THE LAZARUS PIPELINE
North Korea's state hacking units, grouped under the umbrella name Lazarus, have shifted from bank-wire heists to crypto exploits since around 2017. UN panel reports estimate the regime has stolen several billion dollars in digital assets, funding roughly half of its missile and weapons program by some Treasury estimates.
WHY THE ETH SAT IN AAVE
Aave is a lending protocol: depositors supply ETH or stablecoins, borrowers post collateral and draw against it. Stolen funds are often laundered by depositing them as collateral, borrowing other assets, and abandoning the position — leaving the original tokens stuck in the pool when prices move and liquidations trigger.
HOW TERRORISM JUDGMENTS WORK
The Anti-Terrorism Act and the Justice Against Sponsors of Terrorism Act let US victims sue states designated as sponsors of terrorism. North Korea has been on the list since 2017 (and earlier, 1988-2008). Pyongyang never appears in court, so plaintiffs collect default judgments — paper victories worth nothing until assets are found inside US jurisdiction.
THE PSEUDONYMITY MYTH
Every Ethereum transaction is public and permanent. Firms like Chainalysis and TRM Labs cluster wallets by behavior, then tag them when one address touches a known exchange KYC account. Tornado Cash, the mixer OFAC sanctioned in 2022, was the main industrial-scale tool for breaking this trail — and even its deposits are partially de-anonymizable through timing analysis.
THE DAO AS DEFENDANT
Aave has no CEO, no headquarters, no custody of user funds — the protocol is autonomous code, governed by token-holder votes. Treating the DAO as a party that can be ordered to move funds is the novel move: the court is reaching past the smart contract to the humans who hold the governance keys.