Chris Giancarlo, former chairman of the Commodity Futures Trading Commission, is advocating a modern version of letters of marque and reprisal — a constitutional clause largely unused since the early 1800s — as a way to pursue state-sponsored hackers such as North Korea's Lazarus Group.
The proposal would allow private firms to legally hack back against such actors, an arrangement its authors describe as a privateer model updated for an era in which stolen assets sit in hot wallets rather than cargo holds.
An op-ed and a $1.4 billion theft
Giancarlo first made the case in a February 26, 2025 op-ed co-written with Christopher Perkins, head of Franklin Crypto. The piece pointed to the Lazarus Group's theft of roughly $1.4 billion to $1.5 billion from crypto exchange Bybit.
The authors argued that the US already possesses a legal mechanism for this problem: Article I, Section 8 of the Constitution grants Congress the power to issue letters of marque and reprisal, which historically gave private actors official permission to act against a nation's enemies.
Under the proposal, the government would deputize the private sector. Rather than waiting for agencies to chase stolen funds, licensed firms could pursue groups like Lazarus directly. The authors called these operators "neo-privateers" and named Lazarus explicitly as a target.
Competition as a cybersecurity lever
Giancarlo continued promoting the concept after the op-ed, raising it in congressional testimony and again on a podcast in August 2025. There he suggested technology firms could compete with one another on hacking and asset recovery capabilities, with any such activity requiring presidential authorization.
That competitive element is central to his argument: rivalry between firms, he contends, would sharpen cybersecurity and improve the odds of recovering stolen assets.
Legislation, then a narrower executive approach
The idea moved into Congress in August 2025, when Rep. David Schweikert introduced H.R. 4988, the Cybercrime Marque and Reprisal Authorization Act. The bill would authorize operations against foreign cybercriminal enterprises, a scope that explicitly covers groups involved in crypto theft.
A White House national security memorandum issued in August 2026 then took a more targeted approach, focusing on transnational criminal organizations rather than direct engagement with nation-state actors. That distinction is significant because the Lazarus Group is widely described as state-sponsored — precisely the category the memorandum steered away from.
The executive branch appeared to embrace the general concept while proving less willing to give private firms a license to confront foreign governments.
Open questions
Markets have shown no clear reaction to the proposals, with no evident price movement or trading activity tied to them.
The harder issues are legal and ethical. Authorizing private firms to hack foreign actors raises concerns about escalation, misattribution, and collateral damage.
The developments to watch are the fate of H.R. 4988 and how the memorandum's narrower focus is applied in practice. The central question is whether groups like Lazarus fall inside or outside the lines being drawn.
Giancarlo has made his case that the private sector should form part of national cyber defense. Washington is still deciding how much of that job it is willing to outsource.
