Chris Giancarlo wants to revive letters of marque to fight the Lazarus Group

Chris Giancarlo has an idea for dealing with North Korea’s most prolific hackers. It involves a clause in the US Constitution that has mostly gathered dust since the early 1800s.

The former chairman of the Commodity Futures Trading Commission (CFTC) wants to modernize letters of marque and reprisal. That would let private firms legally hack back against state-sponsored cybercriminals like the Lazarus Group. It is a privateer playbook, updated for an era where the loot sits in hot wallets instead of cargo holds.

From the high seas to the blockchain

The pitch first surfaced on February 26, 2025, in an op-ed Giancarlo co-wrote with Christopher Perkins, head of Franklin Crypto. Their timing was not subtle. The piece pointed to the Lazarus Group’s theft of approximately $1.4 to $1.5 billion from crypto exchange Bybit.

Giancarlo and Perkins argued the US already has a legal tool for this kind of problem. Article I, Section 8 of the Constitution gives Congress the power to grant letters of marque and reprisal. Historically, those documents gave private actors official permission to go after a nation’s enemies.

Put simply, the government would deputize the private sector. Instead of waiting for agencies to chase stolen funds, licensed firms could pursue groups like Lazarus directly. The authors described these operators as “neo-privateers,” and Lazarus was named explicitly as a target.

Giancarlo kept pushing the concept after the op-ed. He raised it in congressional testimony and again on a podcast in August 2025. There, he suggested technology firms could compete with one another on hacking and asset recovery capabilities, with any such activity requiring presidential authorization.

The competitive angle is the interesting part. Giancarlo’s argument is that rivalry between firms would sharpen cybersecurity and improve the odds of actually getting stolen assets back.

Congress takes the bait, then the White House narrows it

The idea did not stay theoretical for long. In August 2025, Rep. David Schweikert introduced H.R. 4988, the Cybercrime Marque and Reprisal Authorization Act.

The bill would authorize operations against foreign cybercriminal enterprises. That scope explicitly covers groups involved in crypto theft, which puts outfits like Lazarus squarely in frame.

Then came the recalibration. A White House national security memorandum issued in August 2026 took a more targeted approach. It focused on transnational criminal organizations rather than direct engagement with nation-state actors.

That distinction matters a lot. The Lazarus Group is widely described as state-sponsored, which is exactly the category the memorandum steered away from. The executive branch, it seems, liked the general concept but was less eager to hand private firms a license to tangle with foreign governments.

What this means for crypto and cybersecurity

Markets have not reacted so far. There has been no clear price movement or trading activity tied to the proposals.

The harder questions are legal and ethical. Authorizing private firms to hack foreign actors raises obvious concerns about escalation, misattribution, and collateral damage.

For now, the things to watch are the fate of H.R. 4988 and how the memorandum’s narrower focus gets applied in practice. The central question is whether groups like Lazarus fall inside or outside the lines being drawn. Giancarlo has made his case that the private sector should be part of national cyber defense. Washington is still deciding how much of the job it is willing to outsource.