Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
The Almighty Buck Bitcoin Crime

Does a $3.6B Bitcoin Seizure Prove How Hard It Is to Launder Crypto? (arstechnica.com) 76

Posted by EditorDavid from the blockchain-of-events dept.
What's the lesson after $3.6 billion in stolen bitcoin was seized by America's Justice Department from the couple who laundering it?

Wired argues it all just shows how hard it is to launder cryptocurrency: In the 24 hours since, the cybersecurity world has ruthlessly mocked their operational security screwups: Lichtenstein allegedly stored many of the private keys controlling those funds in a cloud-storage wallet that made them easy to seize, and Morgan flaunted her "self-made" wealth in a series of cringe-inducing rap videos on YouTube and Forbes columns. But those gaffes have obscured the remarkable number of multi-layered technical measures that prosecutors say the couple did use to try to dead-end the trail for anyone following their money.

Even more remarkable, perhaps, is that federal agents, led by IRS Criminal Investigations, managed to defeat those alleged attempts at financial anonymity on the way to recouping $3.6 billion of stolen cryptocurrency. In doing so, they demonstrated just how advanced cryptocurrency tracing has become — potentially even for coins once believed to be practically untraceable.

Ari Redbord, the head of legal and government affairs for TRM Labs, a cryptocurrency tracing and forensics firm...points to the couple's alleged use of "chain-hopping" — transferring funds from one cryptocurrency to another to make them more difficult to follow — including exchanging bitcoins for "privacy coins" like monero and dash, both designed to foil blockchain analysis. Court documents say the couple also allegedly moved their money through the Alphabay dark web market — the biggest of its kind at the time — in an attempt to stymie detectives....Lichtenstein and Morgan appear to have intended to use Alphabay as a "mixer" or "tumbler," a cryptocurrency service that takes in a user's coins and returns different ones to prevent blockchain tracing....

In July 2017, however — six months after the IRS says Lichtenstein moved a portion of the Bitfinex coins into AlphaBay wallets — the FBI, DEA, and Thai police arrested AlphaBay's administrator and seized its server in a data center in Lithuania. That server seizure isn't mentioned in the IRS's statement of facts. But the data on that server likely would have allowed investigators to reconstruct the movement of funds through AlphaBay's wallets and identify Lichtenstein's withdrawals to pick up their trail again, says Tom Robinson, a cofounder of the cryptocurrency tracing firm Elliptic.
The arrests and "largest financial seizure ever show that cryptocurrency is not a safe haven for criminals..." Deputy Attorney General Lisa O. Monaco said in a press release. "Thanks to the meticulous work of law enforcement, the department once again showed how it can and will follow the money, no matter what form it takes."

Or, as Wired puts it, "Even if your rap videos and sloppy cloud storage accounts don't get you caught, your clever laundering tricks may still not save you from the ever-evolving sophistication of law enforcement's crypto-tracers."
This discussion has been archived. No new comments can be posted.

Does a $3.6B Bitcoin Seizure Prove How Hard It Is to Launder Crypto? More

Does a $3.6B Bitcoin Seizure Prove How Hard It Is to Launder Crypto?

Comments Filter:

  • easy to follow (Score:3, Interesting)

    by Anonymous Coward on Sunday February 13, 2022 @04:29PM (#62264545)
    chain hopping, tumbling etc are all pretty worthless when dealing in those sort of sums. It doesn't matter that they might not know the exact coins but what they will see is for example $100m going into an exchange and then a corresponding 90-100m going out as a different coin. The volume of these exchanges mean it is very easy to follow the money unless they break it up into 10's of thousands of smaller transactions.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      The volume of these exchanges mean it is very easy to follow the money unless they break it up into 10's of thousands of smaller transactions.

      You could break it in 10s of millions of small transactions, and it wouldn't make any difference. Every single transaction is forever recorded - and easy to process with computers to boot.

  • Lichtenstein (Score:3)

    by Valgrus Thunderaxe ( 8769977 ) on Sunday February 13, 2022 @04:30PM (#62264547)
    In this case is the name of Ilya Lichtenstein. This omission changes the entire context of the submission.

    • Really? You thought a guy who died in 1997 tried to launder billions in bitcoin and was arrested last week?

  • They are patsies (Score:3)

    by etash ( 1907284 ) on Sunday February 13, 2022 @04:31PM (#62264551)
    They were accused of laundering, not stealing. A couple of idiots. Apparently the perpetrators knew it's dirty money that cannot be laundered and gave it to them. It would be interesting to see if the government gives it back to bitfinex and what they'll do with it. It's not inconceivable that bitfinex itself is involved and it was a "hack" not a hack. They "lost" 76m usd of btc at the time and now will prolly receive back 3.6b of it.

    • It would be interesting to see if the government gives it back to bitfinex and what they'll do with it.

      LOL, yeah like that'll happen.

    • Apparently the perpetrators knew it's dirty money that cannot be laundered and gave it to them.

      What a weird world we live in. If anyone has more dirty Bitcoin to spare, feel free to send it here: 1BBdEwwKKwxQvCHe7Mxy5FWZjFJX6kj1CS

      (Note to any Feds with no sense of humor: I did not retain the private key to that wallet address. Any BTC sent to that address is permanently "burned".)

  • How surprising is this? (Score:3)

    by I've Got Three Cats ( 4794043 ) on Sunday February 13, 2022 @04:32PM (#62264555)
    Originally, Bitcoin was supposed act like a fiat currency that was not tied to any particular government or organization. I don't believe anonymity was supposed to be the core feature, since you still have to interact with other entities to use your new currency. It may have been unregulated, but I don't think anonymity was supposed to be the big selling point.
  • As they say: Either: 1. it's not that hard - they just did it wrong or were unprofessional in their techniques: 2. it's hard with they way they attempted to launder the stolen assets.

  • They got caught because they were dumb, that's it (Score:5, Interesting)

    by metrix007 ( 200091 ) on Sunday February 13, 2022 @04:41PM (#62264577)

    Crypto can be made impossible to trace.

    Use an anonymous VPS server (Njalla from the pirate bay guys is a good one), pay with anonymous payment (a pre-paid visa used several months after purchasing from a Walgreens wearing sunglasses and a hoody, maybe even a mask in these pandemic times), and setup your own instance of whatever crypto you want so you don't have to use third party processors like Coinbase (takes about 350gb storage but worthwhile).Then on an entirely separate anonymous VPS or shell server store the wallet in a veracrypt container, and only access from anonymous wifi hotspots, never the same one, always with a different appearance.

    Have no trace at all to the real individual who owns it, absolutely none what so ever.

    • Re:They got caught because they were dumb, that's (Score:5, Informative)

      by redback ( 15527 ) on Sunday February 13, 2022 @04:59PM (#62264621)

      yeah, but how do you spend it?

      Its no good to you until you can convert to fiat.

      • That is precisely what the Bitcoin exchabges are for. One of their primary functions is "mixing", mixing the "tainted" money with "clean" money to break up the transactions and make tracing individual sources of the originally transferred bitcoins much more difficult to track. See:any introductory article on the process, such as:

        https://www.natlawreview.com/a... [natlawreview.com]

        • Re:They got caught because they were dumb, that's (Score:4, Informative)

          by Geoffrey.landis ( 926948 ) on Sunday February 13, 2022 @05:40PM (#62264717) Homepage

          That is precisely what the Bitcoin exchabges are for. One of their primary functions is "mixing", mixing the "tainted" money with "clean" money to break up the transactions and make tracing individual sources of the originally transferred bitcoins much more difficult to track.

          And that is precisely what the article we are discussing [arstechnica.com] says didn't work in this case.

          • We're back to the Die Hard quote, which I'll paraphrase: "if you steal [3 billion,] 600 million dollars, they will find you". The described effort involved in this was fascinating, including the hinted collaboration with Lithuania where the Alphabay exchange servers were seized.

            I'm not suggesting that the bitcoin exchanges are always 100% effective at money laundering, but it is what many if not all of them were designed for, and answers redback's question about "how do you spend it". And it remains one o

      • More and more legitimate services/companies accept crypto, even Tesla does or will soon.

        So, like anything else, you could buy that stuff and sell it for cheap. You might lose some, but if the money was stolen in the first place it's not so much aloss as it is the cost of doing business.

        • Re: (Score:2)

          by torkus ( 1133985 )

          More and more legitimate services/companies accept crypto, even Tesla does or will soon.

          So, like anything else, you could buy that stuff and sell it for cheap. You might lose some, but if the money was stolen in the first place it's not so much aloss as it is the cost of doing business.

          Ironic that you said this given the subject you replied to.

          The wallet(s) are clearly identifiable by blockchain logs as containing the stolen crypto. Your suggest of using a highly traceable, online-connected vehicle as a means to launder cyrpto is laughable at best.

          Besides being small-time, horribly-implemented money laundering, it's multiple orders of magnitude too small to even make a dent in the balance.

          • I think you're missing the point, and thus your allegation of irony is incorrect.

            It doesn't matter if a wallet gets blacklisted eventually. Funds can be moved around to different wallets, and won't be blacklisted before something is able to be purchased. Once that thing is purchased, the point is to offload it in exchange for cash as soon as possible.

            This is in fact how it's actually done in practice.

      • why do you need fiat? you can purchase real things with crypto (including drugs)

        • Re: (Score:2)

          by torkus ( 1133985 )

          Simply put: to break the chain of ownership.

          Yes, you could go buy an oz from your local dealer. In doing so, you've linked the wallet to another one and from there to another etc.

          Since every transaction is public, one merely needs to watch until those coins go somewhere either traceable, hackable, or otherwise not anonymous - and then walk back the IRL chain. These people were at least trying to use mixing/washing services - but they used one that got compromised.

          Not surprising really - you can be perfect

      • Re: (Score:2)

        by Xenna ( 37238 )

        Sell it anonymously to people over the internet at a large discount. Let them take the risk.

    • to be honest, i can't believe someone who hacked one of the biggest crypto exchanges stores his private key in plain text, and has no idea how to anonymize himself. You and others (even less tech-savvy people) suggested hundreds of ways he could've liquidated his bitcoins, but this hacker didn't take the simplest of precautions. I'm starting to believe there was more behind the scenes and this couple was chosen as a scapegoat.

  • Article Mentiones Missing Evidence and Logic Chain (Score:5, Interesting)

    by JakFrost ( 139885 ) on Sunday February 13, 2022 @04:47PM (#62264593)

    I read the article yesterday and the writer, Andy Greenberg, for Wired.com, did accurately notice and mention that facts and evidence was missing from the prosecution's outline on how.

    The IRS hasn't entirely spelled out how its investigators defeated those two distinct obfuscation techniques. But clues in the court document—and analysis of the case by other blockchain analysis experts—suggest some likely theories.

    The IRS's explanation doesn't mention at what point the money in Lichtenstein's bitcoin wallet was converted into the monero that later appeared in those two exchange accounts. Nor, more importantly, does it say how investigators continued to follow the cryptocurrency despite Monero's features designed to thwart that tracing—a feat of crypto-tracing that has never before been documented in a criminal case.

    Most likely the investigators had data from other sources, likely the AlphaBay, and other Crypto exchanges, either through legal means such as subpoenas, or discovery, or the good ol' parallel-construction from other investigations by other 3-letter security agencies (NSA, CIA, FBI, etc.) that cooperated together to piece the evidence together.

    All of the IC intelligence community world-wide has had their eye and and their hands deep into crypto for quite a long time because if you're tracing bad guys this is where you look because that's where the money is going. The blockchains keep a perfect publicly accessible and queryable ledger and record of all transactions, even if you try to use one of those anonymizing crypo currencies, because the IC agencies monitor the network traffic world-wide and focus on money flows so they know the ingress and egress points to the crypto networks and can pinpoint transfers coming in and out down to infinitesimal time units and then correlate the data between far-away listening posts and sources of data to determine that money coming in from one location shows up leaving elsewhere within the expected time frame and amounts.

    The data scientists working for IC know how to do collation and correlation of data and they have algorithms and machine-learning to help them piece things together, not to mention private enterprises like Chainalysis to help them with expertise or consult for them.

    If you can narrow down transactions within a system or between systems (chain-hopping) down to fairly close time interval, sub-second, or multi-second differences especially if the amounts and relative values match up, then that is enough evidence to submit during an investigation and even to go as far as prosecution if you can attach a high statistical confidence value to it, as in no other multi-million transaction happened within +-5-minutes of these two or multiple transactions. That's usually good enough for most folks, including in the legal arena, to point to as a smoking gun type of evidence even if nobody actually saw the bullet leave the gun or hit the body, cause and effect type of evidence.

    It's possible that the IRS investigators didn't actually trace monero to draw that link, points out Matt Green, a cryptographer at Johns Hopkins University and one of the cocreators of the privacy-focused cryptocurrency zcash. They may have found other evidence of the connection in one of the defendant's records, just as they found other incriminating files in Lichtenstein's cloud storage account, though no such evidence is mentioned in the IRS's statement of facts. Or they could simply be making an assumption unsupported by evidence—though that's not a common practice for federal agencies prosecuting a high-profile criminal case years in the making. "The third possibility, which I would definitely not rule out, is that they have some tracing capabilities that they're not disclosing in this complaint," says Green.

    The most likely have so many sources of data from network traffic analysis, block-chain analysis, an

  • Especially considering the scale of crypto shenanigans going on in China and lots of other places. Shady doesnâ(TM)t even begin to describe it.

  • The greater fool. (Score:4, Interesting)

    by RyanFenton ( 230700 ) on Sunday February 13, 2022 @05:10PM (#62264655)

    The entire game of almost every sector - of what has emerged as the 'crypto segment' of the market and discussion spaces - is the 'greater fool' approach to interaction.

    Most commonly seen in multi-level marketing and pump-and-dump practices, it's the act of creating a community based on hype and encouraging theory-crafting on when best to get in, and when best to get out of speculation arcs.

    Note that this process is inherently self-selecting for a certain kind of 'wisdom' - that is, folks who think they are 'clever' or 'lucky enough to win in high-risk scenarios, with more than a dash of desperation involved in most of the people playing.

    That desperation is what makes the high-energy/enthusiasm aspect of these communities self-reinforcing, and very punishing of skepticism and many kinds of consideration, usually with special labels for that kind of talk.

    Exactly that selection bias means that members of these communities tend to have a very limited kind of technical acumen. Basically a small pool of shared scripts, a few gurus with specialized knowledge, and a lot of people shopping around for cheap services to scale up those scripts.

    The folks with more aptitude have usually found better ways to make more consistent money and never get involved, or the less ethical ones with more skill tend to create automated ways of playing that crowd for access to resources.

    So... it's a bit like how a lot of managers end up falling for email scams, after managing technical people and getting overconfident in how 'easy' tech stuff seems.

    Spend all your time searching for the greater fool tends to end up with you playing that role.

    It's also the core of how most major market crashes play out.

    Ryan Fenton

  • Public blockchain makes it hard to launder (Score:3)

    by drnb ( 2434720 ) on Sunday February 13, 2022 @05:15PM (#62264663)

    Does a $3.6B Bitcoin Seizure Prove How Hard It Is to Launder Crypto?

    No, but a public blockchain that permanently records each and every transaction makes it hard to launder.

    Face it, the gov't hype over this bust is PR. Its the win they can point to. However like drug smuggling, human trafficking, etc its just a small fraction of what is going on. Its just a "tax", a cost of doing business, for the launderers, smugglers, and others. Don't exaggerate its significance.

  • This just shows you all those articles on cnn, msnbc, etc where someone making $30k/year brags about making millions through a "side hustle" are all just scams. The Forbes article looks like any of those "I am 21 and make $700,000 a year through my side hustle". The articles never explain how someone could legally make that much money through a side hustle.

  • Anonymity vs. Pseudonymity (Score:3)

    by Frobnicator ( 565869 ) on Sunday February 13, 2022 @06:32PM (#62264797) Journal

    Thankfully many criminals don't know the difference between anonymous vs. pseudonymous.

    The transactions are pseudonymous. While your exact identity isn't known, the wallets and every transaction are known perfectly and can never be hidden. This is a requirement for the transactions, and is necessary for the ledger to work and remain publicly usable. This means every coin is perfectly tracked forever.

    It can be eventually possible to launder it gray, mixing it enough that there is plausible deniability when someone eventually uses it in a transaction tied to a name. Even so, it can never be laundered clean, the transactions will forever be in every stolen coin's history.

    Thieves are discovering it is impossible to launder the coins at a large scale. At small scale it isn't worth it for police to hunt, but at large scale they'll track it down, and sooner or later the pseudonym's digital trail will be tied to a real-world identity.

    • You'd have to convert it to a truly anonymous commodity, like drugs.

      You couldn't feasibly buy $4.5B worth of coke, but you could buy lots of it (I dunno, $50K batches? maybe work up to more?) and then sell it to someone else, even in bulk, for real fiat.

      Since you're not dealing on the street, your exposure would be low--besides dealing with people that transact $50K worth of coke.

      The feds might be able to trace the crypto to the first person you bought drugs with, and arrest them--but at that point, that p

      • So if anyone asks you how you got so much money, you can just say you earned it by selling coke and you're off the hook? Brilliant plan.

  • I mean... You watch all the forensics porn shows and you think there's no way anyone could possibly get away with any sort of crime. Of course those stories are cherry picked and most of the time LEOs don't have the resources or budget to have anyone who can take on these things. For every $3.6bn bust there are probably hundreds of thousands of smaller cases in the low millions or less that go completely under the radar of law enforcement.

    • This would have gone completely under the radar too. The feds just happened to be doing their latest dark market honeypot game when the couple decided to use that market as a tumbler. It isn't like they chased them down or anything, they stumbled onto this couple while going after drugs.

  • https://www.youtube.com/watch?... [youtube.com]

    This guy should really try standup comedy sometime.

  • They didn't defeat and trace diddly, they launched a man-in-the-middle attack via a dark market they'd taken over.

  • Heather R. Morgan was a contributor between 2017 and 2021. Her most recent bio: She “is an international economist, serial entrepreneur, and investor in B2B software companies. She is an expert in persuasion, social engineering, and game theory. Morgan is the co-founder and CEO of Endpass, which uses Artificial Intelligence (AI) to automate identity verification while proactively detecting fraud. When she's not reverse-engineering black markets to think of better ways to combat fraud and cybercrime, she enjoys rapping and designing streetwear fashion.”

    https://www.forbes.com/sites/heathermorgan/2019/04/30/got-burnout-tech-ceo-try-rapping/?sh=798d92123102

    It's probably fairly easy to use AI to detect fraud when you're the one committing it.

Slashdot Top Deals

To the landlord belongs the doorknobs.

Close