Before his arrest, Virgil Griffith had a reputation as a “cult hacker,” a “tech-world enfant terrible.” A 2008 profile in The New York Times Magazine, published when he was 25, called him the “Internet Man of Mystery,” and cast him as “a troublemaker … A twerp. And a magnet for tech-world groupies,” drinking White Russians and “revel[ing] in the attention of his female fans.”
Griffith had become notorious the year before, when he launched WikiScanner, a website that used IP address databases to expose the anonymous editors of Wikipedia entries. The site’s release brought on a wave of news coverage, as IPs associated with government agencies, political parties, major multinational corporations and religious institutions, from Pepsi to the CIA to the Church of Scientology, were all implicated. The attention transformed him into a minor celebrity. By 2014, Griffith was still marketing himself as a troublemaker. In a promotional video for the reality show “King of the Nerds,” in which he was a contestant, he describes himself as a “journeyman of the internet dark arts.” “I consider myself a rebel,” he adds, speaking into the camera. “Or at the very least, I play to my own drum.”
Griffith had been living in Singapore and working for a cryptocurrency organization, the Ethereum Foundation, for two years when the U.S. State Department denied him permission to visit North Korea for the Pyongyang Blockchain and Cryptocurrency Conference in April last year. But his rebel attitude meant he went anyway. He was arrested months later when he flew back to the U.S. on Thanksgiving. It was then that the Justice Department revealed that Griffith was facing up to 20 years in prison for violating U.S. sanctions on North Korea, because, according to the FBI, the Alabama-born hacker had “participated in discussions regarding using cryptocurrency technologies to evade sanctions and launder money.”
Cryptocurrencies offer an entirely new financial infrastructure, cutting out banks and enabling peer-to-peer transfers that bypass borders and regulators’ jurisdictions.
Griffith has pleaded not guilty, but his case is significant whatever the outcome. It marks the first time a U.S. citizen has been charged with conspiring to use cryptocurrency to evade sanctions—a sign that policymakers are worried about rogue states turning to cryptocurrency to dodge international restrictions on their money.
How Crypto Can Circumvent Sanctions
Since its first nuclear test in 2006, North Korea has been wrestling with U.N. sanctions on everything from its imports of oil and luxury goods to its exports of coal and minerals, as well as certain kinds of financial activity. A host of other countries and multilateral bodies have implemented further measures against North Korea. Unilateral U.S. sanctions are particularly restrictive, targeting a longer list of individuals, businesses and economic activities, including banks, companies and individuals based outside North Korea that are suspected of supporting the state’s weapons program.
But instead of complying with the sanctions, North Korea has reportedly continued to fund those weapons through illicit activities, including the state-sponsored trafficking of arms, drugs and even its own citizens. Last year’s Pyongyang cryptocurrency conference, which was aimed at “building bridges of friendship and collaborations” with tech experts, looked like the regime’s latest attempt to add cryptocurrencies to those sanctions-evading activities. Since 2017, a handful of other states, including Iran, Cuba and Venezuela, have joined North Korea in experimenting with cryptocurrencies as a way to evade international and U.S. sanctions and achieve financial independence.
For decades, nations targeted by U.S. sanctions have searched for ways to move their money outside the U.S.-dominated financial system. To monitor all kinds of international payments, the U.S. relies on the SWIFT messaging service that banks use to communicate payment instructions to each other, and on the correspondent banking system, which routes almost all payments through New York. It is this system, and the oversight it enables, that makes the U.S. ability to implement sanctions particularly effective.
Cryptocurrencies offer an entirely new financial infrastructure, cutting out the need for banks and enabling peer-to-peer transfers that bypass borders as well as regulators’ jurisdictions. Cryptocurrency “mining” involves a highly complex process of verifying other users’ transactions, which requires specialized hardware with significant processing power. Once mined, cryptocurrencies can be exchanged for other assets—whether hard or soft currency, or other cryptocurrencies—or traded by users directly, a process that is now simplified and facilitated by companies like Coinbase that host currencies in app-based “wallets.” Instead of recording transactions in a bank’s ledger, they are catalogued in “blocks” on a blockchain⎯a transparent, distributed ledger technology that stores data on thousands of servers at once, and enables any user to see everyone else’s records in near real-time.
According to Reuters, Griffith may have also been trying to arrange the delivery of crypto mining equipment to help the North Korean regime generate Ether, a cryptocurrency created by his company Ethereum. But North Korea has so far gained more attention for stealing cryptocurrency than creating it. For years, state-backed groups have been helping the regime raise funds by hacking into cryptocurrency exchanges, businesses that enable cryptocurrency to be traded for other assets. Between January 2017 and September 2018, North Korean hackers are thought to have stolen $571 million in cryptocurrency from five exchanges in Asia. Authorities gained insight into how this money was laundered when two Chinese nationals, Tian Yinyin and Li Jiadong, were indicted by the U.S. Treasury Department in March. The U.S. said that Tian and Li stole the equivalent of $100.5 million in cryptocurrency from unnamed exchanges, $34 million of which they converted into Chinese yuan, and a further $1.4 million of which they used to buy iTunes gift cards.
“Without many other ways to legally bring money into the country, North Korea has resorted to straight up stealing it,” says Fred Plan, senior threat analyst at the cybersecurity company FireEye. “North Korea has extremely well-developed cyber capabilities, so for many of the country’s problems, the application of cyber operations has been the go-to solution,” he adds. “Given one of North Korea’s most pressing problems currently is the need for money, it’s no surprise they would exercise their cyber capabilities [to offset] their array of financial problems.” That is especially true since cryptocurrencies deprive the U.S.-centered financial infrastructure of the ability, he says, to “understand, manipulate or track” transactions.
American officials fear that North Korea will funnel this illicit funding into its nuclear program. A Justice Department indictment, unsealed in May, confirmed as much, stating that a cadre of North Korean and Chinese citizens had used more than 250 shell corporations to funnel over $2.5 billion of illicit money into building weapons of mass destruction. After Griffith’s arrest, William F. Sweeney Jr., an assistant director-in-charge at the FBI, told The New York Times, “We cannot allow anyone to evade sanctions, because the consequences of North Korea obtaining funding, technology, and information to further its desire to build nuclear weapons put the world at risk.”
But in the cryptocurrency world, debates about its use in North Korea feed into broader concerns about the effectiveness of sanctions. Although Griffith has not commented on his reasons for traveling to North Korea, some have suggested that his presentation in Pyongyang, entitled “Blockchain and Peace,” was meant to relieve ordinary North Koreans from the poverty and malnutrition exacerbated by American-imposed sanctions. Following his arrest, there was fierce debate on social media over whether this idea had any merit, or if it was a naive misjudgment that would only empower Kim Jong Un’s regime. As the headline in one tech outlet put it, was Griffith a “freedom fighter” or “fool”?
The Perils of ‘Sovereign’ Crypto
Independent cryptocurrencies, like Bitcoin and Ether, were created with the aim of freeing money from government influence and oversight. But in recent years, states around the world have been researching to see how they can take advantage of the efficiency of blockchain technology without losing control of currency. Though no other country is known to carry out brazen crypto heists like North Korea, other states are coming to view blockchain technology as part of a longer-term strategy aimed at undermining U.S. financial power, either by investing in the technology or by developing their own state-backed, “sovereign” cryptocurrencies, also known as central bank digital currencies.
No other country carries out crypto heists like North Korea, but others are coming to view blockchain technology as part of a longer-term strategy to undermine U.S. financial power.
These differ from currencies like Ether or Bitcoin because they are centralized, meaning that payments can be frozen, canceled or otherwise regulated by a central authority, like a country’s central bank. Many central bank digital currencies use blockchain technology, or technology inspired by it. Sweden’s digital currency, the e-krona, for example, uses a blockchain-inspired technology, and China’s digital yuan is also expected to use blockchain to take advantage of its ability to simplify and secure transactions. The emergence of central bank digital currencies has been read as a threat to cryptocurrency’s original aim, since they further empower the very financial systems and governments that crypto was designed to circumvent. As the manager of one cryptocurrency services provider based in Switzerland wrote in VentureBeat in 2018, “In case anyone has forgotten: The end goal of cryptocurrencies was to decentralize power, not to bolster existing centers of authority.”
According to Aditi Kumar, the executive director of Harvard’s Belfer Center, which is tracking the development of these new currencies, their issuance could make it even harder for the U.S. to enforce sanctions. “Those currencies have a central authority, and so you need the cooperation of that central authority to understand what’s happening on that network,” she says. The information stored on the blockchains of Bitcoin and Ether, for example, are publicly available⎯although the sheer amount of information stored there makes it exceedingly difficult to track exchanges. With centralized digital currencies, though, the U.S. will have no way of surveilling transactions, even if it were willing to expend that effort. “We won’t be able to get a handle on activity on that network,” Kumar says. “The most immediate implication is that sanctions become less effective. It’s basically the leaky bucket problem. We could implement sanctions, but if there are workarounds, then they become less potent.”
Yet the first attempt to introduce a sovereign cryptocurrency was widely considered a flop. In December 2017, Venezuelan President Nicolas Maduro took to state TV wearing a beige workman’s shirt to announce the country’s oil-backed national cryptocurrency, the Petro, to a polite smattering of applause. Venezuela was facing a slew of U.S. sanctions, and the new currency, Maduro declared, would “help defeat the financial blockade and move toward new forms of international financing.” Many Venezuelans have in fact turned to established cryptocurrencies as a refuge against the country’s hyperinflated bolivar, so much so that Venezuela has one of the highest rates of cryptocurrency use in the world today. But the Petro failed to win investor confidence, as it was met with skepticism and undermined by the Maduro regime’s reputation for economic mismanagement and alleged corruption.
To achieve one benchmark of success, the Petro would have had to be used to conduct trade. In April 2018, this was clearly the aim, with Venezuelan officials insisting that the Petro would be used to purchase Russian-made trucks, and that Caracas would offer India a 30 percent discount on Venezuelan oil if it used the Petro. Both Russia and India backed out of these deals. Russia’s deputy finance minister said there were no plans to use the Petro to trade, and India said its central bank had prohibited any use of the cryptocurrency, even though doing so could have saved the country $1.6 billion on oil imports. Although Turkey’s foreign minister said in 2018 that his country would be “pleased” to use the Petro, no trade in the cryptocurrency ever materialized.
Despite these setbacks, Maduro continues to promote the Petro, as U.S. sanctions have tightened further and Venezuela’s economy continues its collapse. In January, he decreed that airlines flying from Caracas must use the Petro to pay for fuel.
With a wary eye toward Venezuela, other countries under U.S. sanctions are moving more slowly and deliberately to develop their own sovereign cryptocurrencies. Iran, for example, is “taking time to invest in start-ups, to pilot projects with their banking system and Iranian tech companies,” says Yaya Fanusie, a former CIA analyst who is now an adjunct senior fellow at the Center for a New American Security. “They’re trying to build infrastructure, and they’re investing in research [and recruiting] a cadre of computer scientists who understand cryptocurrency and blockchain technology.” In December 2019, Iranian President Hassan Rouhani suggested that leaders from Turkey, Qatar, Iran and Malaysia create a “Muslim cryptocurrency” to “save themselves from the domination of the United States dollar and the American financial regime.”
Russia has also been working on establishing a “crypto rouble.” At a meeting in Tokyo in 2017 where representatives of 25 countries met to try and set international standards for blockchain, the head of Russia’s delegation, who also worked for the FSB, its intelligence agency, reportedly said, “The internet belongs to the Americans—but blockchain will belong to us.”
U.S. adversaries are not the only ones experimenting with this technology. The Belfer Center’s Digital Currency Tracker lists seven countries that have launched their own pilot digital currencies—China, South Korea, Thailand, Ukraine, Sweden, Uruguay and the Bahamas—with at least a dozen more conducting research and development, including the United States.
Some countries are attracted to centralized digital currencies due to their promised ability to eradicate inefficiencies in the financial system, while others are interested in eliminating financial exclusion. Senegal and Tunisia, for example, have experimented with using cryptocurrencies to reach citizens who don’t have bank accounts. But the ramifications for U.S. financial dominance could be the same unless the global financial system, centered on the U.S., can evolve alongside these new digital currencies.
Rather than adapt, though, the U.S. is responding to this new financial landscape by attempting to regulate or ban some digital currencies outright. In 2018, for example, President Donald Trump used an executive order to ban U.S. companies and citizens from using Venezuela’s Petro. But beyond new regulation, policymakers in the U.S. have few options to crack down on these new currencies. “It’s not like nuclear materials, where there’s a lot of hardware and expensive stuff. We’re really talking about software,” Fanusie says. “A lot of it is open source. It’s free software that’s really easy for the developers to create, so they can’t necessarily stop a country from creating these new systems.”
U.S. authorities are attempting to prevent the misuse of digital currencies. But whether they will invest resources to adapt to the new financial reality is yet to be seen.
Instead, can sanctions be adapted to a future filled with national cryptocurrencies? According to Fanusie, regulators are trying to adopt new strategies, but they have not been very successful so far. The Treasury Department’s sanctions list now includes digital currency addresses; earlier this month, for instance, it added 23 addresses that it said were used to fund Russian-linked election interference. “But there’s a technical problem there,” Fanusie notes. “You can create a cryptocurrency wallet easily. So if the U.S. sanctions your wallet, there’s nothing that keeps you from turning around, downloading some software, creating a new wallet with new addresses, and then just going about your business. That’s why there’s a lag between what the regulators are doing and what the sanction evaders are going to do.”
Consider how one Iranian Bitcoin trader responded to being sanctioned last year by the Treasury Department’s Office of Foreign Assets Control, which listed his Bitcoin addresses. As the trader, Mohammad Ghorbaniyan, told The New York Times, he was back in business a week later, and set up a new, anonymous Bitcoin address in just five minutes. “Perhaps my name remains sanctioned, but we don’t use names online,” he told the Times’ Thomas Erdbrink. And now he knew to keep his accounts anonymous. “Basically, Treasury just Googled me,” he said. “I’m not making the same mistake again.”
The Future of Finance
For countries under sanctions, cryptocurrencies—whether the likes of Bitcoin, or state-backed digital currencies like Venezuela’s Petro—are a long-term strategy, not a short-term fix. Attempts so far to evade sanctions using this technology, including North Korea’s cybercrimes, have shown that countries are not yet capable of moving enough money around at scale to insulate their economies from sanctions. But it’s early days.
“We’re still in the very early stages of understanding how different digital currency projects would be structured,” says the Belfer Center’s Kumar. “A world where there are many competing digital currencies,” she adds, “could become a very complicated system with many competing offerings for people to use for payments.”
The possibility of sanctions evasion is just one part of a larger challenge as economies around the world adapt to the rise of digital currencies. “These new financial pipelines are going to require innovative approaches to governance and compliance in order to maintain global financial integrity,” Fanusie and his colleague, Trevor Logan, wrote in a report last year for the Foundation for Defense of Democracies. They said that authorities “must do more than passively monitor adversaries’ attempts to build new systems,” and that “U.S. policymakers and financial sector stakeholders will need to take the lead in this evolving international ‘crypto race.’” They urged the U.S. to thoroughly investigate the emerging threats posed by digital currencies, hire blockchain experts to guide U.S. financial authorities, and “encourage computer science talent to build blockchain solutions” by funding private pilot programs.
Virgil Griffith’s case demonstrates that U.S. authorities are advancing their efforts to prevent the misuse of digital currencies. But whether they will invest the necessary resources to adapt to the new financial reality these abuses represent is yet to be seen. As the Federal Reserve’s Lael Brainard acknowledged in his 2018 speech to a San Francisco cryptocurrency conference, “even if cryptocurrencies prove to have a very limited role in the future, the technology behind them is likely to live on.” Change is coming, and the case against Griffith won’t be enough to stop it.
Morgan Meaker is a freelance journalist based in London. She writes about human rights and digital politics. In 2018, she was selected as one of Forbes 30 under 30 working in European media.
