The Curious Case of Marine Chain: The DPRK cyberscam behind a blockchain-powered maritime investment marketplace
The latest report by the UN Panel of Experts on the Democratic People’s Republic of Korea (DPRK) published on 9 March 2019 documents the various ways in which North Korea has continued, over the past year, to evade and violate international sanctions under which it is prohibited from dealing with other States due to concerns about its nuclear weapons and missile technology programmes. Among its findings, the Panel recounted “a massive increase in ship-to-ship transfers” that it says has rendered the latest round of UN sanctions “ineffective”; continued violations of the North Korean arms embargo; and a troubling account of how the leadership in Pyongyang has made use of civilian facilities, including public airports, for ballistic missile assembly and testing. The Panel also noted that financial sanctions remain some of the most poorly implemented and actively evaded measures of the sanctions regime against North Korea. With mounting pressure on financial institutions to disrupt North Korea’s illicit financial networks, the Kim regime has been forced to find new ways to evade the restrictions. Consequently, to this end, North Koreans seem to have taken an interest in exploiting cryptocurrencies.
In particular, the report draws attention to alarmingly increasing occurrences of cyber attacks by DPRK actors to illegally force the transfer of funds from financial institutions and cryptocurrency exchanges to the Kim regime, therefore contributing, directly and indirectly, to the North’s nuclear weapons programme. Such techniques and operations are said to have significantly grown in sophistication and scale since 2016 – in 2018, Priscilla Moriuchi, a former US National Security Agency officer, reportedly told Radio Free Asia that North Korea may have raked in more than $200 million in digital cryptocurrency transactions in 2017 alone. As a result, crypto-transactions have become an important tool in the evasion of the sanctions – so much so that the Panel of Experts has now identified the illicit use of cyberspace by North Korean actors as a “trend”. Consolidating these findings, a recent report by the Royal United Services Institute (RUSI) sheds light on some of the intricate ways North Korea seeks to use cryptocurrencies as part of its proliferation financing efforts, including through fundraising, stockpiling or circumvention. Staggeringly, according to RUSI’s estimation, the value of the cryptocurrency North Korea obtained between 2017 and 2018 reached at least $545 million.
One curious example described in the Panel’s report is the case of Marine Chain. Registered in Hong Kong on 12 April 2018, Marine Chain Platform Limited was set up as a blockchain-enabled platform for vessel transactions and offered partial ownership of maritime vessels in exchange for digital tokens. On the Crunchbase database, the company is listed simply as a “next-generation global maritime investment marketplace enabled by blockchain technology,” intended to function as an asset tokenization platform and a digital asset exchange. Its main selling point: to allow vessel owners to “tokenize” ownership of vessels and list part of this asset for sale while allowing accredited individuals and institutions to purchase and trade fractional ownership of these marine assets. In essence, by investing in a Vessel Token Offering, an alternative cryptocurrency based on the Ethereum blockchain platform, investors would be able to own parts of ships and then trade with other buyers.
According to the UN report, in October 2018, a Member State informed the Panel that “a start-up company in the process of establishing itself as a Hong Kong-registered blockchain platform named Marine Chain has at least one DPRK individual behind it”. The same Member State also expressed concern that “the platform could be used to generate money for the regime and as a potential means of evading sanctions on shipping by creating a new method of obscuring the ownership of a vessel”. It also noted that Marine Chain “claimed to be an Etherium(sic)-based blockchain platform with its own crypto-currency token that will facilitate the buying and selling of marine vessels worldwide through digital tokenization”.
This led the Panel to launch an investigation into Marine Chain’s Chief Executive Officer, Singaporean national Capt. Jonathan Foong Kah Keon, on suspicion of violating paragraph 18 of UNSC Resolution 2375 (2017), which prohibits States and their nationals from operating any joint ventures or cooperative entities with the DPRK. The Panel also requested information on a suspected national of the Democratic People’s Republic of Korea who had been presenting himself as a Marine Chain adviser. In his correspondence with the Panel, Foong reportedly provided contradictory information and documentation that did not meet the experts’ evidentiary standards. He claimed that Marine Chain had been shut down, arguing, “the biz was closed because the owner/investor is not paying his bill”. Moreover, on the whereabouts of and his communications with the “owner/investor”, he stated “although I have informed the owner to foot all outstanding bills (Owning (sic) close to 500K US$) he remained silent and we lost communication shortly thereafter”.
It is unclear exactly how much revenue the company raised before it shut down six months later. While it was still active, its website, www.marine-chain.io, was promptly flagged by Reddit users as the exact replica of another site, www.shipowner.io. Additionally, it was shown to have been hosted at four different IP addresses since its registration, though it has since also been taken offline. Additionally, cybersecurity researchers from Inskit Group at Recorded Future in October 2018 released a report titled Shifting Patterns in Internet Use Reveal Adaptable and Innovative North Korean Ruling Elite, stating that Foong had been working to help North Korea evade international sanctions since at least 2013. According to this research, Capt. Foong’s Linkedin profile originally cited a decades-long career in the maritime industry in Singapore – although that profile, too, has now been taken down. Foong has reportedly spoken at numerous events, citing his position at Marine Chain or as the founder of marine-chain.io. Further research published by North Korea-specific policy research website 38North.org in 2015 reveals that Capt. Foong had been identified as either working for or advising companies in Singapore that “have facilitated illicit activity on North Korea’s behalf and that have dealings with UN-sanctioned entities” twice before – once, as an advisor to the Korean “Myohyang International Maritime Institute,” a company then owned by Leonard Lai, a known individual in North Korea’s Singaporean network, and a second time as a Director for the Mongolia Ship Registry Pte. Ltd. in Singapore, which at the time was associated with Sovereign Ventures, another entity linked to “flag of convenience” schemes that routinely used the national flag registries of third countries to obfuscate DPRK-linked vessels or mask illicit North Korean operations at sea.
Alas, as with all things DPRK, the complexities of these associations run deep. The connections to Marine Chain and the discoveries behind it may not be the first time North Korea has turned to cryptocurrencies to circumvent punitive measures, but they do mark the first documented case in which the worlds of maritime sanctions, shipping and blockchain technology converge. This comes as no great surprise – as the UN Panel itself has stated, cryptocurrencies are harder to trace, can be laundered multiple times, are processed in a distributed manner rather than through a central authority and, above all, are (still) independent from government regulation. But perhaps even more significantly, the apparent use of cryptocurrencies by North Korean actors to generate funds for the Kim regime by paying directly for goods, services and resources that are explicitly prohibited by international sanctions is an evident sign of the ever-shifting sandscape that is the sanctions world, and demonstrates yet again that the DPRK is not only willing, but also very able to adapt to new challenges by embracing emerging technologies as part of its strategy to stay ahead of the sanctions curve.
Meanwhile, in Pyongyang, plans are going ahead for an international blockchain and cryptocurrency conference scheduled for 18 to 25 April 2019. Though no other details of the agenda are provided, for €3,300 (£2,900), conference attendees are invited to come together to “share their knowledge and vision, establish connections and discuss business opportunities” around these topics, while also being treated to a seven-day tour of the country. As part of the package, delegates will receive an all-inclusive stay in North Korea, replete with activities such as skating, bowling, shooting and shopping. The cryptocurrency conference concludes with a trip to the Daedonggang Beer Factory on the seventh day.
 David Carlisle and Kayla Izenman, Closing the Crypto Gap: Guidance for Countering North Korean Cryptocurrency Activity in Southeast Asia, RUSI Occasional Papers, 14 April 2019, available https://rusi.org/publication/occasional-papers/closing-crypto-gap-guidance-countering-north-korean-cryptocurrency.
 It is unclear to what extent North Korea has been able to successfully exchange its cryptocurrencies for dollars, euros or other hard fiat currency that it can spend. A CryptoGlobe report talks about how DPRK actors may be using digital currencies by “mixing”, “shifting” and using multiple exchangers to bypass international financial institutions, see https://www.cryptoglobe.com/latest/2018/09/200-million-north-korea-may-be-mixing-shifting-cryptocurrencies-to-acquire-usd-cyber-intelligence-researchers-say/.
 The model which Marine Chain was allegedly emulating is based on ShipOwner (SHIP), another cryptocurrency token that operates on the Ethereum platform. See https://shipowner.io/.