Episode
14 June 2022 Official episode · Official transcript
cybercrime advanced persistent threat bitcoin
The episode examines cryptocurrency thefts and laundering attributed or potentially attributed to the Lazarus Group, including attacks on NiceHash, Coincheck, KuCoin, and the Ronin Bridge, as well as North Korean cryptocurrency scams, malicious trading applications, and fraudulent remote-worker recruitment.
Topics: Cryptocurrency wallet private-key theft, Bitcoin mining pools, Phishing and targeted social engineering, Network pivoting and privilege escalation, Cryptocurrency transaction tracing on blockchains, Cryptocurrency laundering and peel-chaining, Bitcoin tumblers and cryptocurrency mixers, Know Your Customer identity controls, Fraudulent cryptocurrency applications and malicious backdoors, Remote-worker identity spoofing, Initial coin offerings and cryptocurrency exit scams, Cryptocurrency exchange security, Bridge and node compromise, North Korean state-linked cybercrime attribution
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
NiceHash hack INITIAL_ACCESS_VIA phishing
Employees at NiceHash received phishing emails, and an employee apparently clicked one, opened its attachment, and became infected.
Explicit Confidence 99% · Geoff White EP 119 Details
“Employees at NiceHash start to get phishing e-mails sent to them”
NiceHash hack INVOLVES lateral movement
After compromising an employee computer, the attackers moved deeper into the NiceHash network.
Explicit Confidence 98% · Jack Rhysider EP 119 Details
“they burrowed their way deeper into the NiceHash network, pivoting”
NiceHash hack INVOLVES privilege escalation
The attackers escalated their privileges while moving through the NiceHash network.
Explicit Confidence 99% · Jack Rhysider EP 119 Details
“pivoting and escalating their privileges”
NiceHash hack COMPROMISES NiceHash
The attackers gained access to NiceHash systems and drained cryptocurrency from its wallets.
Explicit Confidence 99% · Jack Rhysider EP 119 Details
“this attacker got into NiceHash’s systems and found where the private keys were”
NiceHash hack INVOLVES cryptocurrency wallet private key
The attackers sought NiceHash's Bitcoin wallet private keys in order to empty the wallets.
Explicit Confidence 99% · Jack Rhysider EP 119 Details
“NiceHash’s Bitcoin wallet private keys”
NiceHash hack ATTRIBUTED_TO Lazarus Group
According to the FBI, the NiceHash theft was the work of the Lazarus Group.
Attributed Confidence 95% · Geoff White EP 119 Details
“according to the FBI, this was the work of the Lazarus Group”
Lazarus Group ASSOCIATED_WITH North Korea
The Lazarus Group is described as believed to be working on behalf of the North Korean government.
Uncertain Confidence 94% · Geoff White EP 119 Details
“believed to be working on behalf of the North Korean government”
The WannaCry incident is described as a ransomware cyber-attack that infected hundreds of thousands of devices.
Explicit Confidence 99% · Geoff White EP 119 Details
“the WannaCry cyber-attack, the ransomware attack that hit multiple countries”
WannaCry ATTRIBUTED_TO Lazarus Group
The WannaCry attack was attributed to the Lazarus Group, according to the episode's discussion.
Attributed Confidence 98% · Geoff White EP 119 Details
“the WannaCry attack was also attributed to the Lazarus Group”
WannaCry USES cryptocurrency mixer
The attackers moved WannaCry ransom payments through wallets and cryptocurrency mixers to launder them.
Explicit Confidence 96% · Geoff White EP 119 Details
“the money being moved around, moved to different wallets, tumbled”
Lazarus Group USES targeted phishing
The episode describes phishing emails attributed to Lazarus as carefully crafted for specific employees at specific companies.
Attributed Confidence 97% · Jack Rhysider EP 119 Details
“these phishing e-mails were often very well-crafted to target a specific person”
Marine Chain ICO INVOLVES Marine Chain
The Marine Chain ICO was the fundraising effort associated with the Singapore-based Marine Chain company.
Explicit Confidence 98% · Jack Rhysider EP 119 Details
“Marine Chain was this cryptocurrency startup. I think they were working on an ICO”
Marine Chain ICO ATTRIBUTED_TO North Korea
The Marine Chain ICO is described as a North Korean front operation, although the account is based on later investigation and reporting.
Explicit Confidence 96% · Geoff White EP 119 Details
“it does turn out to be a North Korean front operation”
Tony Walker USES identity spoofing
Tony Walker used the name Julian Kim when signing Marine Chain contracts.
Explicit Confidence 98% · Geoff White EP 119 Details
“he’s signing himself Julian Kim”
Tony Walker SAME_AS Kim Il
The US government says Tony Walker, also known as Julian Kim, was actually Kim Il.
Attributed Confidence 94% · Geoff White EP 119 Details
“the US says is the real name of Tony Walker and Julian Kim”
Kim Il ASSOCIATED_WITH North Korea
According to the US government, Kim Il was an operative of the North Korean government.
Attributed Confidence 95% · Geoff White EP 119 Details
“was actually Kim Il, an operative of the North Korean government”
Coincheck hack COMPROMISES Coincheck
The Coincheck exchange was hacked and its NEM hot wallet was emptied.
Explicit Confidence 99% · Geoff White EP 119 Details
“someone hacked into this exchange ... and found the Nem hot wallet. They emptied the whole thing”
Coincheck hack INVOLVES NEM
The stolen assets in the Coincheck incident included NEM tokens from the exchange's hot wallet.
Explicit Confidence 99% · Jack Rhysider EP 119 Details
“About 500 million Nem were in that hot wallet”
Coincheck hack ASSOCIATED_WITH Lazarus Group
The episode presents the possible North Korean/Lazarus attribution of Coincheck as unresolved and supported only by limited indicators.
Uncertain Confidence 98% · Geoff White EP 119 Details
“It is not clear to me and I don’t think it’s clear to investigators whether this was North Korean”
KuCoin hack COMPROMISES KuCoin
Hackers gained access to KuCoin's wallets and removed multiple types of cryptocurrency assets.
Explicit Confidence 97% · Geoff White EP 119 Details
“once the hackers got in. Because once they get in, it’s not just one wallet they have access to. If they’ve got this kind of blanket backdoor access, they’ve got access to the entire safe and whatever’s in there, so they start pulling out this money”
KuCoin hack INVOLVES ERC-20
ERC-20 tokens were among the assets stolen in the KuCoin attack.
Explicit Confidence 99% · Geoff White EP 119 Details
“Some ERC-20 tokens were taken”
KuCoin hack ATTRIBUTED_TO Lazarus Group
The episode says the KuCoin attack was firmly attributed to North Korea and matched prior North Korean crypto-heists.
Attributed Confidence 95% · Jack Rhysider EP 119 Details
“This one is firmly attributed to being North Korea”
Ronin Bridge hack INVOLVES Ronin Bridge
The Ronin Bridge was the conduit targeted in the major crypto-heist.
Explicit Confidence 99% · Geoff White EP 119 Details
“The Ronin Bridge in the middle is the conduit”
Ronin Bridge hack INVOLVES Axie Infinity
The Ronin network supported deposits for the Axie Infinity NFT game and held substantial associated funds.
Explicit Confidence 98% · Jack Rhysider EP 119 Details
“There’s this NFT game called Axie Infinity which is one of the first NFT games out there and it’s also one of the most popular. To play it, you need to deposit your money into this Ronin network”
Ronin Bridge hack ATTRIBUTED_TO Lazarus Group
Security researchers attributed the Ronin attack to the Lazarus Group, according to the episode.
Attributed Confidence 95% · Jack Rhysider EP 119 Details
“many security researchers have attributed this attack to be the work of the Lazarus Group”
Celas Trade Pro ATTRIBUTED_TO Lazarus Group
Celas Trade Pro is described as a malicious cryptocurrency trading application allegedly launched by the Lazarus Group.
Attributed Confidence 93% · Geoff White EP 119 Details
“the hackers behind it who are allegedly the North Korean Lazarus Group”
Crypto Neuro Trader ATTRIBUTED_TO Lazarus Group
The recorded 2020 case involving Crypto Neuro Trader is attributed by US investigators to the Lazarus Group.
Attributed Confidence 94% · Geoff White EP 119 Details
“the Lazarus Group apparently got away with $11.8 million”
Bobby Sierra USES identity spoofing
Bobby Sierra was described as someone spoofing another person's legitimate resume and identity during a job interview.
Explicit Confidence 99% · Jon Wu EP 119 Details
“He was clearly spoofing someone’s legitimate resume and pretending to be them”
Bobby Sierra ASSOCIATED_WITH Lazarus Group
Jon Wu suspected Bobby Sierra might be a North Korean hacker; later, a US advisory reportedly matched the interview tactics, but the identity was not established as certain in the episode.
Uncertain Confidence 87% · Jon Wu EP 119 Details
“I think I just interviewed a North Korean hacker”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:38:53.920703+00:00