Hi, everyone. This is Lindsay O'Donnell Welch
with Decipher. And I'm here today with Arie Red
Board, the Global Head of Policy at TRM Labs.
Arie, how are you doing today? I am great, Lindsay.
Thank you so much for having me and really looking forward to
the conversation today. Yeah, Thank you so much for
coming on. And you know, we're going to
talk today about something that honestly, I don't know too much
about, which is the overlap between cybercrime and
cryptocurrency. And it's, it's a really, really
fascinating subject. But I was looking at TRM Labs
website last night and there were just a lot of terms that
kind of lost me like wallet screening or like in the 2026
crypto crime report you guys released earlier this year, like
a 7A5 tokens, things like that. So I really want to, you know,
hear from you on all these different terms and like get
into this. But first, can you tell me a
little bit about how you specifically got into this space
and specifically with crypto? Absolutely.
Yeah. Well, I'm glad that you're
struggling with that stuff because that is 1 area where I
could be helpful. My wife I think gives me a hard
time. She says that I don't know
anything other than about anything other than that stuff
anymore. You know, sports, politics, it's
just like all crypto crime all the time.
But by way of really quick background, Harry Redboard on
the global head of policy at TRM Labs, Prior to joining TRMI,
spent about 11 years as a federal prosecutor at the US
Department of Justice. And I really spent most of that
time at the intersection of money laundering and national
security, what I call threat finance, essentially stopping
bad actors from getting the money they need to do bad
things. So think sanctions of Asian
criminal prosecutions. Think export control, terrorist
financing. I then spent about two years at
the US Treasury Department working in the office and
overseas, the national security apparatus there.
So OFAC, the Office of Foreign Asset Control, is our sanctions
regulator, FinCEN, which is the US Financial Intelligence unit,
a policy component called TFFC. Really sort of all the ways that
the US Treasury has built national national security, a
national security component to stop bad actors from engaging
with the financial system. I left Treasury about six years
ago and joined what was a seven person startup at the time at
TRM were over 400 people today with a really global team and we
work with law enforcement agencies, regulators and
compliance teams globally to stop illicit actors from using
cryptocurrency. Yeah, that's, it's really
interesting. I'd imagine there is a huge
interest from law enforcement, especially in in what you guys
do and what you see in the threat intelligence that you've
collected in these areas. And you know, from from my
perspective, you know, I think there's almost like a
misconception that like cryptocurrency is fully
anonymous and that's certainly not the case, right?
I mean, transactions are still being recorded and can be traced
at some level. That's what's really
extraordinary about the technology and that's very much
we what we do, we provide for law enforcement.
It's really tracing and tracking software.
It allows them to track and trace every transaction on
public blockchains, which are immutable public ledgers, which
means every transaction is logged and forever.
So it allows law enforcement to track and trace the flow of
illicit proceeds. So if you have a ransomware
attack or you have a hack law enforcement, think FBI or IRS,
criminal investigation, DEA, Secret Service, they use TRM to
track and trace those flows, ultimately with the goal of
building an investigation, prosecution, A seizure,
forfeiture action and getting those funds back from those bad
actors. So that's really the
extraordinary thing about this technology.
You know, I spent my career as an AUSA investigating cases
involving bulk cash smuggling and networks of hawalas and
shell companies and high value art and real estate, right?
There was no TRM to track and trace those things on open
ledgers. And it's really extraordinary.
It's a really extraordinary capability today when it comes
to investigations and compliance.
Yeah, that's really interesting. I'm sure that you have some
fascinating stories, just like being able to trace these types
of things over the years even outside of cybercrime.
Like do you have any like specific incidents that maybe
you track that is? There, there, there are really
so many. I mean, I would encourage your,
your listeners. We put at least one blog post
every week about law enforcement sort of really using our
technology to track and trace, you know, illicit proceeds.
And, and there's so many examples years ago, I feel like,
and maybe for your audience, particularly interesting.
You know, you had the Colonial Pipeline attack, which to me was
like this just extraordinary watershed moment when cybercrime
went from being, you know, I think something that wasn't a
law enforcement focus and, and maybe an annoyance to something
that really became a global security issue.
You know, you're shutting down the gas supply to the the East
Coast of the United States. I remember, you know, waiting in
line in, in, in Washington to get gas.
FBI used our tool to track and trace that ransom payment and
was ultimately able to use their tools to seize back.
And really, I mean, over the last five years since then, as I
said, there's just myriad examples of law enforcement
using these types of tools really more and more at scale.
And we see, we've seen recent investigations involving Iran,
North Korea, you know, ransomware groups, Russian
sanctions evasion. What what what's happening
really is that as we move fully into a digital space, bad actors
are also moving funds on block chains, right, in ways that they
never did before. And the ecosystem is growing and
so is sort of illicit activity. You mentioned a report that we
put out a few months ago, sort of our crypto crime report.
We said that there was about $158 billion in crypto related
crime in 2025. That is a record setting year.
It's still made-up only about 1.3% of all activity within the
crypto ecosystem. So we're talking about a
relatively small percentage of overall activity, but it's
still, you know, 1.3%. That keeps me up at night
because it involves North Korea hacks, it involves ransomware
and terror financing, But the bottom line is more and more
activity is happening in crypto, both lawful activity and and
illicit activity. Yeah, absolutely.
And you know, you mentioned the Colonial Pipeline ransomware
attack. I still remember when the DOJ
came out and said, hey, we were able to get all this, you know,
essentially recover these funds from that.
That was a really interesting point because, you know, at that
point, I think the government was also saying, look, if you
work with us and collaborate with us, then here's like what
we have the capabilities to do and we can, you know, kind of
recover this. So, you know, I think there's a
really interesting, you know, I guess angle there in terms of
how that these attacks or incidents play out after they
happen with capturing that, being able to capture that money
back. Yeah, absolutely.
And you know, look, we are an investigative tool and law
enforcement is sort of using us to track and trace these funds.
And, you know, we we've seen that also recently right now,
there's been this proliferation of scams really driven by
transnational cybercrime groups. There was a recent takedown of a
group called the Prince Group in Cambodia, for example, where the
US was able to actually seize and begin a forfeiture action
for $15 billion, the largest ever forfeiture in U.S. history.
I think the largest forfeiture of anything anywhere in history.
And it's really an only in crypto story because bad actors
are now able to move larger amounts of funds faster
cross-border than ever before. But the paradox is we can now
track and trace them and potentially seize them back,
back for the victims, back for law enforcement.
And I think that's really what we're seeing now.
So we're going to see more and more, right?
I mean, I can go through any number of different types of
cases, but the reality is crypto is becoming used more and more
by both good and bad actors. Yeah, it's funny, I do like to
look through DOJ indictments and like, because it's always
interesting. You can really figure out how
FBI agents are able to kind of draw evidence and identify
people that they're charging in attacks.
And a lot of the times the the crypto wallets are kind of what
they're using as their primary piece of evidence there.
And I think there was like a really interesting case with
like one of the Scattered Spider hackers.
I think it was like a few months ago where they basically they
said they analyzed the blockchain and then found a
wallet on a server that contained portions of the ransom
payment by victims and attacks. And then they also found that
that wallet had been used to buy gift cards.
And those gift cards were used for the food delivery service.
So like, you know, being able to connect all these pieces.
Do you think that bread actors or ransomware actors are
becoming more aware that these bread crumbs are being left
behind and like how to kind of pivot away from that?
Or is this still very much like a, you know, something that's
there and like, useful? Yeah, I know.
Look, these are very sophisticated actors.
There's no question, certainly from a cyber perspective.
And of course, they know and they've known for a long time
that law enforcement is using blockchain intelligence tools
like TRM to track and trace these payments and ultimately
sees them back. You know, it's interesting.
A lot of bad actors globally have gone to stable coins.
They're moving to stable coins for a whole host of reasons why
most why why like lawful actors are using them too.
It's a way to move funds fast in a stable way tied to the US
dollar. Ransomware groups are actually
an exception. And someone asked me about this
recently and I explained that like stablecoin issuers like
Tether, like Circle, have really unique capabilities to burn and
reissue their native token, which means they can actually
remove it from your crypto wallet and put it in a place
where you cannot access access it.
It's extraordinary. It's been a conversation that's
been going on for a number of different reasons recently, post
drift hack. What are the obligations of a
stablecoin issue? What should they be doing here?
But the reality is they have this capability and Tether has
shown that they can do it at scale.
They just did a 300, almost $350 million seizure, I'm sorry,
freeze last week involving Iran. So ransomware actors are still
looking for Bitcoin, which is unstable, but it is truly
decentralized in a way that you cannot, you know, rollback
transactions, you cannot freeze funds.
And that's up to the exchanges sort of not to move them.
So ransomware actors are very sophisticated, but so is law
enforcement. And it's this cat and mouse game
that has gone on forever between the good guys and the bad guys
where, you know, bad actors are early adopters of of new
technology historically and law enforcement is is playing catch
up. But I think that we see law
enforcement more and more leaning into technology.
I mean, 11 sort of important point I think to put on your
question is AI has really supercharged this type of
activity, the scam activity, certainly the ransomware
activity. You know, we, we have always
lived in a world where ransomware groups were looking
for affiliates, right? They were looking for a
franchisees, essentially someone who sits to sell and deploy
their malware. Well, you know, in the age of
AI, you don't need that, right? You can establish agents that
could go out and at scale deploy your malware.
You don't have to have a revenue sharing model with anybody else.
And I think it can allow, it will ultimately allow ransomware
actors to move much faster to continue to attack global health
systems and, and manufacturing and, and critical
infrastructure, but really do it at a scale that we've never seen
before. And that to me is not a national
security threat. That is a civilization level
threat. And that's why I I evangelize
all the time that we need to be countering this activity by
using technology for good. Yeah, that's, that's really
fascinating. That's a great point about the
use of AI as opposed to, you know, continuing to lean on the
affiliate operational model. Have you seen that in I know you
at the back end, you're able to collect all this data and kind
of intelligence at the back like in terms of ransomware attacks,
like have you seen any kind of evidence of that yet or is this?
Something we definitely, we definitely have.
We, we have not necessarily seen it at scale the way we've seen
scam these scam transnational criminal groups from a scam
perspective, really using it from the scam perspective.
I we see it in every case, the use of defect technology really
targeted phishing emails. You know, they're, we're gone to
the days of the Nigerian Prince and the broken English right.
It's perfectly tailored phishing attacks on people.
Slightly different on the ransomware front, but we're
definitely starting to see it. And to me, it's a huge, huge,
huge threat. Yeah, definitely.
Well, I wanted to talk to you mentioned the Drift protocol
heist and that, you know, I definitely wanted to talk about
that. It seems like, I mean that these
crypto heists are absolutely fascinating to me just because
of the sheer amount of money that criminals are able to kind
of, you know, drain from them. And I know you know in the past
we've had the like I think it was by bit was $1.5 billion and
then Ronan network breach in 20/22 was 625,000,000.
So I and I think that it was 285,000,000 that was drift which
was a couple weeks ago now. So wanted to hear your
perspective on kind of what you know, your takeaways were from
that specific one. Yeah.
You know, as I mentioned, we put out a report today that
basically ties together 2 attacks in the first four months
of 2026. North Korea has stolen about 577
million already this year. Last year it was close to 2
billion. That that is 76% of all stolen
crypto this year has been attributed to North Korea, which
is just a stunning number. And they've gotten much better.
North Korea's been very, very good at this for a long time.
I think it's important, I think, for your audience to know who
he's really following this. I mean, North Korea has
professionalized hacking and particularly crypto theft in a
way that we've never seen from any other regime.
And it's not even close. North Korea, you know, from a
young age, they'll take kids who are showing aptitude for STEM
and essentially train them to be cyber warriors.
And people often talk about state sponsored activity in
North Korea. It is not state sponsored
activity. It is the state itself.
North Korea is a criminal state that has decided that without
any meaningful economy, they can steal billions of dollars of
cryptocurrency to fund weapons proliferation and other types of
destabilizing activity. I think what's gotten so really
like troubling about the situation is they've moved from
sort of tech using technology to really using, you know, social
engineering and scale. And you know, you mentioned the
Drift protocol and you mentioned that your, your, your audience
might not be, you know, super crypto native, but Drift is a
trading platform built on the Solana blockchain, which is a
major crypto blockchain. Think of, think of Drift is like
a decentralized exchange where people can trade crypto assets.
And it is a governing body, right?
You have to have some type of mechanism for, for allowing
transactions to go through essentially a Security Council
that's made-up of multiple signers who have to jointly
approve major changes. And essentially, North Korea
spent months, I mean, we're not talking about, you know, a few
days here trying to breach the controls.
This was months getting close to Drift's employees, meeting them
in person meetings, at cryptocurrency conferences.
It's really just unprecedented. And that allowed them to
ultimately get to to ultimately get control of these mechanisms
that allow transactions to go through.
And we're able to essentially unlock that exchange and steal
$285 million. The planning was just
extraordinary. And I think what it also says to
me is that like, they didn't just pick drift, right?
They likely picked many of these.
And I think what I'm so concerned about is that we're
going to start to see a litany of these types of attacks based
on essentially months or even maybe years of planning.
So I, I, I, I look it, North Korea is, is, is a country and,
and you know, a, a threat actor that we followed for a really
long time. We have a guy at TRM named Nick
Carlson. I think Nick is, Nick is a
former FBI analyst who I used to work really closely with when I
was a prosecutor. And we essentially went to TRM
together. And he, he's one of the foremost
experts in the world, But I think his, his view tends to be,
Hey, crypto is just the next thing, right?
First it was, you know, counterfeit $100 bills and, and
counterfeit cigarettes and narcotics.
And now, now they've moved to crypto because you can actually
steal funds at the speed of the Internet.
Yeah, I think the The Drift Protocol hacked definitely, as
you said, it shows kind of just how good, you know, these North
Korean actors have gotten that social engineering.
I mean it, it's played out really almost like a spy novel,
like the way that. It's, it's absolutely
extraordinary and it, and it's been that way for a long time.
If, if, if listeners want to go really deep on this, The Lazarus
Heist podcast is excellent on the BBC with, with, with Jean
Lee, who was AAP Bureau correspondent in North Korea.
It's really, it's really extraordinary and goes back in
time and talks about all the way sort of North Korea has
professionalized this. But it's, it's something that's
been going on for years and years.
And, and I think they've just gotten to the point now where
they it's crazy that when the US thinks about adversaries, we
think about Iran and China and Russia and North Korea is even
in the same breath. But it's because they've
professionalized this capability to steal funds at the speed of
the Internet and use it for weapons proliferation.
They're they're in the conversation and we need to
fight back. When you look at North Korean
actors and how they utilize, or should I say, I guess like.
Cryptocurrency, how is that different from what you see with
ransomware actors or not necessarily North Korean actors,
just other types of cyber criminals?
Yeah, no, absolutely. For North Korea, it's different,
right? Cyber criminals tend to be bad
actors who are motivated by greed, who are trying to steal
funds that may that that are that may be state sponsored, but
may just be sort of a rogue criminal element.
Think of a gang. North Korea is different, right?
This is a government that has no other means of, of, of their
economy. So they're stealing
cryptocurrency and using it to fund their own, their, their
regime essentially. I think that's, that's
significant. So they launder very differently
too. They launder in a way where it
doesn't, you know, no one, they don't care about being caught
because no one is ever going to be caught or extradited anywhere
arrested from North Korea. What they care about is that
they can off ramp as much of the funds as they possibly can as
fast as they can. So they're using, you know,
various different services. They're trying to move the funds
as quickly as possible. They are using Chinese money
laundering networks to actually launder the proceeds of a lot of
these Chinese gangs that have been doing this for years and
and really acting sort of as a nation state actor as opposed to
what sort of a rogue criminal group would do.
Well, yeah, that's interesting too.
I mean, in the in the Drift Protocol hack or heist, I guess,
you know, they were mentioning that the initial people who were
carrying out the social engineering weren't necessarily
North Korean nationals. So that was almost like, you
know, there's multiple different entities being involved there.
Yeah, that fact really took my breath away in terms of like,
you know, I mean, North Korea, it's not easy for North Korea to
necessarily find people to do their bidding.
And the fact that there were, you know, non North Korean
people who were the ones at the conferences having this
engagement. And I think it's a really
interesting question that's going to lead to much more
investigation from FBI and others.
Yeah, certainly. You know, when you look at like
it's just over the years, like over the past what like decade
and a half, two decades, like these types of attacks have
really evolved. But like even looking back at
like going way back, like the Mount G Ox, you know, attack and
things like that, Like how have you seen these types of crypto
heists or hacks like evolve over the years?
They've gotten much bigger for sure, and I think the laundering
has become much more sophisticated.
We now have all kinds of privacy techniques and mixers and
privacy coins and other types of cross chain swaps, right?
Moving funds across block chains as fast as, you know, at rapid
speed in order to obfuscate the flow of funds.
Mixers for your audience or essentially exchanges on block
chains where you put in funds, it mixes them up with other
users and sends them out clean. The other side, we trade at TRM.
We trace, you know, funds through many mixers with a high,
pretty high degree of confidence.
But there's no question that these laundering typologies has
evolved where they're using new services.
You know, for years North Korea used Tornado Cash, which is a
decentralized protocol mixing protocol on Ethereum.
Tornado Cash was sanctioned and then delisted.
And there's all kinds of interesting drama around that.
But they're looking to different services now too.
You know what, what services can they move funds through that
aren't going to freeze them? And you know, we highlight Thor
Chain as one example of that in the report that we put out
today. But there are there are plenty
more. Right.
That makes sense. And I, you know, so I wanted to
ask, you know, about looking at the report that you guys
released from January, there were some really interesting
takeaways in terms of ransomware and kind of what you're seeing
there. Specifically, you know, what
would be in your opinion, some of the the biggest takeaways
with what you found having to do with that?
You know, I think we're seeing more and more attacks.
You know, there's no question. And the attack surface seems to
be getting bigger and not smaller.
I think I testified last week actually before the House
Homeland Security Committee and there was a discussion of
ransomware one of my one of the other panelists talked about and
I was a little taken back. They said about 50% of all
ransomware attacks are on health systems.
And to me, you know, that was pretty extraordinary where
people, you know, ultimately could potentially die, who are
not getting the care that they need or the electricity is going
out or, or these types of issues are happening.
So I, that, that, that to me was something, you know, kind of
recently to learn about. I, I think this idea of the use
of AI to scale these types of attacks potentially something
that we're thinking about very, very closely at TRM, but I think
we're seeing the number of attacks go up.
We're certainly seeing the, the, the size of these, the overall
ransom payments go up. I think it's interesting.
It's it's certainly a a concerning moment, but as bad
actors are scaling this type of activity, I think that's that's
the biggest concern through AI and other types of technology.
Yeah, that's what was really stood out to me at least was,
you know, you get you're able to get a lot of good information
about ransomware operations after the initial attack that
actually happened. So you can see, you know, our
businesses paying the ransom, like what happens to that money,
how it's moved and used over time.
So that's, that's really cool. And one thing that I that stood
out to me when I was looking at the report as well as, you know,
these the points about major disruptions that did not fully
extinguish ransomware groups, but instead kind of had a little
bit of like a scattering impact on them.
I always think that's fascinating because you know,
you see a lot of these disruption efforts being
announced and I always wonder what, you know, if they're going
to have a near term impact or a long term impact and what's kind
of going on behind the scenes there.
So I thought that stood out to me as well.
Yeah, it's a great question. It's interesting.
We had our public sector summit yesterday for TRM, which we
hosted about 200 federal law enforcement agencies, national
security leaders in in our space.
And I, I think one sort of major theme was the idea of
disruption. And I think we have to change
the paradigm a little bit when it comes to sort of this new
world where everything is global, cross-border, North
Korea, Russia, China, right? Places where we might not
necessarily be able to prioritize arrests, putting
people in handcuffs and has to be like, what does disruption
look like? I think disruption certainly
looks like seizures. It looks like forfeitures, name
and shame. But disruption I think is a
little bit of what you're describing as well.
And that is sort of the whack a mole concept.
And whack A mole has a very sort of negative conversation when it
comes to law enforcement. But I I've always been a big
believer that you got to whack some moles every once in a
while. And whacking those moles adds a
little friction possibly to the laundering process.
You know, when you're reconstituting yourself as a new
entity or a new group, that takes work, you know, are you
going out and getting new affiliates?
How are you? How are you what what you know,
is the deal not as sweet as it was because people are worried
about, you know, getting attacked themselves.
So I so I think that like, you know, adding friction to some of
these processes is really useful.
We're not going to end ransomware, certainly not in
this sort of digital age we're we're now fully immersed in.
But I do think we can make it much harder for these groups to
ultimately launder and then off ramp the illicit proceeds and
for your viewers or your listeners, the the world of sort
of crypto crime and blockchain tracing really comes down to how
fast bad actors are able to move the funds to off ramps, right.
You still need to convert those stolen funds into more usable
currencies, U.S., dollars, yuan, whatever it ultimately is rubles
to use them and it becomes this cat and mouse game that has
always gone on between law enforcement using tools like TRM
to track and trace and then that bad actor trying to off ramp
those funds. You know, you mentioned the buy
bit hack earlier in the wake of the buy bit hack last year,
February 21st, we about 1.5 billion is the largest hack by
three times. You know that that's ever
happened before and we never also seen funds laundered and
moved as fast. Within the first few days fund
the entire 1.5 billion was converted from Ethereum to
Bitcoin and then that laundering process began.
So what we realized was then that we need to move faster.
We really, we need to use AI to to supercharge our tracing
capabilities and, and we and we need to really, really wall off
that perimeter around those block chains to ensure that bad
actors aren't getting their funds back.
So a few months later in August, we announced something called
the Beacon Network, which is our answer to a lot of this.
And that is it's the largest information sharing initiative
in, in crypto. We have about, we have about 80%
of all crypto transaction volume, centralized transaction
volume is part of Beacon. So think finance, Coinbase,
Kraken, OK, xblockchain.com, crypto.com, Ripple.
But then fintechs like Robin Hood and Stripe and PayPal and
we basically married them with about 70 global law enforcement
agencies who are flagging illicit proceeds and sending out
real time alerts. Think Beacon Lighthouse, right?
And the exchange gets these alerts and before those funds
can move through the exchange to that off ramp, they're being
blocked and then ultimately working with law enforcement to
seize back. So it's all about speed.
And that's the power of this technology, right?
Like the promise of crypto is cross-border value transfer at
the speed of the Internet. We can now move larger amounts
of funds faster than ever before, for good, for
humanitarian aid, for remittances, for payments.
And yet bad actors are trying to do the same thing.
So we need to move as fast as they are.
That's yeah. That's really interesting.
I also had a question too, in terms of when we're talking
about law enforcement disruption and how governments are kind of
approaching this, the issue of ransomware.
What do you think about sanctions?
Like how effective have those been and especially with kind of
your your own background dealing in that area?
Yeah, Look, I, I think sanctions are one tool in a larger toolbox
of national security tools that we should be implementing
against ransomware gangs, against these scam centers,
against Iran. You know, when I was at at
Treasury, we were talking almost constantly about measuring the
impact of sanctions. And it's not always easy.
But I would say that sanctions, sanctions need to be deployed
against these groups and the states that sponsor them or
allow them to operate, you know, pretty much unfettered.
But but we got to mix it with other tools.
And to me, the most powerful one that we have today that we're
not using effectively is offensive cyber.
If if North Korea can steal 1.5 billion from bibit or 285
million from drift, we should be stealing it right back and more.
And you know, it's interesting. I mean, we're in this really
interesting moment in human history where the private sector
holds all of the data and the public sector has all of the
authorities. And our job is to provide the
public sector with all the data that they need to go after bad
actors. But I think it's also important
to empower the private sector to go after bad actors similarly to
the way we think about public sector.
You know, around the American Revolution and the, and the War
of 1812, we had these things called letters of Mark that
allowed us to go after pirates on the high seas.
I want cyber letters of Mark to allow us to go after these types
of bad actors who operate on blockchains and in the digital
space today. So I think that sanctions are a
really powerful tool, but combined with law enforcement
authorities, national security capabilities like offensive
cyber and, you know, a host of other types of things, I think
we're more, I think we're starting to see the right, like
the, the right level of response here from our government in the
US, from the White House. But there's still more work to
be done for sure. Yeah, definitely.
Absolutely. OK.
Well, is there anything else you want to mention either about
kind of, you know, just cryptocurrency in general?
Yeah, you're in my sweet spot. I'll talk about all of it.
I think, Yeah. I mean, I think we covered a
lot. Yeah, I think we probably
covered a lot, but yeah, I don't know anything else, any other
areas. I mean, obviously the ransomware
piece is someplace that you're very focused and I, I feel like
we covered that pretty well. But yeah, no, I I felt pretty
good. Yeah, awesome.
Well, thank you so much, Arie. It was really nice to, you know,
get some insight from you about what's going on in this space.
I really appreciate you coming on.
Hey, thanks so much for having me.