'Planet Money': How investigators cracked the Axie Infinity crypto hack

A MARTÍNEZ, HOST:

Last year, a team of hackers stole more than $600 million worth of cryptocurrency from an online video game. It was one of the largest crypto thefts ever. Jeff Guo from our Planet Money podcast brings a story of what happened next.

JEFF GUO, BYLINE: The game was called Axie Infinity. It's kind of like Pokemon. It's got these adorable, cartoon blobs battling other blobs.

(SOUNDBITE OF VIDEO GAME SOUND EFFECTS)

GUO: But last March, hackers came for Axie. That is when Erin Plante got the biggest assignment of her life. Erin is the vice president of investigations at a company called Chainalysis. She specializes in hunting down stolen cryptocurrency. Now, because it's cryptocurrency, Erin and her team, they're able to watch in real time as the stolen money bounces from digital wallet to digital wallet. And almost immediately, Erin notices that these hackers are good. This money that they're laundering...

ERIN PLANTE: It starts to hit a mixer called Tornado Cash. And so that immediately sets off alarm bells.

GUO: Tornado Cash is this well-known cryptocurrency mixer. Mixers are digital services that take in cryptocurrency from different places and kind of scramble it all together.

PLANTE: So when money hits a mixer, it'd be like if the getaway car went into a building and...

GUO: A giant garage.

PLANTE: Exactly. Goes into a giant garage and 15 cars come out the other side, and those cars are all identical.

GUO: I think this is a plot element in "Ocean's Eleven."

PLANTE: I think it is.

GUO: Fact check - it was actually a plot element from the movie "2 Fast 2 Furious." But anyway...

PLANTE: Once we see the money start moving to Tornado Cash in this way, this very systematic way, we say oh, [expletive], this starts to look like North Korea.

GUO: This systematic way of laundering crypto, this was classic North Korea. A few weeks later, the FBI confirms it.

CHRIS WONG: I would say, like, the North Koreans, I call them crypto curious. They do everything. They try everything.

GUO: Chris Wong is an FBI agent who specializes in crimes involving cryptocurrency. He says that in recent years, the North Korean hackers have gotten really sophisticated. Last year, it's estimated that they stole more than $1 billion worth of cryptocurrency.

WONG: North Korea is diverting large amounts of currency into funding weapons production and weapons delivery systems.

GUO: Nukes.

WONG: Yeah. Exactly.

GUO: According to the Biden administration, these days, half of the North Korean nuclear program is being funded by stolen crypto. For investigators like Erin, there is a small window of opportunity to try to seize back the crypto before the North Koreans can cash it out for weapons. The North Koreans often try to sneak their crypto through what are called centralized exchanges. These are kind of like the banks of the crypto world. When Erin and her team trace stolen crypto to one of these centralized exchanges, they can reach out, they can say, hey, freeze that account. It's the North Koreans. But they don't have much time before the money is on the move again.

PLANTE: It's somewhere in the window of 20 minutes to one hour at the most.

GUO: What?

PLANTE: Yeah.

GUO: Were you literally having people just, like, 24-hour shifts watching where this money was going?

PLANTE: It's exactly what we were doing.

GUO: Erin says over the past year, they have been able to freeze a few million here, a few million there, but most of that stolen money, she says, they are never going to be able to get back.

PLANTE: If you look at the numbers, I think at, you know, the end of this whole investigation, about 20% of the money will be recovered.

GUO: But Erin says things are getting better. Last year, for the first time ever, the U.S. government sanctioned some cryptocurrency mixers, including Tornado Cash. They even just arrested one of Tornado Cash's founders for money laundering and other crimes. He pleaded not guilty, by the way. The Axie Infinity heist was kind of this turning point for the world of crypto, because today, your crypto might be funding a cute, digital video game, but the next day, it might be in the hands of a dangerous nation state with an illegal nuclear program.

Jeff Guo, NPR News.

(SOUNDBITE OF MUSIC) Transcript provided by NPR, Copyright NPR.