FATF urges global crackdown on DeFi, citing North Korea-linked hackers to steal $570 million

FATF calls for global strengthening of DeFi regulation, mentioning that North Korea-related hacking attacks caused US$570 million in losses.

The Financial Action Task Force (FATF), a Paris-based intergovernmental organization, recently released a report calling for stricter supervision of decentralized financial (DeFi) platforms. The FATF pointed out that many DeFi platforms are only "nominally decentralized" and are still actually controlled or significantly influenced by identifiable individuals or groups. In this case, the relevant responsible party should comply with the same regulatory requirements as other financial institutions.

Vulnerability in DeFi Regulation

The FATF report highlights that nearly 93% of the jurisdictions surveyed have not yet implemented their anti-money laundering regulations on DeFi projects that meet regulatory standards. Of the 142 responding regions, only 26 have initiated risk assessments, only 4 have introduced licensing rules, and so far only 2 regions have licensed or registered DeFi platforms.

The organization divides DeFi projects into three categories: projects with identifiable controllers, projects that are actually centralized but the operators are hidden, and a few projects that are truly decentralized. Only the last category of recommendations can be exempted from FATF. The report found that despite claims of decentralization, factors such as concentration of governance tokens, administrator rights, upgrade controls, and internal reward mechanisms have made many projects highly centralized in actual operations.

The FATF guidelines cover a range of explicit and implicit signs of control, including the ability to update codes, manage fees, adjust risk parameters, operate public interfaces or affect project coffers. When such effects exist, the participants behind the platform-whether they are developers, core token holders, interface operators, or funders-should be licensed and subject to regulation. Running a front-end interface that directs users to the underlying protocol may also constitute sufficient control.

Calls for greater compliance and enforcement

FATF Chairman Giles Thomson said the goal is to allow responsible innovation while preventing criminals from using DeFi technology to launder illicit funds. He sees strong public-private information sharing as a key part of law enforcement strategy. The FATF report urges governments to identify the responsible parties behind DeFi projects and regulate them as virtual asset service providers.

The report points out that so-called decentralized projects often have centralized elements, resulting in centralized governance rights, management authority, or fee structures that benefit insiders. If project organizers refuse to cooperate, the FATF recommends that as a last resort, jurisdictions consider banning such platforms from operating locally. The guidance also encourages the DeFi project to integrate anti-money laundering measures such as sanctions screening or KYC verification directly into smart contracts or user interfaces.

For truly decentralized projects, regulators should focus on relevant "key nodes", such as issuers of stablecoins that can freeze assets, centralized exchanges that handle fiat conversions, or operators that control user-facing websites. Banks and exchanges are advised to conduct due diligence on any DeFi services they contact or stop working with non-compliant platforms.

The DeFi platform is used in crimes

The FATF report highlights DeFi's role in recent major hacking attacks and criminal activities, particularly noting the North Korea-related attack that occurred in April this year, resulting in a total loss of more than US$570 million. The report detailed the damage to Solana-based Drift Protocol (completed in just 12 minutes) and the damage to KelpDAO of $292 million. Together, these incidents accounted for approximately 76% of all cryptocurrency-related hacker losses this year.

Recent enforcement actions, including the U.S. conviction of Samourai Wallet co-founder and Tornado Cash developer Roman Strohm, have reinforced the view that the developers and operators behind the DeFi platform can be prosecuted and regulated as a money services business. The report also noted that ransomware operators, organized money laundering gangs and groups implementing fraudulent investment schemes are using DeFi mixers, bridging and exchange services.

DeFi Growth and Regulatory Response

According to FATF data, DeFi's total locked position value (TVL) this year is US$86.6 billion, an increase of approximately 85% since 2023, with the top 12 agreements controlling more than 60% of the share. The FATF urges regulators to plug existing loopholes and enforce its standards to combat large-scale illegal financial risks while supporting responsible growth in the industry.

Of the 142 jurisdictions surveyed, approximately 7% have applied FATF rules to DeFi, 26 have conducted risk assessments, and only 2 have licensed or registered DeFi platforms.