Reconnaissance General Bureau

$308 million from a Japanese exchange in 2024, $235 million from an Indian one soon after.

So Trader Trader definitely have serious form in this, and they are thought to be linked Of course, not just to any old criminals, but to North Korean intelligence and the Reconnaissance General Bureau.

Which is, I think, one of the better, maybe a more anodyne spy agency name that really masks the insanity and piratical nature that is inbred in the Reconnaissance General Bureau.

And I think it's worth setting up the North Korean context a bit because that is where these attacks come from.

North Korea is, it's kind of its own bird, isn't it, Gordon? Because it is a state that uses its spies, quote unquote, sort of scare quotes, to essentially act as criminals to go out and fund crime.

And they have identified in technical terms the fingerprints of an organization called the Lazarus Group.

It's an affiliate of the Reconnaissance General Bureau, as it's known, which is North Korea's external intelligence agency.

And one of its affiliates, which the FBI gives the name of Trader Trater, has also been identified.

It's to do with the way they've got in their modus operandi.

So you might have, I don't know, one department that's focused on espionage, one department that's focused on, I don't know, propaganda, influence, but you'll also have various different departments and sub departments focused on cyber operations.

And what analysts have seen over the course of the last, particularly last sort of five, six, seven years, the RGB, the Reconnaissance General Bureau, North Korea's spy agency, has pivoted vast swathes of its workforce to... specifically targeting cryptocurrency organizations.

So actually what started as the Lazarus Group, which was probably a small department within the Reconnaissance General Bureau tasked with stealing cryptocurrency over the last years, has grown into a much, much bigger department and has split into smaller sub departments where different teams work on different things.

And when we talk about Trader Trader, Apple Juice, Contagious Interview, Dangerous Password.

All of these different names are just code words, essentially, we're using to refer to the different departments.

Okay, but then essentially in that whole diagram, those other sort of little criminal groups within the North Korean government, they focus on other ways of stealing money for the regime, but Trader Trader and maybe a few other ones are focused on crypto.

Yes, yes.

So there are several subunits of the Reconnaissance General Bureau and actually the Korean Workers Party that are focused on stealing cryptocurrency.

And on the cyber side, what they've done is use the whole power of the state.

So that means going into schools as early as the secondary level, identifying talented technical students and pushing them into these pipelines to develop them further into university, and then eventually being brought into the Reconnaissance General Bureau which is North Korea's intelligence service.

And the best of the best are brought up to be these cyber actors.

And we have to keep in mind that the North Korean economy is minuscule compared to most countries on earth, right? GDP sits a little above $30 billion.