Chris Giancarlo, former chairman of the Commodity Futures Trading Commission (CFTC), is pushing to modernize a long-dormant clause of the US Constitution as a way to counter North Korea's most prolific hackers. His proposal would revive letters of marque and reprisal, letting private firms legally hack back against state-sponsored cybercriminals such as the Lazarus Group — a privateer playbook updated for an era in which the loot sits in hot wallets instead of cargo holds.

From the high seas to the blockchain

The idea first surfaced publicly on February 26, 2025, in an op-ed Giancarlo co-wrote with Christopher Perkins, head of Franklin Crypto. The timing was pointed: the piece cited the Lazarus Group's theft of approximately $1.4 to $1.5 billion from crypto exchange Bybit.

Giancarlo and Perkins argued that the United States already has a legal tool suited to the problem. Article I, Section 8 of the Constitution gives Congress the power to grant letters of marque and reprisal — documents that historically gave private actors official permission to pursue a nation's enemies.

Put simply, the government would deputize the private sector. Rather than waiting for agencies to chase stolen funds, licensed firms could go after groups like Lazarus directly. The authors described these operators as “neo-privateers,” and Lazarus was named explicitly as a target.

Giancarlo kept promoting the concept after the op-ed, raising it in congressional testimony and again on a podcast in August 2025. There, he suggested that technology firms could compete with one another on hacking and asset-recovery capabilities, with any such activity requiring presidential authorization.

The competitive element is central to his argument: rivalry among firms, he contends, would sharpen cybersecurity and improve the odds of actually recovering stolen assets.

Congressional interest, then a narrower White House approach

The idea did not stay theoretical for long. In August 2025, Rep. David Schweikert introduced H.R. 4988, the Cybercrime Marque and Reprisal Authorization Act. The bill would authorize operations against foreign cybercriminal enterprises, and that scope explicitly covers groups involved in crypto theft — placing outfits like Lazarus squarely in frame.

A recalibration followed. A White House national security memorandum issued in August 2026 took a more targeted approach, focusing on transnational criminal organizations rather than direct engagement with nation-state actors.

The distinction matters considerably. The Lazarus Group is widely described as state-sponsored — precisely the category the memorandum steered away from. The executive branch, in effect, embraced the general concept while showing less enthusiasm for handing private firms a license to tangle with foreign governments.

Implications for crypto and cybersecurity

Markets have not reacted so far. There has been no clear price movement or trading activity tied to the proposals.

The harder questions are legal and ethical. Authorizing private firms to hack foreign actors raises obvious concerns about escalation, misattribution, and collateral damage.

For now, the things to watch are the fate of H.R. 4988 and how the memorandum's narrower focus gets applied in practice. The central question is whether groups like Lazarus fall inside or outside the lines being drawn. Giancarlo has made his case that the private sector should be part of national cyber defense. Washington is still deciding how much of the job it is to outsource.

Source: CryptoBriefing — Chris Giancarlo wants to revive letters of marque to fight the Lazarus Group