Senior Intelligence Analyst DPRK China Focus

Unchain Data; United States; Hybrid; USD 150,000 - 230,000; Full time

Job summary

Chainalysis is seeking a senior intelligence analyst to own DPRK and China attribution end to end. You will map on-chain activity, surface threats for sanctions, and produce actionable intelligence for clients and publications.

The role requires deep DPRK/China expertise, strong writing, and experience in threat-finance or national security. You will collaborate with analysts, data scientists, and engineers worldwide and drive automation to scale analysis.

Qualifications

• Deep, demonstrable DPRK and/or China expertise; command of crypto operations and/or money-laundering networks.
• On-chain tracing ability against DPRK/China targets with proven skill.
• National-security or threat-finance background in intelligence, sanctions, or investigations.
• Regional fluency on DPRK and Chinese illicit-finance ecosystems.
• Elite potential with a track record leading hard problems end to end.
• Excellent writing and outward-facing communication skills.
• AI-forward instincts: build automation to scale work.
• Comfort working with data; blockchain forensics experience preferred.
• 5+ years of analytic, intelligence, or threat-finance experience for Senior hire; 8+ for Staff.

Responsibilities

• Own DPRK & China attribution end to end including Lazarus Group and related networks.
• Lead attribution responses to sanctions events and turn designations into data coverage.
• Map networks on-chain: trace funds through mixers, bridges, no-KYC, OTC, and laundering channels.
• Produce finished intelligence and briefings for customers and flagship publications.
• Be the external expert representing Chainalysis on DPRK/China crypto threats publicly.
• Set collection agenda and direct domain data requirements within the team.
• Translate typologies into detection guidance for products and customers.
• Build with AI to scale analysis and support colleagues.

Skills

DPRK expertise

China expertise

On-chain tracing

Threat finance

National-security background

Regional fluency

Excellent writing

AI-forward

Data-driven

Tools

Blockchain forensics

Job description

About Us

Chainalysis is the blockchain data platform, making it easy to connect the movement of digital assets to real-world services. Powered by deep blockchain data and AI, organizations can investigate illicit activity, manage risk exposure, and develop innovative market solutions built on the industry\'s most trusted blockchain intelligence. Our mission is to build trust in blockchains, blending safety and security with an unwavering commitment to growth and innovation.

The R&D team at Chainalysis is inspired by solving the hardest technical challenges and building products that establish trust in cryptocurrencies. We\'re a global organization that thrives on challenging work and doing it alongside exceptionally talented teammates. Our industry evolves rapidly, and our mission is to build a flexible, AI-driven platform that automates entity resolution, optimizes data labeling pipelines, and creates predictive models that identify illicit patterns before they escalate.

Our data and solutions have been used to solve some of the world\'s most high-profile criminal cases and grow consumer access to cryptocurrency safely. By pairing the industry\'s most trusted blockchain data with agents that reason, investigate, and act, we help our customers scale their workflows as the cryptocurrency economy becomes increasingly mainstream.

The Role

The Global Intelligence Team produces the attribution at the heart of blockchain data — connecting on-chain activity to the real-world entities behind it, across the global crypto ecosystem. It\'s the intelligence data moat beneath every Chainalysis product, and what investigators, sanctions authorities, and national-security agencies rely on to follow the money and disrupt threats.

As our DPRK- and China-focused intelligence analyst — the team\'s subject-matter expert on North Korea and China — you\'ll own the problem of making DPRK and Chinese crypto activity visible on-chain end to end. This is a depth role: while our analysts cover the breadth of the crypto-services ecosystem, you\'ll go deep on a single, high-stakes domain — becoming the person, inside Chainalysis and increasingly across the industry, who understands how DPRK and Chinese actors use crypto and can prove it on-chain. You\'ll own the attribution for their crypto footprint, map how these networks actually operate, turn that into finished intelligence customers act on, and be the expert voice representing Chainalysis on DPRK and China crypto threats.

Few threats test that mission harder than North Korea and China. Through Lazarus Group, the DPRK has stolen billions in crypto — via exchange and DeFi hacks and IT-worker schemes — to fund its weapons program, then laundered it through mixers, cross-chain bridges, and Chinese OTC networks. China, in turn, sits at the center of global crypto money laundering — from guarantee marketplaces and underground banking to scam compounds, fentanyl vendors, and cartel-linked laundering. The two are deeply intertwined, and making that activity visible on-chain is one of the most consequential problems in crypto intelligence today.

Who You\'ll Work With

You\'ll join a fast-moving, globally distributed team — analysts, threat-domain SMEs, data scientists, and engineers — collaborating across time zones, async and in real time. We move fast, hold each other to a high bar, and back each other up across regions. As the DPRK & China SME, you\'ll be the single point of depth for the domain and a force multiplier for everyone working adjacent to it.

Responsibilities

• Own DPRK & China attribution end to end — the threat-actor entities, their definitions, and the accounts, addresses, and infrastructure they operate: Lazarus Group and DPRK state-sponsored theft and laundering, DPRK IT-worker networks, Chinese-language OTC and underground-banking networks, guarantee marketplaces (e.g., Huione-style platforms), scam-compound and pig-butchering laundering infrastructure, fentanyl and precursor vendors, and Chinese money-laundering organizations.
• Lead the attribution response to DPRK- and China-related sanctions events — when OFAC or allied authorities designate DPRK actors, exchange-hacking units, or Chinese laundering networks, drive the rapid, high-visibility on-chain attribution that turns those designations into coverage in our data, often against the clock.
• Map the networks on-chain — trace how stolen and illicit funds move through mixers, cross-chain bridges, no-KYC swaps, OTC brokers, and off-ramps, following DPRK hack proceeds into and through Chinese laundering infrastructure, and keep that picture current as they adapt to pressure.
• Produce finished intelligence — advisory notes, customer and partner briefings, and contributions to flagship publications (the Crypto Crime Report and beyond) that make DPRK theft/laundering and Chinese money laundering legible and actionable.
• Be the named external expert — represent Chainalysis on DPRK and China crypto threats at conferences, on panels, with the press, and in briefings to public- and private-sector partners.
• Help set the DPRK & China collection agenda — surface what data we need on these networks and feed those requirements into our collection process and priority intelligence requirements; you direct collection for the domain, but it runs through the team\'s apparatus and prioritization, not you alone.
• Translate typologies into detection — turn what you learn about DPRK and Chinese methods into guidance that our products and our customers can operationalize.
• Build with AI — design and tune the automation that scales your analysis and the team\'s, and handle the hard cases automation can\'t.
• Level up the team — raise the bar on DPRK, China, and money-laundering tradecraft broadly, and partner closely with analysts, other SMEs, data science, and engineering.

Requirements

• Deep, demonstrable DPRK and/or China expertise — real command of DPRK state-sponsored crypto operations (Lazarus Group, exchange and bridge hacks, IT-worker schemes) and/or Chinese-language money laundering, OTC and underground banking, guarantee marketplaces, and organized-crime finance. This is the core of the role, and we\'ll expect you to show it.
• On-chain tracing ability against DPRK/China targets — direct experience following DPRK hack laundering or Chinese OTC/laundering networks on-chain, or deep DPRK/China threat-finance expertise paired with proven blockchain-tracing skill you can bring to bear here from day one.
• A national-security or threat-finance background — intelligence, sanctions, counter-threat-finance, or investigations, from the IC, Treasury/OFAC, law enforcement, the military, a think tank or research institution, or private-sector CTF/sanctions work.
• Regional fluency — a strong grasp of the DPRK and Chinese illicit-finance ecosystems and regional money-laundering flows.
• Elite potential and a proven track record — exceptional aptitude, judgment, and work ethic; you\'ve led hard problems end to end and you raise everyone around you.
• Excellent writing and communication — this is an outward-facing expert role; your intelligence has to land with analysts, customers, and senior audiences alike.
• AI-forward instincts — you build automation to scale your work and others\', not just use it.
• Comfort working with data; blockchain forensics experience strongly preferred.
• 5+ years of relevant analytic, intelligence, or threat-finance experience for a Senior hire; 8+ years and recognized domain authority for a Staff hire.

Nice to Have

• Mandarin and/or Korean language ability.
• Direct experience with OFAC sanctions, designations, or the designation process — especially involving DPRK or Chinese entities.
• A record of published research or public speaking on DPRK crypto theft, Lazarus Group, or Chinese money laundering.
• Familiarity with cross-chain bridge and mixer laundering, guarantee marketplaces (e.g., Huione-style platforms), or Chinese OTC and underground-banking networks.

AI at Chainalysis

AI is not a feature at Chainalysis — it is a new way of working. One that turns instructions into work done, and helps us move faster than the threats we\'re built to counter. We expect our employees to take ownership of the output and ensure quality. As the world\'s most trusted blockchain analytics platform, Chainalysis sits at a rare intersection of proprietary data, regulatory relationships and crypto expertise that makes it uniquely placed to shape and lead the next era of AI-driven intelligence — and we expect everyone here, regardless of role, to be an active part of it.

AI fluency is tied directly to how we measure performance and how we plan to win. There is no substitute for your own curiosity. We provide the tools, workflows, and space to experiment — but the expectation is that you develop these capabilities yourself, bring ideas, and collaborate across teams to reinvent the way work gets done. We are not using AI to do less. We are using it to do what was never possible before.