How to launder $600 million on the internet

0:00Support comes from our 2025 lead sponsor of Planet Money, Amazon Ads. Less than half of customers fully trust their financial institutions. Amazon Ads helps financial brands build that trust through relevant ads using first-party signals to reach the right customers. More at advertising.amazon.com. This is Planet Money from NPR. One of the biggest things in the world of crypto a couple years ago was this game called Axie Infinity. You can think of it as like blockchain Pokemon. You buy these tiny little digital pet blobs with tiny little legs and you fight them against other people's tiny pet blobs.

0:46Except every pet is also an NFT, basically this digital beanie baby. And some of them were selling for thousands of dollars. People have made this game their full time job. You can even trade your Axies for cryptocurrency on our marketplace. A lot of Axie's fans seemed convinced that the game was proof that crypto could be used to create an entire economic ecosystem. The company behind Axie Infinity grew into a multi-billion dollar business. Then in March of 2022, this candy colored paradise full of happy-go-lucky but also weirdly lucrative digital pets was the scene of a shocking crime. A heist!

1:27They were heisted! It was a heist! And that is where our story begins. In the middle of the night, Erin Plant gets a phone call. It was about four o 'clock in the morning. And you know when your phone is set to do not disturb, but when someone calls you repeatedly in such short increments of time, it will actually ring through. That's what's happened. Erin is essentially a private detective who specializes in hunting down stolen cryptocurrency. And that frantic caller was her boss. Erin was about to get the biggest assignment of her life. I think the first words out of his mouth were, Axie Infinity lost$600 million.

2:08$600 million worth of crypto plucked out of one of the company's digital wallets. What was your reaction? My reaction is just horrified. I mean, it was jaw-dropping. That's a huge amount of money. An absolutely astounding amount of money. It was, in fact, the largest crypto heist in history. And now it was Aaron's job to track down where it all went. Hello and welcome to Planet Money. I'm Jeff Guo. And I'm Keith Romer. That 4 a.m. phone call would launch an 18-month-long investigation and lead Aaron to face off against some of the world's most sophisticated digital money launchers. Today on the show, the biggest crypto heist of all time.

2:51A case that would eventually pull in the FBI, raise alarms at the highest levels of government, and threaten the nuclear security of the entire planet.

3:21perks? Trust. It's the number one factor that drives loyalty. Amazon Ads helps financial brands build that trust through relevant ads that reach customers at key decision moments, whether they're planning retirement, buying a home, or managing debt. Using rich first-party insights, Amazon Ads connects brands with the right audiences where they browse, buy, and stream. Learn more at advertising.amazon.com. This message comes from Capital One with the Quicksilver card. Earn unlimited 1.5 % cash back on every purchase, every day. What's in your wallet? Terms apply. See CapitalOne.com for details.

4:04A lot of times when there's a high-profile crypto crime, Aaron and her team get called in. Aaron is the vice president of investigations at a startup called Chainalysis, and she's often working side-by-side with law enforcement. You have a security clearance. I do. How often in your regular life do you have to use the phrase, it's classified? I've never had to use that phrase before.

4:30I actually don't think most people in my regular life have any idea what I do. Because by the time they find out, they've disappeared. Yes, yeah. Yes, exactly. When Erin first started out 20 years ago, she was helping governments investigate bribery and corruption and tracking down where all those bribes were going. And Erin loved this methodical kind of work. I'm very much a math, science, black, white, nothing colorful in between kind of person. Back in the early 2000s, it was kind of the dawn of digital evidence. Erin would have to literally sneak into server rooms, physically plug in hard drives and copy over the incriminating data.

5:13We would often go into a company building, and our story was that we were there to do a software upgrade. Literally undercover. This was your cover story. You're an IT person. Yes, we were an IT person. So we would go in with a cover story that we were there to do a software upgrade or do something IT-related, and it had to be done overnight. So we would arrive in the evening. We would work all night copying people's emails. In secret? In secret. Those emails would sometimes hold clues to elicit payments, and they would help Aaron trace those payments through the financial system, through credit cards and wire transfers and banks.

5:54It was all this very slow process with all of these dead ends. But by the time the Axie heist happened last year, a lot had changed in Aaron's world. Instead of using the traditional financial system, these days more and more criminals are using cryptocurrency, laundering money through Bitcoin or Ethereum or whatever. And in some ways, crypto might sound like an investigator's dream because every transaction gets recorded on the blockchain. And for most of the big cryptocurrencies, that blockchain is visible to the entire world. So it is real time. It is available for anyone to look at. And you can follow the money in a similar manner that you follow it in traditional financial crime investigations, but you're able to do it much faster.

6:45But in the world of crypto, the criminals can also move much faster. And in all of these really sophisticated ways. Now, when Aaron was hired by Axie Infinity to investigate this heist, step one was to start at the scene of the crime. And you know how in murder mysteries they have that wall where they tape photos of suspects and evidence And there's this little red string connecting everything. I love a murder board. You gotta love a murder board. Exactly. Erin has a version of that for the blockchain. We're in her office and she pulls it up on her computer. And she can show us exactly what happened in the immediate aftermath of the Axie heist.

7:23So this yellow circle here is Axie Infinity's wallet. This is their wallet that they control. and this yellow circle here is the wallet that the money moved to. And then you see from this hacker wallet that held all of the stolen funds, you see this sort of spray of lines coming out of it. In those first few hours after the heist, the hackers are already moving that stolen crypto. They're changing wallets. They're splitting money into different wallets. They're swapping it for other kinds of cryptocurrencies. It's like following a getaway car that is making exits off of off ramps and going through tunnels and going on to different roads and merging on to other roads to try to lose the path of the car that's behind them chasing.

8:21In this case, it sounds like you guys are like in a helicopter and you can just see them. That's a good analogy. I think we are in a helicopter and we can see them. And we're watching them at all times. Erin doesn't know who these hackers are. But one thing she notices is they are good. They are methodical. They are breaking this money into regular amounts, moving it around in systematic ways. And then they kick it up a notch. So it's now an hour or two in. And we are looking at the money that came out of the Axie Infinity Treasury. and it starts to hit a mixer called Tornado Cash. And so that immediately sets off alarm bells.

9:04Tornado Cash is this notorious cryptocurrency mixer. Mixers are these digital services that take in money from different places and kind of scramble it all together. For the errands of the world, they are a giant headache. Here's how they work. Let's say I have 10 bitcoins and I bring it to a mixer. The mixer is collecting my bitcoins. It's collecting bitcoins from other people. And it uses these fancy algorithms. One of them is called CoinJoin to pool all of our bitcoins together and then randomly deposit our money into new, clean digital wallets. Now, mixers can be used for legitimate reasons, for privacy, to keep your crypto transactions anonymous.

9:48But they are also essentially the ultimate money laundering tool. So when money hits a mixer, it'd be like if the getaway car went into a building. Like a giant garage. Exactly. It goes into a giant garage and 15 cars come out the other side. And those cars are all identical. I think this is a plot element in Ocean's Eleven. I think it is. It absolutely is. And if it's not, they should build it into the next one. And so what happens there is you don't know which one to continue chasing. You saw one goer go in and you saw multiple come out. All right. Hold up. Hold up, Jeff. You know that I'm not going to allow your erasure of the Fast and Furious franchise to go unremarked.

10:37It's from Too Fast, Too Furious, not from Ocean's Eleven. OK, go on with the show. Okay, okay. Regardless of which fictional movie this came from, in the real world, in the real Axie Infinity heist, these hackers, they weren't just using one mixer. They were using multiple mixers, one after another after another. And all this scrambling can make it really difficult, almost impossible for investigators to follow the trail. Except Erin lets us in on what is kind of a secret. She says she and her team at Chainalysis have started to develop ways to essentially reverse the mixing process, to actually trace the money through a mixer and out the other side to see which is the right car for them to be following.

11:22Do the criminals know you can do this? They are starting to figure it out. So one year ago, I would have said no. And at that point, Chainalysis didn't even talk about demixing. We didn't want criminals to know that demixing, as we call it, was even possible. Wait, so people thought this was actually impossible to figure out which of the getaway cars were the right ones? Yes. Yes, exactly. Erin was pretty cagey about how their demixing technology actually works. When I pressed her for details, she told me it was proprietary, and she didn't want to give away too many clues to the criminals. It sounds like what you're doing is you're taking advantage of vulnerabilities in how these mixers operate.

12:14Erin starts looking at the public relations guy sitting in the corner. I probably can't say that. Okay, it's classified. It's classified. We get it. We get it. It's classified. Yeah. Aaron was not going to tell me how they did the demixing. But I talked to some computer security experts and they told me, in theory, maybe here's how you could do it. Like, you might make a database of all the digital wallets associated with a mixer. You might monitor the entrances, the exits, maybe look for patterns and how money flows in and how money flows out. Still, even with whatever fancy demixing strategies Aaron's team is using, they are not able to keep track of all the money as it bounces around from one mixer to another mixer.

13:00Some of the cars still end up getting away. What fraction of the money would you estimate was lost to the mixing process? Probably about 10 % was lost to the mixing. Yeah. That's like$60 million. That's a lot of money. Yeah, exactly. The stakes are high when you're dealing with$600 million. Now, while Erin is trying to track where all that money is going, she's also trying to figure out who is behind the heist and where the money will ultimately end up. And this is where she starts to get this bad feeling. The way the thieves are moving the stolen crypto, it's clear that this is not some random teenage hacker who just got lucky.

13:42This is a tightly choreographed operation. The hackers are moving the crypto into the mixers at these precisely timed intervals. They're routing it through multiple mixers, including the notorious Tornado Cash. And Erin, she had seen these tactics before. This was the MO of one of the most formidable crypto hacking operations in the world. Once we see the money start moving to Tornado Cash in this way, this very structured, very systematic way, we say, oh, this starts to look like North Korea. And if the North Koreans were the ones behind this hack, this was no longer just about getting the money back for some online game.

14:23This had become a problem of national security.

14:32This message comes from Vanguard. Capturing value in the bond market is not easy. That's why Vanguard offers a suite of over 80 institutional quality bond funds, actively managed by a 200-person global team of sector specialists, analysts, and traders. They're designed for financial advisors looking to give their clients consistent results year in and year out. See the record at Vanguard.com slash audio. That's Vanguard.com slash audio. All investing is subject to risk. Vanguard Marketing Corporation Distributor. This message comes from Greenlight. Parents say financial literacy is the hardest life skill to teach.

15:13Greenlight's debit card and money app for families makes it easy for kids to learn to earn, save, and spend wisely. Start today, risk-free, at greenlight.com slash NPR.

15:29Last year, the FBI created a special team devoted to crimes involving cryptocurrency. So my name is Chris Wong. I'm a supervisor at the Virtual Assets Unit within the FBI. As you might imagine, there's kind of this weird culture clash between the very buttoned up culture of the FBI and the very not buttoned up world of crypto. And this clash is neatly captured by the Virtual Assets Unit's choice of mascot. Oh, of course there's a mascot. We have an alpaca for sure. Really? No. Are you kidding? Yeah, I think it's J. Edgar Hodler. No, no. No, I'm not serious, yeah. It's J. Edgar HODL. You know, like HODLer, if you know crypto.

16:09So this is like a mashup of J. Edgar Hoover, who is the infamous first director of the FBI, and HODL, H-O-D-L. It's like this crypto inside joke. It stands for hold on for dear life, like never, ever sell your crypto. Now, clever mascot aside, Chris is still very much an FBI agent. So while we know that the FBI worked on the Axie Infinity case and we know that Chris is one of the crypto experts inside the FBI, good luck getting Chris to actually talk about the case. Have you worked on this investigation? So we're not in the practice of talking about who, which agent is necessarily involved in any particular case.

16:50You're not allowed to talk about it. That's not really what I said.

16:56Okay. So, interesting. Chris was, however, willing to talk about North Korea's involvement in this kind of thing. Chris is actually an expert in stopping the flow of illegal funds to North Korea. He says North Korea has been frozen out of the U.S. financial system since long before crypto, going back to like the 1950s. For decades, North Korea has been one of the most sanctioned countries in the world. Part of our job is to essentially enforce those rules. Over the years, North Korea has found all these creative ways to work around these rules, like using front companies to secretly sell their coal and buy gas.

17:35But six or seven years ago, Chris noticed the North Koreans were increasingly turning their attention to crypto. I would say like the North Koreans, I call them crypto curious. They do everything. They try everything. Crypto curious. Yeah. Well, you know, the whole promise of crypto is we're going to disrupt the traditional financial system. And I'm sure from a North Korean perspective, it was like, well, the traditional financial system kind of has all these roadblocks. So this sounds great. Let's disrupt it. Yeah. Right. I mean, if you think about, you call them roadblocks, but we call them anti-money learning controls.

18:07You know? Rules. Rules in place for a good reason. Like, dang, you have to provide an ID to open a bank account. These kinds of roadblocks, these whatever rules, by and large, did not exist in the world of crypto back then. The North Koreans could set up accounts and transfer money. No questions asked. And their state-sponsored hackers have turned into some of the world's most sophisticated digital money launderers. Last year, they stole a record-breaking amount of crypto. Some estimates put it north of a billion dollars. So we're talking significant amounts of funds. And, you know, the issue, it's not that, you know, North Korea is stealing these assets and doing good with them.

18:49Like they're diverting large amounts of currency into funding weapons production and weapons delivery systems. Nukes. And yeah, exactly. The Biden administration recently estimated that half of the North Korean nuclear program is being funded by stolen crypto. And 2022 was record-breaking, not just for North Korea's crypto hackers, but also for its nuclear program. Before 2022, North Korea had been doing maybe 10 or 20 cruise and ballistic missile tests a year. Last year, by some estimates, they fired off 90. So the U.S. government is now taking North Korea's crypto operation a lot more seriously.

19:31The Axie Infinity hack, it was really the turning point. Because of that hack, for the first time ever, the U.S. government put sanctions on crypto mixers. They went after two of North Korea's favorite mixers, including the notorious Tornado Cash. They even recently arrested one of Tornado Cash's founders. Shutting down the mixers was one way to make life harder for the Axie hackers, to slow them down. But Chris says the larger goal is not just to slow them down. The goal is to stop the North Koreans from turning their stolen crypto into actual cash. Well, North Korea needs crypto to buy stuff, but you can't buy ballistic missiles with Bitcoin.

20:07You can't? Yeah. Well, I mean, maybe you can. I've never tried, but like ultimately you need to convert this crypto to fiat currency or cash, like government backed cash. Yeah, like dollars or rubles or something. And there are just not that many places where you can offload hundreds of millions of dollars worth of crypto. At the time, one of the big ways for the North Koreans to cash out was to send their crypto to a third party, to a place called a centralized exchange. These are kind of like the banks of the crypto world. And for the FBI, they represent one of the few opportunities they have to actually get some of the stolen money back.

20:47Generally speaking, those are the prime places where we're able to have some sort of impact. Like places that have a real phone number and existence. Sure, but your mileage is going to vary with a lot of exchanges. Some crypto exchanges still see themselves as disruptors of the traditional financial system. They seem to really not care all that much who is using their services. They don't ask their customers too many questions. But some crypto exchanges are more willing to cooperate. When the FBI sees stolen money moving to one of those exchanges, they can reach out. They can say, hey, freeze that account.

21:26It's the North Koreans. And the exchanges will actually do it. Now, the FBI, they are not doing all this alone. Remember, Erin and her team of investigators from Chainalysis, they are also simultaneously digging around in the Axie Infinity case. They've been hard at work following the money up and down the blockchain through all these different mixers. And they think they know where like 90 percent of the stolen crypto is. Their strategy is to exploit the vulnerability that Chris mentioned. So Erin and her team are waiting for the North Koreans to try and cash out the stolen crypto at one of these centralized exchanges.

22:02That is when she and her team will have a brief window of time to catch the money before it slips away again. So we've done a lot of timing analysis on how long you actually have to freeze money. And it's somewhere in the window of 20 minutes to one hour at the most. What? Yeah. Were you literally having people just like 24-hour shifts watching where this money was going? That's exactly what we were doing. Somebody is watching at all times 24-7. It's like a crypto stakeout. Yeah. Aaron says they're just logged on to their computers. They're waiting for an alert to go off that says the money's on the move.

22:41And Erin remembers the first time all of that watching and waiting paid off. I was actually on an airplane and I was connected to the airplane Wi-Fi. And it was like 10 p.m. And one of my investigators said money just moved to this address. And that address we knew belonged to a service that we had relationships with. That's when the timer started. Erin and her team knew they only had 20 minutes, maybe an hour, before the money would slip away and possibly disappear forever. So they reached out to the crypto exchange, convinced them to put a temporary hold on the accounts. Erin says her team then contacted the FBI.

23:20And with the FBI's help, the U.S. government issued a warrant to freeze almost$6 million worth of crypto. And it was exciting because it was also the first time we had seen North Korean money be frozen in a very long time. Really? Yeah. That was their routine for months. Alerts would come in, they would race to contact more exchanges, get more warrants, try to freeze more money. You feel the pressure to get the message out to whoever needs to as quickly as possible, and then you're just like hoping that they're going to respond. At first, a lot of the exchanges would not respond. But Erin says over the last year, the conversations with the exchanges have actually gotten a lot easier.

24:00You could reach out to pretty much any service that you had somebody to reach out to and say, this is Axie money. And they knew exactly what you were talking about. You didn't have to explain. Through this process, week by week, they were able to freeze more of that stolen money. A few million here, a few million there. Money they were keeping out of the hands of the North Koreans. And also, Aaron says, since the heist, the value of the stolen crypto, it's also fallen by like half. But still, we're talking hundreds of millions of dollars. And the truth is, for all their hard work, Erin and her team know that the vast majority of all that stolen money, they are never going to be able to get that back.

24:42If you look at the numbers, I think at the end of this whole investigation, about 20 percent of the money will be recovered. The other 80 percent either got to the North Koreans or is still sitting out there somewhere on the blockchain. I mean, it happens all the time, unfortunately, and it's not, you know, the fault or wrongdoing of anyone. It's the nature of how quickly money can flow through in this digital ecosystem. In the end, the Axie Infinity heist was this kind of watershed moment for the world of crypto. For one thing, it caused the U.S. government to take these unprecedented steps to try to slow down crypto money laundering.

25:23And it even got some folks in the crypto world to start recognizing some of the dangers of crypto. A lot of the centralized exchanges, they're beginning to ask their customers more questions, requiring ID, doing a little more due diligence. For Erin, the Axie case was kind of the high point of her career so far, partly because it was the biggest investigation, but partly because she finally got to share what she and her team had pulled off. She's usually not allowed to talk about her work. They're usually cases that are classified or completely confidential, and we're never able to talk about them.