Virgil Griffith

• 1. Introduction

  ›

  Virgil Griffith was arrested by the FBI on the 28th of November 2019. The agency accused him of giving North Korea information that could 'help North Korea launder money and evade sanctions.' At the time, Griffith held a research role at a cryptocurrency foundation. He had also spent more than a decade building software projects that put him in courtrooms, hacker conferences, and international headlines.

  Before he ever set foot in North Korea, he had already picked a fight with a corporation over a campus security flaw, built a tool that made corporate communications departments nervous, and helped design a service meant to protect anonymity online. What drew a programmer with that record to a blockchain conference inside one of the world's most isolated countries? And what happened once he arrived? The path there runs through a childhood in Alabama, a Ph.D. in California, and a job at the center of a fast-growing cryptocurrency project.

• 2. From Alabama To Caltech

  ›

  Griffith was born in Birmingham, Alabama, in 1983, and grew up nearby in Tuscaloosa. He graduated from the Alabama School of Math and Science in 2002. From there he enrolled at the University of Alabama to study cognitive science.

  In 2004 he transferred to Indiana University Bloomington, but he returned to Alabama and graduated cum laude in August 2007. A year later, in 2008, he became a visiting researcher at the Santa Fe Institute.

  In 2014, Griffith completed a Ph.D. at the California Institute of Technology, working under Christof Koch in computation and neural systems. His research there was funded partly by the U.S. Departments of Energy and Homeland Security. He has also published papers on artificial life and on integrated information theory. That academic path would soon lead him away from campus research and into the middle of a fast-growing cryptocurrency project.

• 3. The BuzzCard Lawsuit

  ›

  At Interz0ne 1 in 2002, Griffith met Billy Hoffman, a student at Georgia Tech. Hoffman had discovered a security flaw in the campus magnetic ID card system known as BuzzCard. The two of them studied the flaw together and prepared a talk about it for Interz0ne 2 the following April.

  A few hours before that presentation in April 2003, corporate lawyers for Blackboard Inc. served Griffith and Hoffman with a cease and desist order. Two days later, a lawsuit followed, alleging they had stolen trade secrets. It claimed violations of the Digital Millennium Copyright Act and the Economic Espionage Act. The case was settled before the year was out. Griffith walked away from the settlement still drawn to systems he wasn't supposed to poke at. Four years later, he pointed that instinct at a different kind of target: a widely edited reference site anyone could contribute to.

• 4. WikiScanner And Tor2web

  ›

  On the 14th of August 2007, Griffith released WikiScanner. It was a tool built to trace anonymous edits on a widely edited reference site back to their source. The tool matched those edits to their originating IP addresses and named the corporations or organizations behind them. Griffith summed up his goal bluntly: to 'create minor public-relations disasters for companies and organizations I dislike.'

  In 2008, Griffith teamed up with Aaron Swartz to design the Tor2web proxy. Eight years later, in 2016, the Tor team fired him for attempting to sell de-anonymized Tor2web traffic. By then Griffith had already found a new professional home, one built around a very different kind of network.

• 5. The Ethereum Years

  ›

  Since 2016, Griffith has worked as a research scientist at the Ethereum Foundation. He has described Ethereum as 'an unprecedented arena for playing cooperative games,' one that 'enables powerful economic vehicles we don't yet understand.' As of 2019, his personal homepage still listed the Ethereum Foundation as his employer. That same cooperative instinct would soon draw him toward an invitation from an unlikely place: North Korea.

• 6. The Pyongyang Conference

  ›

  In mid-2018, Griffith was invited to attend the inaugural Pyongyang Blockchain and Cryptocurrency Conference. An American businessman, Christopher Emms, and a North Korean political activist, Alejandro Cao de Benós, arranged his invitation and his entry into the country. The U.S. State Department had denied Griffith the special validation he needed to travel there, so he took an unusual route into North Korea.

  Eight foreign delegates made the trip to Pyongyang. Once they arrived, North Korean security staff found a home-made pornographic video on one of the delegates' laptops and confiscated every passport. Five days of tours followed, including visits to local businesses and a foreign language school, most of it unrelated to cryptocurrency.

  The conference itself opened at Pyongyang's Sci-Tech Complex, a venue the delegates found stocked with technology already obsolete elsewhere. Organizers handed speakers a short list of approved topics that looked pulled straight from material already public online. With little to work from, the delegates improvised, speaking to an audience of officials who often seemed confused, some of them asleep. The delegates flew home without incident, but for Griffith, that trip to Pyongyang would resurface before long, in a federal case that carried his name.

• 7. Prosecution And Prison

  ›

  At the time of his arrest, Griffith was living in Singapore and was allegedly exploring whether to renounce his U.S. citizenship. Since around 2010, North Korea is believed to have funded its weapons programs partly through cybercrime, including activity tied to the Lazarus Group. U.S. law, under the IEEPA and Executive Order 13466, bars Americans from exporting goods or technology to North Korea without a Treasury license. Prosecutors alleged that after returning from the Pyongyang conference, Griffith discussed how North Korea could use cryptocurrency to dodge those sanctions.

  Ethereum co-founder Vitalik Buterin launched an online campaign pushing for Griffith's release. According to one source, the campaign could not gather many supporters. Separately, the U.S. Department of Commerce imposed a 10-year export privilege ban on Griffith.

  On the 28th of September 2021, Griffith pleaded guilty at a hearing where he expressed remorse. He was sentenced on the 12th of April 2022 to 63 months in prison, with 10 months already counted as time served. From July 2022, he served time at FCI Allenwood Low, a low-security federal prison in Pennsylvania. He later moved to FCI Milan, a low-security prison in Michigan. Griffith was released from prison on the 9th of April 2025. What remains from his years before the arrest is a small trail of academic papers and book credits. Most carry his own name, though one uses the byline 'Virgil G.'

• 8. The Written Record

  ›

  In 2005, Griffith and Markus Jakobsson published 'Messin' with Texas: Deriving Mother's Maiden Names Using Public Records.' That same year, with Larry S. Yaeger, he wrote 'Ideal Free Distribution in Agents with Evolved Neural Architectures' for MIT Press. The work was tied to Indiana University's School of Informatics and Department of Cognitive Science.

  In 2006, Elonka Dunin credited Griffith as a contributor under the name 'Virgil G.' The credit appeared in 'The Mammoth Book of Secret Codes and Cryptograms,' published by Carroll & Graf.

  In 2007, Griffith contributed two articles to 'Phishing and Counter-Measures: Understanding the Increasing Problem of Electronic Identity Theft.' The book was edited by Markus Jakobsson and Steven Myers for Wiley-Interscience. The two articles on phishing and identity theft, published in 2007 by Wiley-Interscience, remain Griffith's most recent listed academic credit.