Follow the Crypto

Every threat actor leaves a financial signature. Ransomware operators, state-sponsored hackers, fraud networks — they all need to move money, and when they do, the blockchain records it permanently.

Jackie Burns Koven leads cyber threat intelligence at Chainalysis, where she tracks how criminal and nation-state actors use cryptocurrency to fund attacks, launder proceeds, and pay for the tools and infrastructure that power the underground economy. Before Chainalysis, she worked in the U.S. Intelligence Community on nuclear proliferation. She also serves on the Ransomware Task Force, the cross-sector coalition working to disrupt the financial ecosystem that makes ransomware profitable.

In this conversation recorded live at the Links conference in New York, guest host Michael Sikorski, CTO of Unit 42, talks with Jackie about how blockchain intelligence works as a threat intelligence discipline, why open-source cryptocurrency is more exposed than most defenders realize, and what the financial signatures of threat actors can reveal that traditional IOCs cannot.

You’ll learn:

How blockchain intelligence connects wallets to threat actors, criminal networks, and nation-state operations

Why cryptocurrency is relevant to every organization, even those that don’t pay ransoms or custody crypto

What North Korea’s $2 billion in stolen cryptocurrency tells us about the scale of state-sponsored crypto crime

How financial signatures can track a threat actor across rebrands, gang changes, and evolving crime types

What most CTI analysts are missing by not having a blockchain tracing capability in their toolkit

This episode is essential listening if you’re a threat intelligence analyst, incident responder, or security leader trying to understand the financial infrastructure that funds the attacks hitting your industry.

Related Episodes:

Muddled Libra: From Spraying to Preying in 2025