10. North Korea’s CIA: The Billion Dollar Heist (Ep 2)

Summary

Podcast Summary: The Rest Is Classified – Episode 10: North Korea’s CIA: The Billion Dollar Heist (Ep 2)

Introduction and Recap

In the second episode of "North Korea’s CIA: The Billion Dollar Heist," hosts David McCloskey and Gordon Corera delve deeper into one of the most audacious cyber heists orchestrated by North Korean intelligence services, known as the Reconnaissance General Bureau (RGB). Building on last week’s discussion, they continue to unravel the complex operation aimed at siphoning nearly a billion dollars from the Central Bank of Bangladesh.

The Attempted Heist by NORCs

Katty introduces the episode by highlighting the scale of the attempted heist:

“$1 billion billion dollars. What did they do in Austin Powers films?” [00:35]

The NORCs (North Korean Operational Cyber units) meticulously planned this operation to fund the North Korean state, including its lavish lifestyle under Kim Jong Un and its weapons programs.

Key Events and Timeline

Gordon sets the stage by outlining the initial discovery of the heist:

“On Friday 5th February 2016, when a duty manager, a guy by the name of Zubair Ben Huda, notices... a printer glitch...” [04:24]

This seemingly innocuous printer malfunction was the first sign of the cyber intrusion. The malfunction occurred in a highly secure room responsible for printing hard copies of significant multimillion-dollar transfers. David underscores the severity:

“$1 billion, Dr. Evil style sounds like a lot. And it is North Korea...” [07:26]

Cybercrime and Reconnaissance

The hosts discuss the RGB's extensive reconnaissance efforts:

“They have been in the system for some time, carrying out reconnaissance so they've learned the systems and they've timed their heist...” [08:14]

This reconnaissance ensured that the operation was executed with precision, minimizing the chances of detection.

The Role of Pyongyang and RGB

Gordon explains the strategic planning from Pyongyang:

“There is an operational chief in Pyongyang who is looking at this thing holistically...” [10:07]

This chief orchestrated the entire operation, ensuring that all components, from cyber infiltration to money laundering, were seamlessly integrated.

The Bank in Bangladesh

The breakdown of the event at the Central Bank of Bangladesh is meticulously detailed:

• Initial Glitch and Investigation:

  “Ben Huda had done, of course, what any sensible person would do when confronted with a printer glitch... prompt his departure...” [05:22]

• Unfolding of the Heist:

  “The printer had been compromised by North Korean malware, making it impossible to fix...” [05:24]

As technicians attempted to restart the malfunctioning printer, urgent messages from the Federal Reserve Bank in New York began printing:

“Messages are extremely urgent. They're from the Federal Reserve bank in New York... instructions to drain the entire account.” [06:07]

Money Laundering in the Philippines

After the initial transfer, the focus shifts to how the stolen funds were laundered:

“They tried to wire this money to a bank in Manila in the Philippines... exploiting holidays and time differences...” [09:08]

The Casino Angle

The most intriguing aspect is the use of casinos for money laundering:

“Casinos offer you a very interesting advantage here because you have to take this money and you effectively have to launder it...” [25:02]

Gordon elaborates on the strategic use of Macau’s casinos, which are less regulated compared to Las Vegas, facilitating the conversion of illicit funds into legitimate currency.

Operational Challenges and Outcomes

Despite meticulous planning, the operation faced setbacks:

“An alert got tripped at the Fed in New York because there was an unrelated business called Jupiter Seaways Shipping in Athens...” [10:43]

This led to most transactions being flagged, with only five out of the initial $1 billion successfully transferred, amounting to approximately $81 million. Katty raises a critical point about the physical cash conversion:

“How do you physically get hold of cash? Because that's the bit that seems to me to be almost the hardest bit...” [12:04]

Human Element and Ethical Considerations

The discussion shifts to the operatives involved, particularly Park Jin Hyuk, a cyber operative whose role is central to the heist. The hosts ponder the ethical dimensions:

“Are they criminals or are they victims?... he's in a system where he doesn't have a lot of agency.” [39:43]

David reflects on the human cost, highlighting the complex motivations and pressures faced by individuals within the North Korean intelligence apparatus.

Comparative Analysis with Other Intelligence Services

Katty asks a pivotal question about North Korea's uniqueness:

“How unique is that? ... is North Korea really unique in just how far it pushes that, where the kind of criminal and the intelligence side are so tightly fused?” [40:08]

Gordon responds by acknowledging similarities with other states like Russia but emphasizes North Korea's distinct integration of cybercriminal activities into its intelligence operations.

Conclusion and Future Implications

The episode concludes with reflections on the heist's partial success and its implications for future operations:

“This is better than nothing... but someone inside the RGB has to account...” [35:16]

Katty notes that North Korea continues to evolve its cyber operations, shifting focus to cryptocurrency exchanges to evade detection. The hosts underscore the ongoing threat posed by state-sponsored cybercriminal activities and the necessity for robust cybersecurity measures globally.

Notable Quotes

• “$1 billion billion dollars. What did they do in Austin Powers films?” – Katty [00:35]

• “This is a very, very carefully thought through operation. This isn't a smash and grab bank job, it's a smart intelligence operation.” – Katty [09:46]

• “Do we know what happens to our hacker?... We don't know whether he's in the shark tank or living it up with the pet dogs and the meth.” – Katty [39:06]

• “They have built the same kind of network as organized crime syndicates to be able to move money.” – Katty [14:00]

Final Thoughts

Episode 10 of "The Rest Is Classified" offers a gripping exploration of North Korea's sophisticated cyber heist against the Central Bank of Bangladesh. Through meticulous research and engaging discussion, David McCloskey and Gordon Corera shed light on the shadowy intersection of espionage and cybercrime, revealing the lengths to which state actors will go to secure illicit funds. This episode serves as a stark reminder of the pervasive influence of cyber operations in modern geopolitics and the ongoing challenges in combating such threats.

Transcript

[Alexandra Daddario]

Foreign.

[Gordon]

This episode is brought to you.

[David]

By our new friends at NordVPN. Now, Gordon, you have been a NordVPN.

[Gordon]

User for over a year now.

[David]

And why in the world do you.

[Evil]

Like them so much?

[Katty]

So many reasons, David. But one feature in particular that I love is that with just one subscription, you can keep multiple devices safe up to 10 at once with the NORDVPN app. So I've got a lot of phones and laptops around the house which I've used over the years in various places. And to keep them all safe and secure, I do use that NordVPN.

[David]

You can also protect unlimited devices on your router by using NordVPN, which means that it is perfect for keeping your family safe online when they're using social.

[Gordon]

Media, email, banking online, or really anything for that matter.

[Katty]

If you want to ensure that you're safe online, you should take advantage of our exclusive NordVPN discount. All you need to do is go to nordvpn.com restisclassified and. And when you sign up, you can receive a bonus four months on top of your subscription plan. And there's no risk with Nord's 30 day money back guarantee. The link is also in the episode description box.

[Alexandra Daddario]

Exclusively on AMC and amc. There's a black cloud that hangs over our family. Anne Rice's Mayfair Witches return. Flash is out there hunting Mayfair women.

[Anthony Scaramucci]

You're gonna have a battle on your hands.

[Alexandra Daddario]

Starring Alexandra Daddario. I'm gonna take care of it. Of him. Surrender to the D. It's not a.

[Gordon]

Sin to kill the devil.

[Alexandra Daddario]

Anne Rice's Mayfair Witches Sundays exclusively on AMC and amc.

[Katty]

Welcome to the Rest is classified. And we're talking and continuing our story about the attempted heist of a cool $1 billion from the Central bank of Bangladesh by by the North Korean security services, the NORCs, as they're called.

[Evil]

The NORCs.

[Gordon]

Gordon, you missed a tremendous opportunity to do a Dr.

[Evil]

Evil impression there.

[Gordon]

You did not take it.

[Evil]

That's unbelievable.

[Gordon]

I mean, that's a.

[Evil]

What a miss.

[Gordon]

What a mess.

[Katty]

$1 billion billion dollars. What did they do in Austin Powers films?

[Evil]

And for those just listening, he also did not put his pinky to his mouth.

[Gordon]

But we are back. And for those who listened, last week we left with the sort of cyber.

[Evil]

Bandits about to enter the digital vault.

[Gordon]

At the Central bank of Bangladesh. And I think it's worth, before we really get into the nuts and bolts of this heist to set up a few kind of key points from last time to really make the Story punch. And we have been following really these.

[Evil]

Robbers through the lens of the one we know about, a man by the.

[Gordon]

Name of Park Jin Hyuk who has gone through this incredible story of joining the Reconnaissance General Bureau, North Korea's foreign.

[Evil]

Intelligence service, the one that ultimately is.

[Gordon]

Carrying out this heist coming up through his, you know, sort of the North.

[Evil]

Korean equivalent of Stanford or MIT or Oxford, being recruited by the Reconnaissance General Bureau, spending time in China and then.

[Gordon]

Really coming back to this Pyongyang that.

[Evil]

Under Kim Jong Un is becoming an absolute boom town. There is more and more money, and so much of that money is coming from cybercrime.

[Gordon]

And so we have really, on the eve of pulling this heist off, Park Jinhyok and these other robbers and cyber operatives inside the Reconnaissance General Bureau are out there doing something that is a key piece of tradecraft really, for North.

[Evil]

Korea's spy services, which is robbery.

[Katty]

Yeah. So it's a heist story, but not really so much about criminals as spies, as a spy service which is carrying out criminal acts to fund the North Korean state, to fund both the lavish lifestyle of the leader, but also the weapons programs and all the other things that North Korea has been doing.

[Evil]

Exactly.

[Gordon]

And last time we really talked about the robbers, you know, we did not.

[Evil]

Talk about the victims at the Central bank of Bangladesh.

[Gordon]

And I think where we could start.

[Evil]

Today would be by diving in and actually going to the bank.

[Gordon]

On Friday 5th February 2016, when a duty manager, a guy by the name.

[Evil]

Of Zubair Ben Huda, notices Gordon, as any modern person would, and be irate over a printer glitch of all things.

[Gordon]

Is going to be the first sign that something inside.

[Katty]

We've all been there.

[Gordon]

We've all been there inside this 12.

[Evil]

Story, really ugly building in the capital.

[Gordon]

Of Bangladesh, Dhaka, he is going to.

[Evil]

Notice this printer glitch.

[Gordon]

And this printer is located in a.

[Evil]

Highly secure room on the 10th floor of the bank's main office.

[Gordon]

And the printer's job is basically to.

[Evil]

Print out hard copy records of the.

[Gordon]

Often multimillion dollar transfers that flow in and out of the bank. So of course there's a digital record of this, which we'll talk about how.

[Evil]

The North Koreans have taken care of that.

[Gordon]

But the printer is the backup, right?

[Evil]

The hard copies that come out.

[Gordon]

Now, Ben Huda had done, of course.

[Evil]

What any sensible person would do when.

[Gordon]

They'Re confronted with a printer glitch, which is when it's discovered, he tells his subordinates to fix it and then he promptly leaves the office. Now, of course, nobody can fix it because the North Korean malware has broken it. Right.

[Evil]

But on Saturday. Right, on Saturday, 6 February, Ben Huda goes back into the bank at around 9am and the printer is still broken.

[Gordon]

So his subordinates have not fixed the problem.

[Evil]

There's error messages.

[Gordon]

And then they do, you know, sort.

[Evil]

Of the second maybe most sensible thing.

[Gordon]

Which is let's restart the printer, turn.

[Katty]

It on and off again.

[Evil]

We've all been there.

[Gordon]

Let's do a hard restart. And as soon as they do that, messages begin to spew out of the printer tray.

[Evil]

And these messages are extremely urgent. They're from the Federal Reserve bank in New York. The Fed.

[Katty]

The Fed, yeah.

[Gordon]

Where the Central bank of Bangladesh has their sort of US dollar denominated account. And what becomes clear from all of.

[Evil]

These messages that are all coming out is that the Fed had received instructions that look like they're coming from the bank or over that Swift system, the sort of interbank messaging system that we had talked about last time. They've received instructions to drain the entire account.

[Gordon]

It's almost a billion dollars.

[Evil]

It's $951 million for the bean counters.

[Gordon]

Out there who are going to follow.

[Evil]

This trail as we talk about it. It's an insane amount of money, and.

[Gordon]

It'S probably the second biggest attempted heist ever in history.

[Katty]

It's a bad day if you're a bank manager, isn't it? If you. It's a printer spews out a message saying, we've agreed to your transfer of $1 billion, or we've got this message.

[Gordon]

Not only are you irate about a printer glitch, but now your day's got a lot of money is being.

[Evil]

Is being taken.

[Gordon]

Now, I do think it's worthwhile to.

[Evil]

Put that number in context for a.

[Gordon]

Minute, because $1 billion, Dr. Evil style sounds like a lot.

[Evil]

And it is North Korea, just to put it in kind of North Korean terms.

[Gordon]

Again, really crunchy numbers are hard to come by.

[Evil]

But North Korea maybe spent around 4 billion on defense in 2019.

[Gordon]

And so we're talking about a number that's maybe a quarter of the military budget, right?

[Katty]

Yeah.

[Gordon]

That is an insane number.

[Evil]

In the US that's like $200 billion. And I think in the UK it's.

[Gordon]

You know, maybe £15 billion or something like that. So it's a massive swing here for.

[Evil]

Park and these bank robbers back in Pyongyang.

[Katty]

We know that the North Koreans have been in the system for some time, carrying out reconnaissance so they've learned the systems and they've timed their heist, haven't they? I mean, that's one of the keys to the operation is they've tried to time it at a moment when it's least likely to be spotted.

[Gordon]

Yeah, that's exactly right. So the Fed, you know those messages that rolled out of the printer?

[Evil]

I mean, the Fed had started sending.

[Gordon]

Messages the day before on Friday, right around mid morning. But with the printer out of action and with the RGB's malware having sort of wiped the record digitally, the company, the Central bank of Bangladesh, really only.

[Evil]

Sees these midday on Saturday.

[Gordon]

But of course, when the Bangladeshis see this, it's Saturday in New York.

[Katty]

And the Feds closed.

[Evil]

And the Feds closed.

[Gordon]

Right.

[Evil]

And then this is also a critical.

[Gordon]

Piece of the sort of the dance.

[Evil]

Here that the North Koreans have so.

[Gordon]

Expertly choreographed, is that the hackers are.

[Evil]

Going to try to wire this money to a bank in Manila in the Philippines. And in 2016, on Monday 8th February.

[Gordon]

Which is the next day, it's the first day of Lunar New Year, which.

[Evil]

Is the national holiday across Asia.

[Gordon]

And so they've exploited these holidays, weekends.

[Evil]

The time difference between Bangladesh, New York.

[Gordon]

And the Philippines, They've actually engineered a five day run of sort of missed.

[Evil]

Handoffs and miscommunication and lag time between all these different parts of the world. They've engineered a five day run to.

[Gordon]

Get the money out.

[Katty]

So it's back to that idea that this is a very, very carefully thought through operation. This isn't a smash and grab bank job, it's a smart intelligence operation.

[Gordon]

I'm not sure if the norcs are a fan of whiteboards and such things.

[Evil]

In their offices, but I would have.

[Gordon]

To imagine that at some point this team in Pyongyang had the choreography, had.

[Evil]

The potential, the timeline up on a whiteboard somewhere. And the operational chief, because park, this bank robbery we've been following is probably more of the foot soldier in this.

[Gordon]

You know, doing a lot of the kind of coding work and things like that to actually do the reconnaissance on the computer systems and to deploy the.

[Evil]

Malware and to write the code that modified the Central bank of Bangladesh's Swift system.

[Gordon]

But there's an operational chief in Pyongyang.

[Evil]

Who'S looking at this thing holistically and interestingly, one of the things that chief.

[Gordon]

Chose, which ends up being a total act of God in some ways, is.

[Evil]

That the bank in Manila that they tried to wire all this money to, they chose a Branch that had an address on Jupiter street in Manila.

[Gordon]

And here we kind of see why cybercrime and espionage is never like the.

[Evil]

Movies, because something random always goes horribly wrong.

[Gordon]

And an alert got tripped at the Fed in New York because there was.

[Evil]

An unrelated business called Jupiter Seaways Shipping in Athens which was on a sanctions watch list for activities related to Iran and sanctions and whatnot.

[Gordon]

And so a bunch of the payments, a bunch of the sort of attempts.

[Evil]

To send that cash to the Philippines got flagged for review inside the Fed. And so many of those ended up actually having a human look at them, as opposed to just dumping the money to the account that the North Koreans had set up in the Philippines.

[Katty]

And so the plan was for close to a billion dollars. They don't quite get that much because some of it gets stopped, but they still get a hell of a lot of money, don't they?

[Gordon]

Well, y. So the payments are reviewed, most are stopped. And here you can imagine a bunch.

[Evil]

Of people in Pyongyang who are watching.

[Gordon]

This and thinking, I cannot believe how unlucky we've gotten. But they're playing a big game here with a lot of bets across cybercrime.

[Evil]

As we discussed last time, in all domains.

[Gordon]

So this is probably part of the game. But five transactions cross the hurdle, five.

[Evil]

Transactions get through, worth about $101 million.

[Gordon]

Now, interestingly enough, this is where you.

[Evil]

Get to this operational chief in Pyongyang.

[Gordon]

View is you think there had to be a plan that was architected and designed and probably approved at very high levels inside the RGB throughout the year that precedes this to think about how do I actually get the money out?

[Evil]

Right. I mean, it's one thing to send it to an account somewhere. It's another thing to actually have access.

[Gordon]

To it in Pyongyang. And they sent 20 million of that 101 million to a Sri Lankan charity.

[Evil]

Called the Shalika Foundation.

[Gordon]

They misspelled the name in the transaction order, which is when a bank employee.

[Evil]

Spotted the spelling mistake, and the transaction was reversed.

[Gordon]

And so in the end, you take that 101, you remove that 20, which got sent back, and $81 million got through. And I think. I mean, it's an interesting question, isn't it, Gordon, of like, did they think they would get away with all of.

[Evil]

It, or had they intended kind of all along for there to be leakage?

[Katty]

Yeah, because even getting 81 or 100 million is some serious money. Now, this is the bit that I find fascinating, because if someone defrauds Me from my bank. You know, I call up the bank and they can see where it's gone and they'll hopefully refund me. But, you know, you can trace the money. So the question in my mind is, how do you get 81 or $100 million out from having moved it in digital terms from one bank account to another? How do you physically get hold of cash? Because that's the bit that seems to me to be almost the hardest bit of the operation. Almost as hard as the hacking bit, which is the technical bit.

[Gordon]

Yeah, you know, I think this is an angle that we have so little insight into. Now, we do know that the Philippines.

[Evil]

Was chosen for some very specific reasons.

[Gordon]

As kind of the terminus for a lot of this money. Not really the terminus, but I guess.

[Evil]

A way station to help them wash the cash. And there's some very good reasons for.

[Gordon]

That which are quite interesting and related.

[Evil]

To casinos and money laundering.

[Gordon]

But I think they had to build a network of assets, people who were.

[Evil]

Probably coerced and there was a ground game.

[Gordon]

And I think that what the RGB did to build that ground game is the murkiest part of the story. And it's the piece of it that is most old school espionage and that you actually had, I think, assets, some witting and some unwitting that the RGB.

[Evil]

Recruited on the ground in the Philippines, or to come to the Philippines, as we'll see, to help them actually launder.

[Gordon]

The cash and get it out.

[Evil]

And that's the piece of the story.

[Gordon]

That is just, you know, hidden in the shadows.

[Katty]

And it is interesting, isn't it, because it's seen as a cybercrime, but you couldn't finish it. You couldn't get hold of the money without people, without a network. And again, it's that bit of, I guess organized crime have got this as well. These networks on the ground of people who are going to help them, you know, launder money, wash money, be able to move it so it's not traced. But in this case, the North Korean intelligence services have built the same kind of network. You'd expect to see an organized crime syndicate build around the world to be able to move money and perhaps for the same reasons, whether some of these people are being paid off or as you said, coerced to do it, we don't always know. But they've got this whole network of people around Asia. It seems to be able to launder the money and to try and get it out.

[Gordon]

And that's where you think about the type of asset that the CIA or.

[Evil]

MI6 may be typically interested in.

[Gordon]

And I actually think there are reasons and cases where these type of people would be exactly the kind of people.

[Evil]

That a Western spy service might try to recruit. But the typical image would be of somebody, you know, let's take the CIA recruiting in Russia.

[Gordon]

Well, you'd want people with access to.

[Evil]

Putin's inner circle, to his plans and intentions.

[Gordon]

You know, maybe that's someone in the.

[Evil]

Ministry of Foreign affairs, maybe that's someone in the Ministry of Defense. Maybe that's an aide in the Kremlin.

[Gordon]

When you're running your spy service like an organized crime syndicate, which is how.

[Evil]

We should think about the Reconnaissance General.

[Gordon]

Bureau, your assets and agents end up being criminals, gamblers.

[Evil]

There's no sort of ethical lens here. There's no lawyers, probably inside the RGB.

[Gordon]

Trying to figure out what's legal and what's not.

[Evil]

You're in this extremely aggressive organization that.

[Gordon]

Probably feels like its back is up against the wall.

[Evil]

And the whole point is generating cash flow. And actually, interestingly enough, it gives you something to offer these people you're recruiting because they can effectively just be on the take.

[Gordon]

You know, they can take a cut. They're sort of working for you under the expectation that there will be a.

[Evil]

Windfall and they'll take a little piece of that. And so the network in the Philippines.

[Gordon]

Is all these, all these types of people. Now, I think we go back and kind of situate this.

[Evil]

We're in the Philippines, it's Monday 8th February 2016.

[Gordon]

There's $81 million that has been sent.

[Evil]

From the Central bank of Bangladesh's account.

[Gordon]

At the Fed in New York into the Philippines. Now, interestingly enough, what the North Koreans.

[Evil]

Have done as part of that ground.

[Gordon]

Game in the year running up to February of 2016 is there have been.

[Evil]

Accounts established at RCBC, this bank in Manila.

[Gordon]

The accounts have been set up by the RCPC bank manager with fake driver's licenses.

[Evil]

All the applicants have exactly the same.

[Gordon]

Job title and salary, despite all working at different companies. And the accounts have sat dormant with.

[Evil]

A $500 deposit in them. And then all of a sudden, over.

[Gordon]

This weekend, these four non existent Filipinos are wildly rich. Michael Cruz doesn't exist. He's got $6 million in his account. Jesse Legrosis doesn't exist. $30 million.

[Evil]

Alfred Vergara, $20 million. Enrico Vasquez, $25 million.

[Gordon]

All of a sudden this money dumps in to these accounts that have been set up by this bank manager. And I think you Know, this bank manager, a woman by the name of Maria Santos de Guito is an interesting piece of the RGB's ground game in Manila because she's established these accounts. Again, it's very murky and sort of who might have asked her or told her to do it.

[Evil]

But this whole day on Monday, now.

[Gordon]

You think about it, the Bangladeshis by.

[Evil]

This point know the money's gone. The Fed knows that the money has.

[Gordon]

Been sent to the Philippines from the central bank's account. Right.

[Katty]

They've worked out it's missing. Yeah.

[Gordon]

So they've kind of, to use the.

[Evil]

Language of a heist, the robbers are being pursued.

[Katty]

Yeah. The chase is on.

[Gordon]

Now, this is where I think the.

[Evil]

Philippines becomes the key piece of the.

[Gordon]

Puzzle here, because this bank manager is unreachable the entire day as the bank.

[Evil]

Is trying to figure out how they.

[Gordon]

Might be able to claw this money back. And a clerk finally goes into her office, she's been locked up in there all day. And the bank manager tells him, I'd.

[Evil]

Rather do this than me being killed or my family.

[Gordon]

Which is a great, actually piece of journalism done by Jeff White, who wrote.

[Evil]

A book called the Lazarus Heist and.

[Katty]

Did a great podcast on it.

[Gordon]

Yeah, and did a great podcast on this. And that afternoon, $400,000 is ordered from the bank's cash center, delivered to the branch, put into a cardboard box and.

[Evil]

Dumped into the branch manager's car. The windows rolled down, the box gets.

[Gordon]

Dumped in, and the closed circuit cameras have been obviously Gordon, out of commission the entire weekend.

[Katty]

How convenient. So we've got the money has gone into these accounts in the Philippines of these mythical individuals. So the next question is, how do you get the money out of the accounts? How do you turn it into real money? That's the thing that I still don't quite understand from one of these kind of cyber heists.

[Gordon]

There's a critical, non glamorous step here that will take us on this chain, and that's from those four accounts, they've.

[Evil]

Moved the $81 million to a single account.

[Katty]

Right.

[Evil]

And that account is held in the.

[Gordon]

Name of a colleague of that branch manager, signatures forged. And it's an absolutely crucial and kind of mundane step because just as the.

[Evil]

Bangladeshis are sort of in pursuit, demanding.

[Gordon]

That the Philippines freeze these accounts, because of course, this is what would happen in a normal case of cybercrime is.

[Evil]

If money was taken from our account.

[Gordon]

And put elsewhere, you could potentially freeze.

[Evil]

That money in that account and eventually claw back.

[Gordon]

Now by moving it. It's infinitely more challenging to stop this flow because legally in the Philippines, rcbc.

[Evil]

The bank can only freeze the accounts into which the money is initially paid. And so by the time they freeze those accounts, there's only $68,000 left in those original four.

[Gordon]

And so on Monday the 8th, that probably crooked or coerced bank branch manager transfers that $81 million to a money changing firm in Manila. And here I think again, we've got.

[Evil]

Some indication of the RGB's ground game.

[Gordon]

Because basically what happens is that money.

[Evil]

Gets sent to this money changing firm.

[Gordon]

And the cash actually gets converted. And here is where it gets turned into something physical for the first time, Gordon.

[Evil]

It gets turned into pesos, the local currency.

[Gordon]

And then two loading teams, primarily of Chinese nationals, show up with a truck, okay? One of them is operated by a Chinese national who's probably an asset of the North Korean RGB. He takes $31 million and gets on.

[Evil]

A plane and leaves.

[Gordon]

Private plane, never seen again. So there's one angle of this story which is just $31 million gets put into a bag and flies out. It probably goes to Pyongyang eventually, but we don't know. And you know, you could sort of speculate that this guy is probably a.

[Evil]

More traditional asset of the North Korean security services.

[Katty]

So let's take a break there and when we come back, we'll see what happens to the rest of the money as we follow its trail, disappearing into where else but the casinos. See you after the break. This episode is brought to you by our new friends at NordVPN. Now, David, what do you find useful about Nord?

[David]

Well, I really like NordVPN's Threat Protection Pro, which is an incredibly powerful and effective antivirus tool. It is integrated directly into the NordVPN app and allows you to browse safely and smoothly while also protecting you from phishing and other cyber threats.

[Katty]

It can often be hard to distinguish fake websites from real ones or phishing texts that appear to be real. But Threat Protection Pro will prevent you from accessing these dangerous things. So NordVPN is actually the first and only VPN app to receive the certificate certification that their anti phishing software is reliable.

[David]

So to stay secure online, you should take advantage of our exclusive NordVPN discount. All you need to do is go to nordvpn.com restisclassified when you sign up, you can receive a bonus four months on top of your plan and there is absolutely no risk. With Nord's 30 day money back guarantee, the link is Also in the episode description box.

[Anthony Scaramucci]

Hi everyone, it's Katty here from the Rest Is Politics Us Anthony Scaramucci. And I want to tell you about our new series that looks at one of the darkest days in modern American history, the capitol riots of January 6th.

[Unknown]

You know, four years have passed since Donald Trump supporters stormed the Capitol building and tried to overturn the 2020 election results. And Katie and I are going to explore the tensions and the personalities at.

[Evil]

The heart of that storm.

[Anthony Scaramucci]

Yeah, we're going to look at the whole story, starting off with, of course, the 2020 election result. It's itself Joe Biden's victory, Donald Trump's attempts to undermine that result right up until January 6th and those horrifying scenes that all of us watched on television back then. So don't miss it. Go and search the Rest is Politics US wherever you get your podcast to hear just how Donald Trump tried to defy American democracy. And we've included a clip from the series for you to listen to at the end of this episode.

[Alexandra Daddario]

Foreign.

[Katty]

Welcome back to the Rest IS Classified. And we're looking at the money trail from these funds stolen by the NORCs, the North Korean security services out of the Bangladesh Central bank. And tens of millions of dollars have found their way to the Philippines. And David, where else but to the casinos?

[Gordon]

To the casinos. I mean, like any good spy story, Gordon, we're going to end up in the casinos here. So the North Koreans, now that $31 million has been flown out probably to Pyongyang on a private jet, there's $50 million. It is Monday 8th February and it's.

[Evil]

Lunar New Year, Gordon.

[Gordon]

And I know that you, like everyone else in this story, celebrates Lunar New Year by gambling. That is how you bang out a Lunar New Year is by sitting in a smoke filled room and playing penny slots. Isn't that right, Gordon?

[Katty]

Never have.

[Gordon]

But this, the North Korean operation was so elegantly timed because they of course.

[Evil]

Very aware that it is Lunar New Year and there's a huge amount of.

[Gordon]

Celebration and gambling going on in casinos in the Philippines. And casinos offer you, if you are.

[Evil]

Park Jinhawk, who's the cyber operative, or.

[Gordon]

If you're this kind of fictional chief.

[Evil]

Of operations in Pyongyang who's been designing this thing end to end. The casino offers you a very interesting advantage here because you have to take this money and you effectively have to.

[Gordon]

Launder it, which you can do a lot of different ways. But it is essentially a practice of I want to hide or obfuscate where.

[Evil]

This money came from.

[Gordon]

And so I'm going to move it through multiple points so that on the other side, you don't know that it came from the Central bank of Bangladesh.

[Katty]

So no one could trace it.

[Gordon]

Yeah, you don't want to trace it. So casinos are really useful for that.

[Evil]

And at this point in the Philippines.

[Gordon]

In 2016, they are woefully unregulated by.

[Evil]

Any kind of anti money laundering legal regime.

[Gordon]

And so taking money from, literally cash.

[Evil]

Or wiring it from an account into.

[Gordon]

The casinos, playing with it and then.

[Evil]

Exchanging that in for chips or check or cash and then walking out is.

[Gordon]

A perfect way to hide where this money came from. And so again, we know we talked a little bit before the break about.

[Evil]

The interesting kind of assets that the North Korean security services recruit.

[Gordon]

And one of those is a Chinese guy named Kim Wong who runs a gaming junket operation out of Macau. He also ran a T shirt factory.

[Evil]

And restaurants in the past. He's close to a bunch of Filipino politicians.

[Gordon]

So he's kind of an all around.

[Evil]

Fixer and resourceful guy.

[Gordon]

And on February 8th and 9th, Kim Wong is basically going to have a.

[Evil]

Whole bunch of guys walk into the VIP area at the Solaire Casino on Manila's waterfront.

[Gordon]

Solaire is very lovely, a very high.

[Evil]

End place, very upmarket for Southeast Asian gaming.

[Gordon]

There's a theater, there's shopping. It's literally as big as anything in Las Vegas. So our listeners should not think of this as some kind of backwater. This is a beautiful, big, glitzy casino.

[Katty]

And these guys, do they know what they're doing or who they're doing it for? They've just been given money to game.

[Evil]

These guys are kind of interesting.

[Gordon]

So they show up and basically all of the firsthand accounts say these guys are not VIPs. I mean, they're showing up in these kind of, you know, high end, you know, high limit gaming rooms and they're getting stacks and stacks of chips from the cages. Tons of money. But they're kind of just dressed almost sloppily.

[Katty]

They're not in the tuxedo, they're not in the James Bond.

[Gordon]

This is the opposite of Casino Royale, right? This is a, you know, a guy.

[Evil]

In sweatpants and a T shirt and flip flops.

[Katty]

But who's gambling with millions of dollars?

[Evil]

But who's gambling with millions and millions of dollars?

[Gordon]

And interestingly, these guys are.

[Evil]

They're on a very strict routine. They play from 8am until 11:30.

[Gordon]

So they're on a schedule. They take a break for lunch, they take their chips up to the room while they eat, and then they rinse and repeat and they go back in the afternoon, they rinse and repeat the next day. And interestingly enough, all of the kind of firsthand reports will say these guys look bored. They're gaming for massive, massive sums of money. And they're totally bored.

[Evil]

They're playing baccarat.

[Gordon]

This is a very simple game. It's all luck.

[Evil]

It's no skill.

[Gordon]

It's one of the most popular games in Asia. And it kind of begs the question at this point in the story of if they're gambling all this money, are the North Koreans sweating this? Because are they gonna lose it all?

[Katty]

Yeah. So first of all, I've never played baccarat. Have you? I mean, I think actually in the James Bond books, in the book of Casino Royal, that's what he's playing. In the film, I think he plays poker, but in the books it's baccarat. I have no idea how to play it. One of yours on your Vegas trips.

[Gordon]

David, you're a penny slots guy, is that right, Gordon?

[Katty]

I have been to Vegas. I'll have you know.

[Gordon]

I went to Vegas for books research. Critical mission, critical book research, actually. I mean, I did set. I've set a number of scenes in my most recent novel in Vegas. And so I went with my wife and a good friend of ours who is a Vegas animal. He takes trips there. He's a big gambler, he loves it. And he's got all these kind of.

[Evil]

Different connections in Vegas.

[Gordon]

He's a baccarat guy, right. And I went again, for the purposes of research, to observe him on one of these sort of colossal, you know.

[Evil]

Into the abyss gambling trips that he takes.

[Gordon]

And baccarat's an interesting game. And my Vegas experience with him so contrasts with this experience of these like 6 to 12 Chinese guys sitting there kind of bored. Because baccarat's a very. It's an intense game, right? It's really kind of a fight against fate.

[Evil]

You bet on either the player winning.

[Gordon]

Or the bank winning. Two cards get dealt each to the banker and the player, and whoever's cards add up the closest to nine wins, period.

[Katty]

Right?

[Evil]

It's very fast. You can play a lot of hands quickly.

[Gordon]

But if you're playing this in a.

[Evil]

Normal context, like in a high limit room in Vegas, like my friend was.

[Gordon]

And I was observing, by the way, he lost massive sums of money in about 30 minutes. Really, it's just wild. Yeah, it's intense. I mean, players are messing around with the cards, doing weird superstitious things, extremely animated.

[Evil]

Like when you're gambling in that context.

[Gordon]

For, you know, tens or hundreds of thousands of dollars on hand, you are really into it.

[Katty]

And it's just luck. It's just luck.

[Gordon]

And it's just luck. Now, they do post these little boards.

[Evil]

That show the run of hands or sort of whether player or bank has won.

[Gordon]

And there is a whole superstitious system.

[Evil]

Around looking at the patterns to discern what comes next.

[Gordon]

But it's all luck. I mean, there's skill involved to some degree in blackjack and certainly in poker. This is just luck of the draw. But if you play baccarat over a long enough period of time and with.

[Evil]

Enough people and you play this many.

[Gordon]

Hands, like competent, you know, players can recoup about 90% of your.

[Evil]

If you walk in with 100 bucks, you'd come out with 90.

[Gordon]

And so I think the North Koreans know this, right? And again, this sort of operational chief in Pyongyang is probably putting all this in a, you know, a PowerPoint presentation.

[Evil]

For his superiors about how they're going to do it.

[Gordon]

And they're assuming we're going to take.

[Evil]

A 10 or so percent haircut on the money.

[Katty]

That's okay if you get it laundered, but I mean, coming out with 90% sounds pretty good. But your friend didn't when he went there.

[Gordon]

No, he lost all his money.

[Katty]

Did you lose yours?

[Evil]

I did not gamble on this trip.

[Gordon]

This was purely for David McCloskey books to have a tax write off. And so I was not gaming.

[Evil]

I was observing and taking copious notes.

[Gordon]

And we spent the rest of the night having margaritas and going to dance clubs. I mean, it was, it was a truly wild trip. It was the opposite of these, these.

[Evil]

Poor Chinese guys who showed up and.

[Gordon]

Probably got paid minimum wage to gamble with millions of dollars for a week or more back to the Philippines. Interestingly, again, while the all these guys are gaming again, the Bangladeshis know the.

[Evil]

Money'S here, the Filipinos know that the.

[Gordon]

Money is there, but there's nothing legally that they really can do, or they're sort of, you know, they're having to.

[Evil]

Be creative with the legal mechanisms they.

[Gordon]

Use to really try to crack down on this. Pretty soon these guys who are gaming, they, they actually start to run out.

[Evil]

Of their own money.

[Gordon]

So they're playing for hundreds of thousands, millions of dollars down to the tables, but they're actually out of their own pocket change. So I think, you know, the RGB's generosity has.

[Evil]

Has run out in paying some of their support assets. They're asking their VIP host for food and cigarettes inside the casino. Eventually, casino staff enter the room.

[Gordon]

They find, you know, Chinese junket operator.

[Evil]

This Kim Wong character who the North.

[Gordon]

Koreans have probably hired, says, oh, this guy's the brains of the operation. Kim Wong gets let go.

[Evil]

The casino has no authority to arrest anybody.

[Gordon]

Right? And eventually the bank will recover about.

[Evil]

$16 million from Kim Wong.

[Gordon]

He'll be charged. The charters are later dropped. It's this whole kind of murky case, and we're down to really, our last about $34 million.

[Evil]

Right.

[Gordon]

So where does. We have.

[Evil]

We've bled so much money out since.

[Katty]

Yeah, started with a billion.

[Gordon]

The initial, you know, almost billion dollars. And this is where Macau comes in. Now, for those who listened to last week's episode, the North Koreans have a relationship with Macau.

[Evil]

There's history here.

[Gordon]

This actually is.

[Katty]

It's a big gambling hotspot, isn't it?

[Gordon]

Right, yeah, for the NORCs. Now, interestingly, Vegas in 2019 generated $9 billion in gaming revenue.

[Evil]

And I think for many of our American or British listeners might be surprised.

[Gordon]

That Macau earns about four times that. It is a massive gaming hub, larger than Vegas. It's a haunt for shady business, for exiles.

[Evil]

And lo and behold, Kim Wong's junket operates out of Macau.

[Gordon]

And this is the place, Gordon, where we do really lose the money. Because that $34 million, probably in late.

[Evil]

February of 2016, after who knows how.

[Gordon]

Many thousands of baccarat hands has been transported into Macau. And then it is probably literally put in bags and flown into Pyongyang.

[Katty]

So we get to the end of the money trail, and we started with a heist that was going for a billion dollars. Now we come to the end of it. Do we know how much they actually got out of it? Tens of millions. It sounds like they managed to transport through the private plane, through the Macau, through elsewhere. I mean, pretty good take, do you think?

[Gordon]

Pretty good.

[Evil]

If you're.

[Katty]

If you're that operational chief sitting in Pyongyang, are you thinking good job, or were you looking at it, you know, a bit like the kind of gambler who nearly got all the fruits on the slot machine, but didn't quite get the big toll and the big win that he was?

[Evil]

I think it's a bit of a.

[Gordon]

Loss for this operational chief because I have to imagine, again, that there was.

[Evil]

An operation that was approved inside the rgb. There was probably some goal. This guy in a meeting with superiors.

[Gordon]

Said, I think we can get X. And my guess is he got a.

[Evil]

Lot less than what he had intended.

[Gordon]

So you could certainly, I think, make the case that, well, this is better than nothing. And the North Koreans are applying kind of a venture capital investment approach to.

[Evil]

Crime, which is you just make bets.

[Gordon]

Everywhere and some will do well and some won't. And in total, you've cast out so many lines that you bring in, you know, the money you need. This is better than nothing. But I have to think that in the sort of the, maybe the bureaucracy of, of the RGB that somebody looked askance at this afterward and said, you know, you screwed up at a couple.

[Evil]

Points and you told us you were.

[Gordon]

Going to get, you know, a half billion.

[Evil]

And here we are with maybe 50 million in cash.

[Katty]

The chief ends up in the shark tank.

[Evil]

Maybe he ends up in the shark.

[Gordon]

Yeah, the tank fitted with sharks, fitted with lasers.

[Katty]

It's interesting, isn't it, because this is a period in which they're trying to do these bank heists. But the North Koreans, I mean, this isn't the end of it. I mean, their kind of cyber operations and their money making operations continue, don't they? Because I think they then start going after crypto exchanges in the years after this. And I saw they took, you know, $60 million from one crypto exchange, tens of millions of dollars from others. So they kind of evolve, don't they? Because I guess they get spotted doing this, they get rumbled during this heist. And maybe it is a bit too obvious getting inside Swift. So once you've done something like this once, you have to move on. So we see them going for crypto assets. I was seeing recently though, that you've got companies who are hiring remote workers to work on their it, and they don't realize, but it's actually a North Korean. You know, you're getting someone who's offering to do some coding job or something remotely, and you think it's someone in some other country, and in fact you're hiring a North Korean and they never appear on the video link. And what they're doing is getting inside your company and doing the reconnaissance and stealing the stuff, a bit like they did with the Bangladesh Central Bank. So what we've seen is, is North Korea kind of learn and adapt and evolve in the way it does these kind of heists in the last few years.

[Evil]

Well, and there's also maybe an element in the win column, Gordon, is that it brings notoriety.

[Gordon]

The Sony Pictures hack put the spotlight on North Korea in A way that I think it's a little bit of.

[Evil]

Making the intelligence services of this country.

[Gordon]

Look extremely risk tolerant. And that's not a bad thing. I mean, having some notoriety to what.

[Evil]

You'Re up to, I think is maybe a part of this. And obviously we're talking about this story today.

[Gordon]

It's been well covered.

[Evil]

There are ingenious angles at various points to the operation itself.

[Gordon]

I think for many of these guys inside the rgb, my sense is they probably got a real thrill out of being involved.

[Katty]

Do we know what happens to our hacker? I mean, he does get indicted by the FBI, doesn't he? And by the Department of Justice. So his picture gets slapped up on the Internet as the most wanted. So he gets a level of notoriety himself, doesn't he, as the kind of face of this, of this hack, Even though there's probably lots of other people involved as well. But do we have any idea what happens to him? He's disappeared somewhere in the system. We don't know whether he's in the shark tank or living it up with the pet dogs and the meth. And, you know, in Pyongyang, he's in.

[Gordon]

His $80,000 apartment, living, interestingly, on probably.

[Evil]

The second floor, because in North Korea.

[Gordon]

The better apartments are at the bottom because the elevators oftentimes don't work and no one wants to walk up 10 to 15 flights of stairs. But, you know, I do think on.

[Evil]

On the human side, I mean, park.

[Gordon]

He'S a sort of thread through this story because he. He's one of the cyber operatives, but.

[Evil]

We don't really know what happened to him afterward. And I do think with any North.

[Gordon]

Korean spy story, certainly you do have to have this question, which is, is he or are people like him, are.

[Evil]

They criminals or are they victims?

[Gordon]

You know, because he's in a system where he doesn't have a lot of agency. Right. And where he doesn't have a lot.

[Katty]

Of choice because he's been plucked out as being a.

[Gordon]

He's been kind of through this, probably, although there's a lot of incentives to opt into this kind of work.

[Evil]

You know, I mean, he's not being given those.

[Gordon]

Those choices.

[Evil]

What does he think about this?

[Gordon]

I mean, you know, there's another lens here, which is Bangladesh is one of the world's poorest countries.

[Evil]

I mean, he has helped to steal.

[Gordon]

Tens of millions of dollars from depositors at a bank in an extremely underdeveloped country.

[Evil]

So they're not robbing the rich here by any stretch.

[Gordon]

Right.

[Evil]

But then on the other side of it, we know that the most elite.

[Gordon]

Cyber operatives in North Korea, you get houses and cars for being part of work like this.

[Evil]

You get special gifts from Kim Jong Un.

[Gordon]

And so I think actually, especially if you apply a lens of, you know.

[Evil]

How many in the west, due to being sanctioned by the Russians, for example.

[Gordon]

I mean, I would think that him.

[Evil]

Having his picture out there and being.

[Gordon]

Indicted by the FBI, I would guess that he has a copy of that FBI, you know, indictment at his house.

[Evil]

Or framed above his desk in Pyongyang as a badge of honor.

[Katty]

Yeah. My sympathies for him, I have to say, are limited. But one more question. I mean, we've talked about the North Korean intelligence services undertaking this kind of criminal activity. How unique is that? There are other services who got involved with hacking. You know, you think about the Russians as well, but in terms of actually crime being part of their overall purpose, not just something they use to do their spy work, but actually money making as being the goal. I mean, is North Korea really unique in just how far it pushes that, where the kind of criminal and the intelligence side are so tightly fused?

[Gordon]

I think it is unique in the fact that I can state that North Korean covert action is essentially robbery, you know, and that's almost always true.

[Evil]

There are other cases you mentioned Russia.

[Gordon]

Which is a good one, where I think oftentimes elements of the security services.

[Evil]

Will effectively moonlight as an organized crime scenic.

[Katty]

Yeah, the overlaps between organized crime and the state are kind of.

[Evil]

Are murky, right?

[Katty]

Murky, yeah.

[Evil]

North Korea is not alone in having.

[Gordon]

Its spy services better thought of as a criminal syndicate.

[Katty]

David, thank you. Great story. Crazy story of the bank heist that could have netted a billion dollars.

[Gordon]

So close. They were so close to their Dr. Evil moment, Gordon. And it will just have to wait for another criminal operation that we can.

[Evil]

Hopefully cover extensively on.

[Gordon]

The Rest is Classified, but I guess we'll leave this one here and we'll look forward to more insane spy stories next time. Thanks for joining.

[Katty]

Thanks for listening.

[Anthony Scaramucci]

As promised, here's a clip from the Rest Is Politics US miniseries.

[Unknown]

Trump is naturally a conspiracy theorist Fueler. He will fuel the fire of any conspiracy theory because he's always seen himself as an outsider and he wants to foment the people from the outside to attack the people from the inside. So he's developing these ideas that he eventually uses in January, on the 6th of January. And the ideas are there's misinformation out there, there's lies out there. Let's use these lies as fodder to attack the people on the inside. He's doing it with COVID I think hydroxychloroquine works. You may remember this. I took hydroxychloroquine. Mr. President, you took hydroxychloroquine. Yeah, yeah, I'm on it. I took it. And this is the beginnings. This is the kernels of what's about to come. And it all starts with COVID and it leads up to this insurrection, or, as the President says, a very peaceful group of tourists descending upon the Capitol building.

[Anthony Scaramucci]

If you want to hear the rest of the show, go and search. The rest is politics, us, wherever you get your podcasts.