Amit Kumar (00:13):

Welcome to Spotlight on I'm Amit Kumar, and with me as Chainalysis’ Head of Cyber Threat Intelligence, Jackie Burns Koven.

Jackie Burns Koven (00:20):

Thank you for having me, Amit.

Amit Kumar (00:21):

Jackie, how does one become a Head of Cyber Threat Intelligence? That sounds really hard.

Jackie Burns Koven (00:25):

So I've been at Chainalysis a little over five years. Prior to that, I was in the Department of Defense as an intelligence officer, and I was actually very intrigued by blockchain, the technology as a way of storing data securely. And upon that kind of research, I discovered Chainalysis, which was the perfect blend for me involving innovative technology and getting bad guys as great and fulfilling as my career was in government. There wasn't a whole lot of innovative technology involved or available at my fingertips at the time. Luckily that a lot of that has changed since then, but I really became enamored with Chainalysis’ mission. But the data set is so powerful in enabling investigators, compliance officers, regulators, cybersecurity professionals, and understanding the ecosystem and helping to mitigate risk.

Amit Kumar (01:20):

So Chainalysis is a really unique company in the space. When we think about tech companies, usually they stay away from government or they don't have a deep relationship with the government. Can you talk a little bit about the role in the ecosystem and why they have such a strong partnership with government agencies and brought on someone like yourself five or six years ago to help lead this for that?

Jackie Burns Koven (01:42):

From the beginning, I think Chainalysis, the core of our mission has been this flywheel effect. The public and private sector sharing the same data set, which was so different from my perspective in government where everything was siloed, everything was compartmentalized. Not only did governments not share within their different agencies, but especially with other agencies and with our dataset, everyone has access to the same information and can feed it and communicate back and take action on it, which is really, really powerful when we're dealing with instantaneous transporter payments. And you need to act quickly when there's an illicit event that has occurred. And we've had so many proof points I could point to about stolen funds being intercepted, ransomware payments being intercepted, CAM perpetrators being identified and arrested. And it's really a community of public and private sector that are all mission oriented in building trust in blockchains.

Amit Kumar (02:46):

When we were looking at crypto, it was a category that I think was dynamic and exciting, but also a little bit out there and scary for us. And so I spent about six or nine months writing our crypto thesis and I helped us find Chainalysis. And of course we let the series B there. It's very Accel coded. I mean on some level it's just a great B2B SaaS business with recurring revenue with a really talented executive team. Of course you're a big part of that. But the thing that we really loved about it was was help marrying the crypto future that we all believe in and that we're excited about, but also grounding it in the reality of, well, if you want to create this ecosystem, we just live in the real world where the regulators and government agencies need to be a part of that. And I love the mission about building trust. Obviously there's ups and downs in crypto and the price goes up or the price goes down, but I'm more or less convinced that Chainalysis’ existence and their success is a big part of just the viability of the whole ecosystem. I don't think everybody quite gets that.

Jackie Burns Koven (03:52):

It's been a wild ride. In terms of the ups and downs of the market, new things being built, how have you seen the ecosystem change? From an investment standpoint.

Amit Kumar (04:03):

It's gotten I think a lot more stable. When we first started, there were founders and really early adopters from all over the ecosystem trying to build projects. And some of those projects were coded with tokens and new governing structures. There were ICOs, if you remember that. That was one of the reasons it was like, Hey, don't go chasing waterfalls, just stick to the rivers in the lakes that you're used to. And a B2B SaaS business started by a really talented set of entrepreneurs, felt like something that Accel could wrap its head around. And we've woken up now four, call it like five, six years later. And the major investor, of course in Chainalysis, but also Circle, which are two of the most important companies in the ecosystem. So it's sort of an endorsement that you can kind of stick to your knitting and figure out what are the right businesses to invest in.

(04:53):

One thing I find really interesting about Chainalysis is building trust is a very horizontal mission. On one side, you have sort of the basic KYC motion of helping banks, third parties who are transacting, understand who they're transacting with. That's the basic level of it. And that's sort of how I would think about FinTech usually as I lead a lot of our FinTech investments on the other side, you have sort of where you come in, which is taking down sort of the worst people in the world, the worst actors that are leveraging Bitcoin and blockchain technology to sort of further their ambitions and goals. And I think both of these are super important, but it's that second part where I feel like Chainalysis just to your point, has that unique partnership between government and business in a really unique way. Can you talk a little bit about how we work with government agencies, the partnership? And maybe you could talk about it through the lens of one of the many sort of cases that you've worked.

Jackie Burns Koven (05:57):

Yeah, so I mean we've been a part of many cases, some of which are public and some unfortunately that are not. And some of those are actually some of the most satisfying to me when we've been able to proffer a lead to an agency or entity that they might want to take a look at. But I think really it does take whole of government approach towards its ecosystem and involving private sector. And I think what's unique about blockchain and crime involving an aspect of cryptocurrency is that government understands they need private sector, they need to be able to subpoena those exchanges where the funds wind up to get KYC information they need to be able to issue freeze and seizure orders. One, I think case that really stands out to me of many, it's hard to choose, but I really think our ability to support FBI's seizure of the colonial pipeline funds is just a seminal moment. And I've been looking at ransomware since I first started at Chainalysis. It was this niche thing at the time, you had to constantly explain to people what it was, your phone would auto correct it to some other word, but now I think it's in public consciousness now. There's been enough hospitals and enough schools impacted still.

Amit Kumar (07:28):

For our listeners who aren't familiar with the Colonial Pipeline case, can you just explain what that was?

Jackie Burns Koven (07:32):

Sure. The Colonial Pipeline was hit by Alfie Black cat ransomware causing colonial to proactively shut down the systems. And there were videos of people filling up the lines of cars worried that gas was going to be shut off or there's going to be shortages, and they ended up paying a hefty ransom to, and a large percentage of that ransom was actually recovered. 

Amit Kumar (08:09):

The ransom was paid in Bitcoin?

Jackie Burns Koven (08:12):

That's correct. Yeah. So the majority of ransom payments are paid in cryptocurrency, specifically Bitcoin, and that is a great lead for us investigators. So that was just such a, and despite all the hospitals and all of the schools and all of the horrific nonprofits being hit by ransomware, I think Colonial was really one of the first cases that caused it to be elevated to a national security concern because it impacted people's at the pump. It impacted their pocketbook. Another case, the Net Walker ransomware, which was one of the most prolific ransomwares during the time, and we really saw ransomware kickoff during Covid just spike in numbers of attacks and volume earned. It was just so depraved to hit victims during this time where people are sick, people are dying, businesses are closing. Net Walker really took advantage of the remote work situation by targeting RDPs and solutions needed for remote work and vulnerabilities associated with it.

(09:26):

And one of their affiliates and affiliates are operatives that are part of these ransomware gangs. There is the perception, and there's a lot of ransomware actors based in Russia, but they're not exclusive to Russia. So there was one particular affiliate based in Canada, and we supported FBI's identification of the suspect, and they were able to seize over $30 million in cryptocurrency that were the proceeds of ransoms. So this individual is currently locked up in the us. He's been extradited, the funds have been recovered, and there's victims that might be made whole again. So I think that was really important to showcase. We can fight back, we can use the very cryptocurrency that they demand against them. And this is not an over there problem, this is criminals are entrepreneurial, they're going to go for the paths of profitability. And right now they see ransomware as a lucrative endeavor, and that's not bound by geography.

Amit Kumar (10:42):

You talk a lot about ransomware and obviously that's like a very burgeoning type of case that we're dealing with, but I've been sort of shocked at the breadth of the cases that we've dealt with. One was the funding of terrorist activities, funding of other illicit activities in terms of drug dealing or distribution. And then welcome to video. I remember it was a really seminal moment in the company. I don't know that I've ever been prouder to be part of the company and certainly we're financial investors, but we love investing in businesses that are aligned with us, and that just felt like a very powerful moment. Do you want to talk a little bit about that case and what it meant to be at Chainalysis and be part of that?

Jackie Burns Koven (11:26):

Oh, that was just phenomenal and just the colleagues I know who worked on that case, just the utmost respect. It's such a difficult subject matter. And I think to put it in financial terms, CA doesn't break the bank not going to, you can buy CSAM for five, 10 bucks in cryptocurrency, and some of these CSA vendors aren't financially motivated, which is such an interesting concept. They're involved in this for clout. You can buy CSA by trading for other Cs a materials luckily with some CSAM admins, just like other cyber criminals that might be expert mastermind cyber criminals or admin, but they're not expert launders. And I think what welcome to video really took the veil off of this anonymity, this misconception that you can hide behind the ity of crypto and how a silly mistake can lead to an admin being identified.

(12:39):

And we see this time and time again with other dark net market admins with the smallest purchase can be their demise. And so those are great leads for us. And unfortunately, I think some of these headlines with these big takedowns kind of fuels that misconception that crypto is causing these crimes or fueling these crimes when in reality we would not be able to have these successes if it weren't for the traceability of cryptocurrency and the transparency of the blockchain if these crimes were committed in fiat. Good luck, good luck. And if you ask any investigator what the preferred medium of transaction is, they will say cryptocurrency every time.

Amit Kumar (13:29):

The case was sort of profiled very famously, the book, Tracers in the Dark, is that right?

Jackie Burns Koven (13:33):

That's correct. Great book. Definitely read it if you haven't.

Amit Kumar (13:37):

How has the field evolved? Obviously when you came to Chainalysis you mentioned that blockchain was the new technology, and so you've applied a lot of your expertise and experience to blockchain and you're helping drive this function for us. But over the last couple of years we've seen these breakthroughs in ai. Is that evolving the sort of threat landscape or is that evolving our ability to respond to these sorts of threats?

Jackie Burns Koven (14:00):

Yeah, it's changed so much since I first started at Chainalysis years ago. There's types of crime that didn't exist when I first started. There's different types of exploits. There's new coins just as there are new innovations in blockchain and cryptocurrency, there's threat actors out there who are opportunistic looking for ways to exploit it for malicious purposes. And so we are certainly looking very closely at how threat actors are exploiting new developments in AI. And I do view the AI community with a lot of sympathy because I've lived through cryptocurrency being demonized, but every new technology innovation, there will always be bad actors out there looking to exploit it and use it for malicious purposes.

(14:58):

There's a funny New Yorker cartoon actually, where there's two coworkers and one says to the other, Hey, strike crypto from all the deck and decks and replace it with AI. But I feel like, so I'm looking at that convergence of AI and crypto, and there's certainly bad actors out there who are using AI for scams. So if they're trying to bridge a language barrier, making websites and lures look more sleek, more like the company or service that they thought they were interacting with. So usually the telltale sign in some of these scams is a blatant typo or grammatical error with AI that's that's going away voice cloning for scams. So it'll impersonate a known person, or associate family member. We're looking at AI being used to create CS materials. And so unfortunately these are all reality. There's bad actors using AI to try to write malicious code even. And so one of the scarier prospects is AI identifying zero day vulnerabilities and executing code. So instead of being handcrafted as a lot of zero days are, you can imagine zero days at the speed of machine versus the speed of humans. Another low tech crime that we're seeing that didn't really exist when I first started pig butchering scams.

Amit Kumar (16:38):

I have no idea what that is. I saw that in the notes and I was like, what does that mean? Can you explain that?

Jackie Burns Koven (16:42):

So pig butchering sounds like a derogatory phrase, I won't deny it, but the industry uses this term because that's what the scammers use to indicate their victims. It is from a Chinese phrase, shasu pen, which is pig butchering. They refer to their victims as pigs. And essentially the victims are paying little by little by little by little until they're slaughtered essentially their funds drained entirely. These scammers have playbooks of how to socially manipulate their victims, how to compliment them, how to really get them hook line and sinker to trust them enough to invest cryptocurrency in a fund, even though they've never actually met this person. They'll impersonate an attractive person and sometimes they're in touch with their victims via random text dating sites, social media sites, and they'll develop a long-term relationship over time. And crypto might not come in until a few conversations later.

Amit Kumar (18:00):

Sort of a very elaborate catfishing scam.

Jackie Burns Koven (18:02):

Yeah, absolutely. Absolutely. And this is all human driven. And this is a multi-billion dollar enterprise. Imagine if that was AI behind that, the magnitude of victims they could rake in and the scale. And the thing is, people when they first learn about pig butchering, and this term is used because we could say financial grooming, but I don't think that would get the attention that I deserve. There's a John Oliver special now about pig butchering. It slaps you in the face, it wakes you up, it gets your attention. And when people first hear about it, I would never send cryptocurrency to someone I've never met before. But at the same time, they have developed a relationship with this person. They're looking at a platform that is showing returns, but it's all fake, right? The money's being drained on the other end. And there's educated people. There's people from law enforcement, there's people from compliance who are roped into this. And so I think the real key is education. This is a human problem. All crypto crime, all crime is a human problem and technology is part of the solution, but also so are humans. So is education, talking to your family, talking to your parents?

Amit Kumar (19:28):

Well, we're still in, I know sort of a VC truism, but we're still in the very early innings of crypto adoption. The truth is that most usage in the United States today, still speculation or investment. People are not actively transacting in crypto. Do you think that these problems get exponentially worse if we ever cross that Rubicon and my mom or my dad has crypto in their accounts, which today they don't? Of course. But if that happens, I worry about the AI evolving scam landscape when it comes to the elderly. There's so much wealth that's concentrated with folks that are retiring or post-retirement, and there's a big cat and mouse game being played. Of course, we're looking for investments in businesses which can help protect people. But one of the vectors of protectionists right now, no one has crypto really at that age that they're transacting. And if they do, I would imagine it's going to get much worse.

Jackie Burns Koven (20:25):

And a lot of cryptocurrency businesses and banks of course too, have checks in place for if someone above a certain age start sending cryptocurrency out of the blue and in large amounts. But the sad part is even if a cryptocurrency exchange or bank intervenes with that victim, it says, hey, are you sure you want to send that? Or Chainalysis has identified the recipient of your funds as a scam. They're so hook, line and sinker into this scam that they send anyway. Wow. And so that's why really talking to people and so they can understand how sophisticated and these scams are is really important. And I did want to ask you we're seeing, apart from people who haven't been grown up in crypto or been in this space very long, we're seeing really sophisticated investors losing money in some cases to Steelers and to Drainers that are, they look a lot like the website they thought they were going to. It's a letter off and losing funds in that way. How are threats like that baked into your due diligence process or even boardroom meetings when you're looking at the threat landscape?

Amit Kumar (21:56):

I think the mainstreamification, if that's a word, I can just make that up, the mainstreamification of crypto is really important. There is a demand out there for owning or investing in crypto assets. There is. And if the only way that someone can access that is sort of around conventional financial products or conventional financial institutions, people will do that. And then there will be a loss ratio in terms of folks that get entrapped by malicious actors or third parties that they can't verify. If you can go to Fidelity and open your Fidelity app and buy an Ethereum ETF, I think you're going to find people will select that. It sort of reminds me of music piracy before Spotify made it just easy to just play music, which is, it turns out what people wanted. I mean, shit, I was on Napster or Caza downloading songs.

(22:51):

I think that's what everyone used to do. And as soon as the actual solution comes out that's trusted, that's available, that solves the actual problem, it sort of dries up a lot of that piracy. And I think that's what's going to happen. And hopefully the financial institutions sort of lean into this and realize, and I think we're seeing that it's obviously a process. And I think we went from Jonathan testifying in front of Congress to an Ethereum ETF being approved. We're seeing stable coins being more and more embraced. I think that's just a process that happens. And as an investor and participant in the ecosystem, of course you want it to happen overnight. But I think all big social and technological change in the country, it just takes time. It takes time for our government to get up to speed. It takes time for citizens to get up to speed.

(23:38):

And I think that, to be honest, it's going pretty quickly. I think that the change is happening faster, faster than I would've expected. And I think that we're just headed to a better and better place. So I think we're just kind of in this in-between zone, but I think Coinbase is a big part of the solution. I think Circle is a big part of the solution. I think Jan Alice is a big part of the solution, and I think has more and more of these trusted brands come out there, it will help stabilize the ecosystem. How do you think about building out a function like this at a company like Chainy? Have you found Michael and Jonathan embracing what you've provided and what you're building out at Chainalysis? Have you felt the same from the government side of things? How's that been for you to leave the government come out to the private sector?

Jackie Burns Koven (24:26):

Yeah, no, I was a little bit hesitant. I've never worked with financial institutions before. I never worked with cryptocurrency businesses before. And I actually found pleasantly that these are my people actually. These are people trying to give bad guys a bad day, trying to help victims. And part of my job, we're identifying illicit actors and dark net markets and ransomware payments so that these services can prevent those funds from being laundered on their platform. And I view our customers not only the ones who are direct consumers of our data, but I also view that our customers are really victims. Because if myself, if my team, if we aren't tagging and identifying those scam wallets or those stolen fund wallets, those victims aren't seen. No one who is going to help them in exchange isn't going to be able to identify those funds in time. If we don't find that CSAM market, we are not seeing those victims.

(25:40):

And so my team takes our job very seriously in terms of the speed and dedication. We're lurking in these forums too. We're trying to identify the next threat, the next big thing. And then in addition, from a tactical level, I think blockchain data is really important from a strategic level, giving guidance to decision makers in public and private sector, which dark net marketplaces should be focused on for our stolen credentials, which threats should be prepared for. There's a new malware developer out there, how much money is he making? Is it really getting adoption insurers, underwriters, actuaries, looking at our data from a strategic level to understand the scope of different types of threats in the ecosystem? You don't get that with fiat. You don't get that with other kinds of crime. And so not only does it show potentially the scale of a problem, it also shows impact. It can be our report card. How are we doing? We just passed legislation, we just did a take down what is the impact of this? And it can really help guide action and resources and people into combating different angles of this. So I think from a strategic and tactical standpoint, I think blockchain intelligence is now a need to have for public and private sector in risk and security and also in business growth.

Amit Kumar (27:14):

I would say Chainalysis has really renewed my faith in government and sort of the public private partnerships. One of the things I don't think people realize is the global footprint of Chainalysis. It's not just working with three letter agencies in the United States. It's Interpol, it's Scotland Yard. It's sort of the parallel institution or agency at basically every country around the world. Can you talk a little bit about the collaborative nature of this? It isn't a Democrat or Republican issue, really is bipartisan and there's a coalition of countries who all recognize the challenges that are out there and are collaborating real time to take down the bad guys or the illicit actors. How powerful is it to be in the room with and see that partnership and collaboration? Of course, when you go to Twitter, you kind of just feel like everything's falling apart, but to actually see, hey, there are actually a lot of really talented, competent and well-meaning people that are all working together to make this work.

Jackie Burns Koven (28:11):

Yeah, no, those moments of collaboration are the warm and fuzzies that keep me going. Those are wonderful. I think part of our job, in addition to intelligence, I feel like we're the operator. We're constantly getting teams around the world, law enforcement, in touch with each other. Our data set, I think is what brings them together. So sometimes we'll have law enforcement report addresses to us, and then you'll have someone around the world working the same case who wants to be put in touch and great, they can actually put those missing puzzle pieces together and maybe come up with attribution or interesting ops. I've been so as a former gove myself, so impressed with the adoption of this new technology by the public sector, and I think private sector as well. And I think there are some that initially may have counted themselves out like, oh, horses left the barn.

(29:13):

I don't know this stuff. I didn't grow up with this stuff. I'm never going to get it. And then they find they have this light bulb moment and like, wow, this is even easier than Fiat investigations I have to do. This is so every step of the way is transparent and I don't even have to file a single subpoena that's amazing and get the same reaction from private sector. And so I think that adoption is really great, and that's a lesson I have to remind myself if I try to count myself out like, oh, AI, for instance. And I definitely need to be attuned to new tech because I would need to be aware of how criminals might try to abuse that

Amit Kumar (29:58):

In a moment. Right now of a lot of global turmoil, there's a lot of conflict in the world, and some of the activity is also being financed by crypto. Those are some really heavy decisions in terms of how to be involved in those cases or collaborate with governments. How do you think about that, about putting our thumb on the scale and supporting these cases or not? How does chain analysis make a determination on which cases we should take on?

Jackie Burns Koven (30:25):

Yeah, that's an interesting question, and I think it's important to note. We've been talking a lot about cyber criminals, but nation state actors are also using cryptocurrency. There's several public examples of how China, Iran, Russia, North Korea have state actors have used ransomware for financial gain, but also for espionage destruction. We've seen Russian GRU intelligence actors using cryptocurrency to purchase domains and infrastructure. And if you think of cybercrime underground forum as incubators, so we certainly have nation state actors interested. What are they selling? What are they making? What advancements are happening here? So they are engaging with cyber criminals buying their tools, whether it's to obfuscate their identities or incorporate them into their attacks. So nation state actors and cyber criminals are swimming in the same ponds. 

Amit Kumar (31:34):

Jackie, I'd be curious, you've been there five to six years now. What's been surprising about the journey? And if you could go back in time, which would be a very weird way to use the time machine, I'm sure we come up with some better ideas, but if we could only use this time machine to go back in time and give yourself some advice as you're joining chain, which maybe is a proxy for anyone who's trying to create this function at their own companies, what advice would you give them?

Jackie Burns Koven (31:56):

A little secret is that I didn't start out in this role at Chainalysis. Yeah. When I first joined, I was employee maybe 60 or 70. I took the first non-engineering role available on the website. I was a customer success manager. And I was thrown into the fire, having to understand our products, understand our data, understand our diverse client base from public and private sector, from a century old financial institution to a two month old cryptocurrency, ATM. And that was such a wonderful learning experience for me to get my hands dirty and understand all the different use cases, all the different business models. And I loved it. It was chaos, but I loved it. And not everyone is, and I say this in interviews when interviewing new candidates, it's like not everybody likes that chaos. And so coming from government, it's change.

(33:10):

And one that I really embraced and loved not knowing how my day's going to end up. I think I had it all planned out and then having it all go to hell in the first 20 minutes. And so people who thrive in that environment, and it's not just that I didn't want to say I did it, I thrived. It was the team. The team at Lysis is something really special. Supporting each other, understand there's a lot to learn. And if it wasn't for that core team I had around me, I would've been lost. So that made a huge, huge difference. But I am so grateful for being on the floor and knowing how our customer pain points, knowing the problems they're trying to solve and really, really understanding our data deeply.

(34:09):

And then even then, as we've been talking about the crypto ecosystem has evolved so much new protocol, you reach different levels of understanding only to realize how little, and so I'm constantly humbled and having people who are willing to grow and adapt to their role and their strategies based on this wonderfully wild ecosystem we find ourselves in is really important. And people who love to wear many hats, but also understanding that our job is to grow the company and we have to button things up. We have to have more processes in place. And so somebody who can get you from the wild days when you're doing maybe five different people's jobs to, alright, we are creating standards and processes and documentation. And so it's been such a lovely journey to look back and watch how far we've come and still telling all the new analysts, oh, back in my day we didn't even have this department or that department or, it is been wonderful and I'm just really, really proud of the work that we do and how far we've come and that we've brought on.

Amit Kumar (35:39):

Would you ever go back to government?

Jackie Burns Koven (35:43):

I think maybe one day. Maybe one day it would be really hard to ever leave Chainalysis. But I think it's now that you work with a lot of governments, again, I see that there's so many new resources and capabilities that they have that mission. I feel like I can still fight that mission at chassis and kind of multiply myself across multiple investigations and multiple governments. I kind like where I sit today.

Amit Kumar (36:15):

Well, Jackie, this has been wonderful. Thank you so much for making the time and sharing a little bit about your world.

Jackie Burns Koven (36:19):

Thank you so much, Amit. It's been my pleasure.

‍