to do that on the Polygon blockchain, you'd, you know, come over here and see, you know, was the USDC sent on Poly as well. So the old asset view really gives you an overview of the entire activity across the entire chain rather than by token. So this is denominated in USD amounts. So we can see quickly that overall on the Ethereum blockchain here, you know, it consists of one address. There's been six deposits and withdrawals and about $33,000 US has come in. So, you know, with this selector here, you can find, like, a quick overview, a summary of the blockchain level. So if we look at the receiving exposure here for this particular cluster where the funds have come from, we can see that it might have received, you know, some portion of its funds from a decentralized exchange here. In the sending exposure, I might be able to see some, exposure to other sanctioned jurisdictions, potentially another DPRK worker here. So that might be interesting to work out why it's got, you know, sending to other other DPRK IT workers. So just getting an idea of the behavior of this cluster, we can deal with it a little bit more. And so question number one asked us to generally describe, I'm I'm short of real estate on this screen so you have to bear with me, generally describe what this address does. So, you know, how we go about doing that. So there's a couple of different ways we can, you know, draw some conclusions about its behavior. We can have a look at the the transaction tab, which is at the top here. So this will give us an idea of, you know, across all the the receipts in and they're sending out. We can get an idea, you know, there's been a handful of, deposits in and a handful of withdrawals out. And you can see not, only all the assets of the funds going in and out, but now we get a handy column here called interpretations. So interpretations that takes, the information that hopefully you've seen inside Reactor before, inside Transaction Explorer, which is even more detailed. But it gives you an idea of, you know, what what were these things, what are these events on the blockchain. So, you know, you can sort by date and time if you wanted to, and you can see that, you know, the first thing that happened was a token transfer in, then a native asset transfer. So the native asset of of the blockchain being Ethereum is ether. And then, you know, the next thing down here is a swap. It's a swap from USDC to ether. And then the next thing is some ether being sent out. So So it gives you an idea, and enables us as an investigator not to have to guess or kind of imply or put any further brain work into, you know, what's happened in the transaction. You get to see it right in this panel, this list form here, which is really good for identifying patterns. So I can see that the first transaction received is this address here. It's come from this counterparty. So this person has sent some funds into there. If I wanted to, you know, back trace the funds as to where this, you know, $8,000 US came from, I could add that to my graph and trace backwards, hopefully, to some sort of service or, something with some KYC where I can find out maybe it's come from a particular company. But ideally, what we wanna do now is work work forward. So we could trace backwards, but, you know, the the the guts of this investigation is to know where the funds have ended up. So we're gonna have a look at on the June 6, they received a a standard, you know, token transfer of USDC. And next, they've received the native asset transfer, which kind of makes sense. You know, you've get some USDC into your account. You can't move it unless you've got the the native token to transfer it out. So unsurprisingly, what happens next is, you know, a swap transaction on the zero x, protocol. So we can see there's a USDC in, some ETH in, a swapping event, and then ETA out. So one minute later, this type of thing. So, you know and interestingly, if you you've already probably identified here the pattern of this address. So there's another chunk of about 8,000 USD that's been received in, same sort of deal as already Ethereum in the account. We see a swap. We see that Ethereum being sent out to maybe another address here, another DPRK RT worker. And, you know, with whatever's left of the Ethereum that's left in the account, it's sent somewhere else. So, you know, the pattern of this address really is funds in, swapping for Ethereum, and off to another address. So this one we've already identified as a DPRK IT worker, and the supposition is as well as that potentially this is another unidentified DPRK IT worker as well based on where the where the funds have gone to. So that's, you know, that's kind of the answer to question one there about what this cost is doing. It's receiving a salary and sending it out to other places. Question number two asked us to use the counterparties tab over here to look at the top four counterparties and determine their involvement. So I guess the easiest way to do that is having a look at the counterparties. So the counterparties really are gonna give us an overview of what's been sent into the cluster, what's been received into the cluster, and how many times each address might have been seen, whether it's twice, once, or, you know, lots and lots of times. So that gives us a quick snapshot of where the funds are flowing to overall, and we can sort by, you know, where they've been sent, where they've been received. And that's what question number two asks us to do. We're asked to add those four top counterparties to the graph and then determine which of those we can continue tracing through and which one we might have to stop at because it's potentially some sort of service. So if we were to add each of these clusters to the graph, one, two, three, and four, we can have a look around. So if we just shuffle these around into some sort of order, you can already see that, you can get some sort of idea of which one of these might be a service. So no kind of prizes for guessing that we've already named this one as an unnamed service. So it's acting like the service. It's acting like a custodial service where, based on its behavior, we can say this probably isn't a a private type of wallet. So if we start by looking at this cluster here and looking at its, overview, well, what can we see? So the overview tells us it consists of one address, but it's had, you know, 300,000 transfers in and out and, you know, transacted on the Ethereum blockchain at least of, you know, 1 and a half billion dollars. So that looks like a pretty large service. It doesn't look like the type of activity you'd associate with a single user. So I guess from an investigative point of view, if this wasn't labeled here, you can always come into the counterparties or the transactions tab to generally have a look at what's what's useful and what kind of conclusions you can draw, and it gives me a bit of context around what's actually happening in this cluster. So scrolling through here, you can have a look. Well, we've got lots and lots of tokens here, lots and lots of events, lots and lots of transactions, and the interpretation of these events is swaps, swaps, swaps, swaps. So basically, everything into this cluster has been swapped for something else. And that kind of stands out as, you know, it's not gonna be a typical user wallet, storing a huge volume of swaps, you know, and it's obviously categorized already as an unnamed service. But what this likely is is probably a, liquidity provider, or a market maker which provides, you know, tokens and liquidity for trades on either side. And generally, they're hooked into decentralized exchanges or, you know, protocols decentralized protocols. So if I see this address doing con constant swaps, it's likely, you know, a market maker and or an aggregator. And, you know, if I wanted to check, I could click on any of these track transactions here, and you'd come up and go, well, what are we looking at? So, yeah, it's a swap. It's, been involved on the one inch protocol. So one inch has essentially used this address for its liquidity. So if we're looking at that, we can pretty much say, well, that's gonna be a swapping event here. And the reason I'm showing you this, if you come across kind of these clusters which haven't been named or categorized yet, this is the kind of workflow you might go through to check. So, again, you can do the same thing on this kind of cluster here. You'd have a look at it and go, well, of this 8.2 k coming through, should I trace it? Should I not? And it's the same kind of workflow. You'd look and go, well, this is one address. There's, you know, just shy of a million transfers in over its lifetime, and it's not even more value. So, you know, 2 and a half billion dollars of of transfers is huge. So this again, it's gonna be a similar kind of workflow. What are we looking at here? We're looking at lots of token swaps everywhere, maybe on on one inch if we have a look at any of these transactions here. So, again, this is probably another liquidity provider on Uniswap or on a zero x protocol. So it's not gonna be a counterparty that we really wanna trace through because it's essentially acting like a service. So if we look at these other two here, at a high level, we can see that, you know, one address has done 12 transactions of $40,000 and, you know, same sort of thing, small amounts of transfers and, you know, relatively small amount of money going through, which kind of gels with what we already know from investigating the initial cluster here of the transactions. We went into transactions. We knew that the initial cluster started off by receiving some USDC and it sent the Ethereum out. So it sent the Ethereum out to 0 X 5 A, which we've mapped, and it sent the, Ethereum out down here to our DPRK RT worker here. So these are the two ones down the bottom. So we, you know, from a graph hygiene point of view, we might wanna name this as a, unnamed service as well just so we know. And we can remember for later on when we come back to the graph. So what we might wanna do next is have a look at question number three. So this is following the funds. So following the funds from this address, the question asked us, well, of the funds that have gone into this address, can we, you know, make some sort of meaningful, assessment of where the funds have gone? So from the DPRK IT worker, $8,000 have come into this address. Let's have a look at it. What we've already established, it's a single address. It hasn't done many transfers, hasn't sent and received, you know, a huge amount of volume over its lifetime. And, you know you know, we're asking, you know, is this a deposit address, that we can trace to at a centralized service to get some sort of lead, to get some sort of, KYC from, a principal, you know, in principal anyway from from a from an account holder, and maybe some other technical indicators which are held by the exchange. So, you know, we'll head over to in this case, we've had a look at the overview. We might head over to the counterparties you know, the activity here. So what are we seeing? We're seeing a lot of, funds received in in similar dollar amounts. So we've already known this one is identified as a as an IT worker, and it sent 8,000. These other ones aren't too dissimilar. So, you know, one of the presumptions might be that all these other addresses here are themselves IT workers as well. And so if you look at the overview wheel here, you can see that's our RT working, our our sanctioned jurisdiction funds coming in, and we can really drill down into the counterparties tab to, you know, get the bigger picture of where the funds have gone to. So I can see that, you know, the funds have actually been accumulated here, consolidated at this address from all these other addresses here. So I might wanna go, well, where have my funds gone to next? So I might wanna say this one is, consolidation address and label it as such. Because I know that, you know, it's not just the $8,000 coming in from one IT worker. The amounts and timings are gonna indicate this may be other IT workers which are worth investigating as well. So, you know, this is the, I guess, the primary counterparty, the one we're interested in following these funds. You can see the 8,000 has been merged, you know, and consolidated into here with other funds and then sent out as a as a single withdrawal. So looking at this address, I can already see a little bit more activity on it. So, again, one address, a little over a couple of 100 transfers and around $5,000,000 in, in sent and received. So the question is, you know, is this some kind of service? Anytime you see kind of higher volumes, do you you wanna pause and take a closer look and ask, you know, is this the behavior of an individual or a or a service? Is it controlled by a person or is it a contract? Is there anything kind of programmatic about its behavior? So we'll dig in and you can have a look just at the overview tab here. You can see when you see a big wheel like this, it means that pretty much all of the sending exposure has been sent to one particular category. So pretty much everything coming into this address has been sent to, HCOX or Huobi, which is interesting in itself. So, you know, if you go into the transactions tab up here, you might notice some patterns. There's no swaps. It's just transfers of the native asset of Ethereum and some DAI as well. So it seems to only transact in Ether and DAI, which is, like a stable coin like USDT or USDC. And, you know, the pattern is really that ether would come in and then ether would go out or, dial would come in and dial would come in and dial would come out. So it's you know, have a look at the timings here as well. Whatever is coming in is almost immediately going out. So, you know, you can see transactions up here minute on minute after each other. Whatever does come in is immediately sent out and, you know, just confirming in the sent column over here, everything is sent to HTX, you know. So that's the entire life of this cluster is sending everything to HTX. So and for those of you who are familiar with this, this is kind of a classic telltale sign of a deposit address sweep. So deposit addresses take in funds and then quickly forward them to the larger wallets of, centralized services. So this kind of pattern is something we spend a lot of time on in the, Chainalysis Ethereum Certification Course or CERC. So if this is your first time seeing it, you know, recommend checking out that course and it does a bit deeper into the theory and recognition of these kinds of movement packet, patterns. So but from an investigative standpoint, you wanna determine, you know, is this address here controlled by Hwobi? Is it a change of ownership? Is it owned by the same person? And so, you know, tracing through a service is, no good in any any particular case. So if I was gonna have a look at the the type of patterns on here, I would say that this is likely a sweep address for Hawaii, and it's likely tied up with, you know, the Hawaii infrastructure. So I wouldn't I'll be very careful tracing through this address, and, essentially, we would say that this is part of Hawaii. It's a deposit sweep address. And at this point, you know, you'd be going to Hawaii and putting some, request for information in as to who owns that address rather than following the funds through it. So that's a natural stopping point. So that's what we've done so far. We've traced this 8,000 out here consolidation into a small consolidation point and into, most likely, Hawaii infrastructure itself. So, that's the summary of the first trace. You know, nothing too complicated, nothing too unusual. In the end, it just flows into most likely an exchange, deposit address. So number four, ask us. That's number three. We're forwarded to a centralized service. Number four is a little bit, more involved. And if you have a chance to look at that, I hope you managed to find some sort of consolidation point, over on the Tron network. So which is what we'll be trying to do now. So if you look at this 8,000 that has been sent to this DPRK IT worker, it's the same process again. We'll have a look at the behavior of this cluster, which we've already realized. It's probably an individual deposit address, an externally owned account. It's transacted, you know, about $50,000 out, 70,000 in, with, you know, just shot of 20 transfers. So it certainly looks like a, you know, an individual's address. So you can quickly see that, you know, the transactions into this address by having a look at the transaction overview. And if we sort by date and time, we can see that the first transaction in here actually came from our IT worker here of of 8,000. So and again, this is the kind of pattern which we're we're used to seeing of of money coming in. Potentially, these ones here are other remote IT workers as well, all consolidating into this into this point. And, you know, I can see that if I were to go over to the counterparties tab and have a look at the same kind of information as an overview, I can see that it's received a bunch of funds from, you know, maybe a couple of IT workers, but the amounts are similar to these other ones which haven't been identified as yet, which may well be IT workers. But in either case, where have the funds been sent? So if we have a look at where the funds have been sent, well, we've got a natural, you know, your odds are drawn to a service here. So you can see that some of the funds have been sent to, Changelly, hit BTC, which is, you know, a centralized service that might have KYC that you can investigate. And the other one that that was sent to you in the counterparties tab here is this other address up here. So, you know, almost $50,000 have been sent to this address. So we might call this, you know, another consolidation point. And, you know, are we justified in tracing funds through here? So we'll have a look. So one thing you immediately notice is, you know, there's a bit more activity here. Even on one address, there's, you know, 350, thousand dollars moving through this cost. And it looks like, you know, the funds are coming from a series of DPRK IT workers here. So we probably justified in our initial presumption that this is some sort of consolidation point. You know, they're pulling together multiple IT payments and kicking off, you know, the, the laundering process. And, you know, you can definitely verify this pattern by having a look at, you know, maybe some other, transfers that have been sent into this address. So, you know, here's our transfer that may have come in, but, you know, if you wanted to add these other clusters here, you can start looking at, well, do these clusters behave the same as our initial cluster? And, you know, looking at this particular one, you can start having a look at, you know, the exposures very similar. The transaction patterns might be very similar as well, then it's receiving funds directly from IT workers and then consolidating funds out. So all these are natural kind of investigative points which you might wanna use to trace backwards to have a look where those funds have, you know, come from. But if we wanted to trace the funds forward, you know, what's the next step? So I could be justified in having a look at the counterparties from this address and seeing that, you know, it's received a whole bunch of funds from probably other mini consolidation points here and then sent out to a couple of, you know, strong candidates here. So if we're tracing the bulk of funds for this almost 350, what are we gonna do? We can add that to our graph over here. So this may be another, suspected, you know, money laundering activity of of this network. And I guess the question is continuing through where do the funds ultimately land. So, you know, we'd have a look at this address. And what are we seeing? Well, you know, on the overview tab, we can see it's a single address, 30 transfers, you know, 350,000 into the address and out again. And this could be labeled as a as a second secondary consolidation point if you wanted to. So, you know, these funds are further consolidated through. It's the classic, you know, layering technique where transactions are batched and moved around to obscure their their origins. So, you know, if I wanted to, I could dive into the transactions tab here and have a look at, you know, where it's receiving its funds from, where it's sending its funds to at a kind of granular level on a transaction by transaction basis. But, you know, if we wanna move a little bit quicker or get an idea of where the funds have gone to, we can see that the majority of funds received are from here, 344. And where are they sent to in general off to this address here. So we can add that address to our graph as well. And, again, it's just a it's a rinse and repeat process from here until we hit kind of a point where we wanna say, is this a service? We're thinking probably not based on its, you know, activity and it's, you know, acting as a consolidation point. But where does, you know, this cluster end up sending its funds to, you know, almost dollar for dollar? It's sending it out to Symbiosis Finance, which is a bridge. So a bridge is basically a a a way of changing your funds from potentially, funds on Ethereum to funds on another, you know, kind of blockchain. So, you know, the funds have been pushed into a a bridging service here. So my tracing style really has to kind of stop here. I'm not gonna be able to immediately trace through the bridge. You know, up until now, I might have been using counterparties to go, well, where did the funds end up? You can't really do that once you hit a bridge. It needs to be more of that transactional level. So, you know, Symbiosis Finance acts as a decentralized exchange and a bridge as well. And since these are bridging transactions, if I wanna keep, following the funds, my first step is to, you know, try to have a look at where these funds have gone to on on the next chain. So in the transactions tab, over here, sorry, I can see these are all the transactions that have gone into, into Symbiosis Finance. So if I wanted to say bring up, you know, any of these particular transfers out, I can then have a look at, you know, from my counterparties tab over here. There's a whole lot of funds that have gone out to Symbiosis, and we know that it's, you know, one of the transfers here was of, I think, $43,000 is what we're looking for, here. So this is, you know, one of the last transfers that came out. And so we wanted to track where these funds have gone where we can have a look. This is a bridging event of some die that's been sent out. So if you wanna ask yourself, you know, where did it where did it go to? So this is where we can delve into, Transaction Explorer. So newer protocols and bridges are always being, made on you know, that's the nature of of blockchain. There's always a new project coming up, which is offering a bridging service to change coins or change, you know, blockchains. And Reaktor does a good job at, identifying the fact that they are bridging transaction transactions. This is a good example of what to do when, you know, your bridge interpretation doesn't tell you where the funds have gone to. We've identified that it is some sort of bridging transaction or a swap with Symbiosis. And so if Reactor doesn't tell you where it went, you know, as from an investigative point of view, what do you do? Well, most bridges would have their own, explorers. So you can have a look at this transaction here. And with a bit of a Google search, you can end up at the Symbiosis Explorer, which will tell you that, you know, if you put an address in here and search for a transaction, it'll tell you, oh, this was a bridge from the Ethereum blockchain onto Tron. So what you can do from here is go, great. I've got some information. That particular transaction, this $43,000 here was bridged to the Tron network, and we can have a look at, this transaction on Tronscan as well. So getting this past all this, at the end of it, we know that this $43,000 UST has been sent to this Tron address here. So I can quickly copy that, go back into Reactor, and using that bridge explorer, I can then add that to my graph. So what we're seeing here is our RT working consolidation point has sent some funds into a bridge, and a lot of those funds have been sent out to this Tron address here. So if we were to have a look at the aggregated transfer line here, which is, you know, an idea of all the funds that have flown into this address from Symbiosis, here are the actual transactions themselves. So this is the one we were looking at. It was about $43,000 US in and $42.08 out, you know, barring transaction fees and a bit of slippage. This is, you know, typical of what we might see on the other side tracing through TRON. So, you know, your investigation will continue on on the Tron network as well. So now that we've essentially landed at this t c, tjc@gh address, we can see that's received a bunch of funds from Symbiosis. And if you wanted to, you can now analyze all the other transactions coming out of this bridge as well. So those those bridge explorers that you use, on on Google, basically, are just really useful for confirming, and adding context to what Reactor already shows. So you can see over here, basically, your your, transactions on the Tron network now, and see how this, cluster is behaving. And, you know, all the funds that have come into this cluster here, we can see that, you know, almost dollar for dollar, they've gone out to another cluster over here. So we can add this one on. And, you know, again, we're looking at how does this behavior of this cluster work. So when we first added our initial cluster from, post bridge, It's one address that has pretty much received and sent, you know, the same amount of money over, you know, 10 withdrawals, and it's consolidated a lot of its funds or all of it into another address, which, you know, we're having a look at this. This is one address, but we're looking at almost 8,000, seven and a half thousand transfers, couple of $100,000,000. Are we thinking this is a private wallet? Is it a service? We might wanna have a look at the transactions here, and, you know, what's happening. So it's token transfers and, native asset transfers. So you're getting TRX in and USDT in and USDT out. So this this kind of behavior here, for those of you who are familiar with how TRX works, is probably more aligned to a service, probably some sort of o OTC, desk where it's basically a cash for crypto service. So, you know, if you want to identify who was behind this, it becomes increasingly difficult. However, you know, for, you know, one technique you can have a look at is thinking, well, where did it receive its initial gas funding from? So this is a kind of a technique where you might go, who activated this account? And that can be pretty easy to do now that you've got, you know, all the assets on the Tron blockchain. You can have a look at your transactions and sort them by date and time, and you think, well, it first received its, native asset transfer from potentially a Binance account. So that again is another good pivot point where you can go back to Binance and say, well, who's in control of this account and why is it funded our initial cluster here? Is it some sort of OTC broker? Is it an, you know, off books, kind of swapping service? So question number four was probably pretty intense. For those of you who could follow along, great. If you haven't already, then I'll encourage you to give it a crack. And if you particularly wanted to as well, have a look at some of these other clusters along the path and just see, you know I know we've traced forward, but it might interest you to trace backwards as well to see, kind of what patterns are emerging from, this, DPRK IT syndicate. So hopefully, you've enjoyed it, and maybe you can bring some of those, you know, tracing techniques to your, agencies. And I'll hand you back now to Sandra. Fantastic. Thank you so much, Nathan. Do you wanna change back to the slides? Sure. Awesome. So thanks, Nathan, for going through, the investigation workflow and sharing your expertise. Now we'd love to hear from the audience. So if you have any questions, please go ahead and submit it into the q and a function on your screen, and we'll do our best to answer all your questions. So don't be shy. If you're wondering or you have a question, I'm sure someone else on this session also has the same question. So please submit your questions through the q and a box. So, Nathan, there's one question here from the audience. You're talking about this bridge, digital decentralized exchange. The question is how come, Symbiosis is not labeled as a bridge? Yep. Good question. So labeling and, I guess, tracing through bridges is something that, we will continue to support. So I guess as new bridges come along, they've all got sort of different protocols and different ways of, managing their swaps from from the code level, which is probably why generally within Transaction Explorer, you can, you know, hit a button and it will trace through that bridge for you without having to go to another transaction explorer. So even a few months ago, there was a limited support for one of the bridges that we now do support. I'm struggling to think of its name at the moment, which we'd use the Runescan Explorer for. But now it's just a matter of clicking through that button. So when we do identify it as a bridge and support it, it's a lot easy to trace through, if that answers the question. Thanks, Nathan. So just to confirm, it will only be labeled as a bridge if we can automatically trace through that bridge using our technology. So until then, we will label it as decentralized exchange. But until we have that feature that will automatically trace through the bridge, we won't label it as a bridge. I hope that answered your question. So we have another question. Why do you think that these IT workers swap from USDC to ETH to TRX? I'd imagine it's probably because they wanna make it more difficult to trace, and, you know, any kind of layer of, trouble they can give to, you know, an investigator is more time that they have to potentially launder those funds. So, you know, whether they're receiving funds in USDT because it's a stable coin and they can sit on those funds for a while, that is potentially what they'll be doing. So if they're paid in one sort of currency but they don't really have the infrastructure to send it or launder it easily, I'll probably flip it over into sometimes Ethereum where we've seen them use, other bridges, to swap in and out of. And specifically, TRX at the moment is, you know, the the speed of TRX and the ubiquity of it is probably important. The fact that you can find, these, OTC dealers through various channels, which will enable cash outs. It's far easy to swap, you know, USDT on Tron than it is maybe USDT on on other chains. And then, you know, that's the ultimate gain is to get, cash out, and then money flowing back to Pyongyang. Fantastic. Thank you, Nathan. I've got another question here. How can we tell if an address is a personal wallet, a consolidated, wallet, or a service? Yeah. Good question. That really comes down to I mean, if it's labeled as a service in reactive, we take great pains in, only labeling things that we have, you know, a high degree, a 100% confidence that they are, in fact, a service or a bridge or something like this. So and if it's not labeled, it's, either because, we don't have the attribution on it yet or it could be a personal wallet. So I guess it comes down to a little bit of, experience there where if you're looking at the transaction patterns of a personal wallet, you think, well, could an individual be transacting, you know, multiple times a minute for twenty four hours, you know, highly unlikely it's gonna be a programmatic wallet, maybe part of a infrastructure or some sort of service that hasn't been identified. So you're really looking at volumes and you're looking at and timings and you're looking at transaction amounts to make those, connections. And, you know, if you're looking at personal wallets, you often see, you know, exposure to specific deposit addresses at exchanges, whether that's centralized or decentralized, whatever it is, or you'll see exposure to, you know, repeated wallets over and over again, whereas services obviously have a have a much wider range and much bigger exposure to a number of wallets and number of addresses. Awesome. Thanks for that explanation. I think that's all the time we have left for, questions. So those who do have more questions or if your question hasn't been answered, we will respond to you separately after this session. So before we close off, just a quick reminder, if you'd like to stay up to date with upcoming investigation investigation analysis sessions, make sure you subscribe to the series. You can do that by scanning the QR code on your screen or clicking on the link that will pop up into the chat box. We'd love to get your feedback. So, sorry about that. We'd love to get your feedback on today's session. It'll help us shape the way we run our investigate which analysis series. So please take a few minutes to respond to the few questions in the chat box and share your thoughts share your thoughts with us. Fantastic. So thank you again, everyone, for joining us today for our August investigate which analysis. I hope you found, today's walk through valuable, and it leaves you with some ideas that you comply to your own investigation. As a reminder, a recording will be shared with you after the session, so please keep an eye out on your, with on your inbox. Now on behalf of the entire Genalysis team, thank you so much for spending the time with us. We hope you have a great morning, afternoon, or evening, and we look forward to seeing you in our next session. Thank you, and bye, everyone. Thanks, guys. See you later. See you next time.