Cross-Chain Bridges and the New Speed of Crypto Laundering: A Practical Case Walkthrough

Transcript

Thank you very much for joining everyone. We're very excited um to have you here and very thankful that you took the time to be in the call. Today we have today um very exciting topic. Um Julia Morat, most of you already know her because she's also part of our compliance group of of our AML and compliance group. Um she is head of regulatory affairs at Global Ledger and she's a seasoned expert if I may say so in compliance in crypto AI data protection and risk a little over 11 years Julia if I'm not mistaken.

um >> you're making me too young but uh >> and she will talk about an amazing topic which I believe is very interesting and we have talked about it a lot in the in the compliance group and the AML and compliance group and we have talked about it also with several of our presentations that we have made which is um how crosschain brides are used in crypto for laundering focusing and emerging risk of speed. So this is um I think a very interesting topic. We have had the topic a bit from another perspective where we talked about crypto laundering about p butchering um and about how crypto can actually also be used not necessary to do this kind of things but also as an excuse to actually

do it. So I think it's very interesting that you're not now showing the other part of it of how it is actually done and and how it actually works until the point that it actually gets to the exchanges which I believe most of us um work mostly with companies or clients that are actually already taking it out of the exchange. So, it's very interesting to see the other part of it of how it actually gets to the exchange and how we can help either prevent it or at least know how to find out how it works and kind of like try to find a solution for it. So, thank you very much Julia and the floor of yours.

>> Thank you so much Maria and Yukatina for uh making this happen. Um really appreciate the invitation. So um yes, as Maria mentioned, I'm head of regulatory affairs and compliance at Global Ledger, a blockchain analytics solution provider based in Switzerland. I myself am based in Geneva in in Switzerland in the French part. So uh I would like to focus today on uh crosschain bridges and how they facilitate money laundering uh in crypto. So um this is the data that we publish every year. By the way, every year we publish a report on on hacks and um what it tells us about cryptoreated crime.

So, uh it it it focuses on on this predicate offense of of um scams and crypto and and crypto funds being stolen. Um so, last year uh was really devastating in terms of the amount of money stolen from from users in crypto. So the the total um the total volume of of of these funds accounted for uh slightly over 4 billion uh US dollars and we've seen 255 uh incidents of hacks uh which were recorded. So of course this data is is somewhat um skewed or affected by the largest crypto hack in history which is of course the bybit hack which amounted

to almost um one and a half billion US. So this is just a quick visualization for you to to compare with the year before was 2024. So basically the amount of funds stolen in crypto last year was uh slight u uh two times higher than than the amount stolen the year before. And uh this is um a graph showing uh what were the primary targets of these hacks. So centralized exchanges of course come first but as I said um this is mostly because of the by bit hack because it was obviously centralized exchange um that was um uh targeted. Uh centralized exchanges are followed by

defy platforms uh unhosted personal wallets decentralized exchanges and brides themselves are also targeted. We saw that in the second half of of last year uh the share of centralized exchanges being targeted dropped um significantly because there was no one large scale uh hack uh comparable to the bybit hack. So they in the second half of last year uh D5 platforms the various decentralized services came uh to the first place in terms of them being targeted as um for scams.

So that is about that that data was about you know hacks and and and what actually uh happened and the targets. However uh we are mostly as being compliance professionals we are mostly interested to what happens to to funds after the hack occurs. So uh what we know is that uh 50% of of funds um in in terms of the volume of funds um the laundering involves crosschain bridges. Um the next uh most popular method is is defy uh decentralized finance various platforms and protocols. Then go the mixers and privacy protocols and centralized exchanges are also present

of course. However, they are um compared to those other method they they are minority of of of um laundering um uh methods and what it tells us is that um money launderers choose uh less scrutinized less regulated methods to move funds around. Uh, of course, their primary goal is to ultimately cash out of ramp and enjoy the the stolen funds. Um, and the the best way to do that is still using centralized exchanges.

However, what you are also seeing um in the second half of last year is that half of the stolen funds are still sitting there um primarily not on centralized exchanges waiting to be laundered. So what we're expecting this year is that uh more and more um those stolen funds will be laundered uh and and the hackers will ultimately seek to cash out uh using various methods. However, centralized exchanges is not is not their preferred option currently. So today's session of course is about uh crosschain bridges. Um as many of you know uh crosschain bridges are um like it's it's a name for various protocols

for various services allowing for um uh funds to to move from one one chain to another and they of course have legitimate use uses in in in transactions ranging from you know basic interoperability for funds to to move from one chain to another to uh trading liquidity. Uh so so basically their reputation is much better than that of uh mixers and and privacy coins and this is also why uh they are mostly not treated by either regulators or uh regulated exchanges as as a high-risk uh factor. Um so they create a technical smoke screen uh for investigators or

compliance officers who have to uh basically do a series of operations that I will show you today to trace those funds back. So when um a compliance officer at an exchange reviewing transactions um sees um a transaction coming from um a crosschain protocol, what they see is essentially a bridge and flow uh which does not necessarily uh trigger an alert depending on how uh the transaction monitoring system and the scenarios within that exchange um are configured.

And then then it depends on on how the exchange treats those incoming flows. And uh in most cases um they would not be uh triggered as a they will not be triggering an alert or treated as as a high-risk inflow. So um this is um a case that I wanted to show you which is a good example of in general how uh laundering occurs after a hack. Um so it's a case from September last year. Uh the victim lost almost um uh uh $1 million US dollars and the type of hack was a private key compromise uh via malicious fake zoom installation package. So the laundering methods it's

like you you can see the whole the whole uh spectrum of of um those methods involved. So they involved DeFi protocol, centralized exchanges and there was significant swap activity as well. So this is the what happened initially. So the victim's funds were transferred to the illicit actors wallet and then they were uh transferred yet to another wallet and then swapped um through um mimic mimici and then they were further uh sent onwards to um to a centralized exchange which was uh which we classified global ledger as high risk because it does not do KYC and it was tax,

>> excuse me. All right. And then the funds moved onwards to um this high-risk exchange. So this is uh the whole case diagram. Uh and you can see here this is what you would see on our uh tracing tool. Um so you can see the the various swap um activities. So they were essentially the the whole laundering happened in two branches. You can see blue uh steps and and the green ones. But if you explore uh further, I will just uh try to zoom in for you. So you can see like for example in this branch funds go to crosschain protocol. This uh

graph is on Ethereum but from crosschain protocol uh onwards you would have to move uh to another chain. And then uh you can see various defy uh players being uh present and eventually some some portion of the funds go to um uh go to centralized exchanges. Um so this is what I wanted to uh do uh on our uh on our platform. Just give me a second.

I'll go to Excuse me. So on global ledger platform uh one of the uh functionalities is to generate an entity exposure report uh on a whole exchange showing uh various so so on the left hand side you can see the source of funds transactions on the right hand side you can see the the outgoing transactions. So essentially this is a report for a 3 months period showing all the incoming transactions and their uh and the risks uh risks associated with them uh both on the incoming and

outgoing sites. So you can see here for example that crosschain protocol is a type of labeled transactions that that we are seeing on the incoming side and um if you click on entity you can see here for example this is an example of um crosschain uh protocol uh incoming funds. So as you can see we we ourselves label such transactions or uh such protocols as medium risk. um as I said before uh because there are uh legitimate users to these protocols.

However, uh a user would be able to change that default um risk methodology and and and you know label these as as high risk for example. So how I would go about um if I were a compliance officer uh analyzing this exchange for risk uh I would you know investigate these transactions further and what I would like to show you and it's an example of what a compliance officer would have to go through or an investigator to investigate these crosschain protocols and why it's it's difficult to do so and it requires some extra steps. So um I'll take this transaction as an example. So leave transaction we can see that the

depth of this transaction is is five meaning it's five hops away uh from our wallet. Um so I will click on this transaction and it will take me to the tracing tool. I've done it before um our session already but if I wanted to redo it I would I would just click on here and it would trace backwards. So um we can see that this is our exchange just for the sake of demonstration uh you know uh no particular reason why I chose it. So and a compliance officer within this exchange would see this incoming funds and there are five hops away we can

calculate this is exactly five and um so when I first saw this transaction um this particular hack was not known but now we are seeing that this wallet is associated with um has been this hack has been reported and this wallet is associated with with a hack with a known hack h. So if I wanted to know more about this hack, I would uh uh generate a full report and this report would show me that this wallet received some funds from a reported hack. However,

uh most of the funds still came from a crosschain protocol, meaning that some other funds came from a reported hack. So now on on this particular screen because I'm on on the Ethereum um blockchain um I will not see how this funds appeared uh appeared here. So what I need to do I would need to copy this transaction hash and go to the um um uh explorer for this particular um crosschain protocol. I've done it already. And I would copy paste this transaction. Well, I'll I'll redo it

now. I will copy paste this uh transaction here. And it would give me uh it would give me the information about this transaction. So I'll I'll do it live as we speak. Uh and then uh what I need to do, I will copy this uh transaction hash and I would go back to the platform. And uh excuse me I already did this before so that we don't waste time. Uh so I would open our tracing tool uh here and I would uh input this

transaction hash on another blockchain on arbitum and this is where uh I I will see the transaction happening. So um of course there may be um a number of uh different reasons why uh why uh a user um bothered to go through these many hops. Uh one of the reasons can actually be legitimate. So what we're seeing is that the funds originated on arbitrum and then they were uh crosschained uh through layer swap and um were transferred to Ethereum and then these funds jumped one to well five hopes and then they uh even um um

they went to different directions at some point. So um one of the uh legitimate reasons why this could have occurred is that uh these are unhosted wallets. So maybe uh people were uh paying each other uh and you know the funds legitimately moved from one uh uh wallet to another. It's possible. However, um what we think is that uh you know because somebody bothered uh to to transfer them uh in in in so many different hopes, it's it's also likely that um the the some obscuring of the pro provenence of funds

um occurred and it was uh intentional. So um um the the the other uh the other uh question to ask of course is whether it's it's possible to uh transfer these funds uh directly from orbitum to cocoin and and without actually transfer them transferring them to Ethereum and yes it is possible uh so it's it's another uh reason for suspicion Uh what we are seeing is that uh this this combination of action breaks simple address linking horistics and requires for somebody going through um or

reviewing this transactions to to actually know the um explorer that I showed you. uh copy that transaction hash, look for that transaction on the explorer, then go back to the um uh to to the uh uh arbitum uh tracing tool and and you know continue tracing that way. Um so it it's not what a typical uh or normal user would would usually do and it resembles uh peel chain typology. So uh we believe it's it's rather suspicious. The fact that uh later on uh one of the wallets used was also labeled as uh a wallet receiving funds from a different hack uh is also obviously

raising suspicious and uh if you wanted to know more about that hack. So you can this is again the risk report on on the wallets uh in in the chain here two wallets which uh receive funds. So if you wanted to investigate the hack further, you can click on it and it will tell you what what actually happened. Um so of course it raises suspicion because that that wallet was present in the in the chain or two of those wallets. So um what this pattern usually indicates um we see that there was some attempt or it it looks like there was some attempt to

obiscate uh the the tra trail of funds. Uh it's possibly uh done because they wanted to avoid the scrutiny on on on on behalf of the centralized exchange K coin in this example. And um uh this uh could indicate various uh activities including predicate offenses such as tax evasion. It could be shadow OTC over the counter uh operators. Um it could be uh smallcale fraud or scam participants. And it's it's likely that because we saw uh one uh two of those wallets being labeled as related to scam. Um and uh possibly exiting mixers are gambling platforms or um or

it it's also possible that it's it's privacy by habit or uh you know people paying each other multiple times. uh if I were a compliance officer uh reviewing that transaction as a minimum I would probably ask uh a question to to my customer. Um however it would also depend whether that activity is something that I'm observing on that customer profile on a regular basis or whether it's a one-off. So um to sum up uh these types of um activities of skate break the origin linkages uh as we saw it's not it you need to go through some additional steps to investigate this

activity. You need to know uh how to operate how to you know navigate those explorers and and every crosschain protocol was will have different explorers associated with them. Some of them work better, some of them are less user friendly and you would need to you know continue tracing on on on the other um on the other chain. So the these transactions that we saw the multiple hopes um add some transaction noise and um they the the activity reduces the likelihood that uh compliance professionals at working at the centralized exchange would actually look into um into the incoming uh flows further and would bother to go through

that um through those operations. Thank you. I'll I'll stop here. Uh let me know if you have any any questions. >> Thank you Julia so much for the amazing presentation. Um I myself have a lot of questions but I would like to first allow someone else to actually ask. So if there is someone in the if there is someone that would like to ask anything um please feel free to do so. um you can just open your mic and open your video and ask whatever you would like. Um if not then you can also

ask in the chat if you don't feel comfortable um you know asking directly. Um so yeah we'll give you a bit of time if you want to ask something. If not then I will start with the question. >> Okay. >> Oh Julia thanks a lot for that really helpful example. Um just wondering uh in this case you were looking at arbitum and Ethereum uh are there any crosschain analytics tools that exist which allowed which allow that tracing to occur um analytically or would this manual step be needed in in most cases? Are there any common examples where it is possible

to to screen across blockchains? So I unfortunately I wouldn't be able to answer that question because I'm I'm working for one of them and uh obviously and I was showing you uh our tool um unfortunately I'm not able to answer. >> Okay. But my understanding my understanding is this technology does exist that it is now possible technologically to say screen across different blockchains or trace. Um, >> unfortunately I'm not I'm not able to cover that. Sorry, Andreas.

>> Okay, no worries. >> Maria, you had some questions. >> Yes. Um, Julia, thank you so much. I was wondering in that particular case what was the outcome? Um like was it was this checked by a compliance officer and what was the outcome of it? Because in my particular experience we also have we always have the issue that I mean if you look into a blockchain and and if you look into a transaction there is most likely at any point of the transactions there will be something that raises red

flags. Um, so how do you actually like help clients or guide clients through how to look into it and then at one point actually raise a red flag enough to provide an amorous report for example. So in this particular case um actually when we uh when I started using it uh first as an example the the two wallets that were in that chain uh had not been labeled as as um the ones related to a hack. Uh so uh they actually let let me share it with you.

So the chain looked like looked uh like this. You see it? it looked like. So if I were at the cool coin looking at the incoming transactions, I would be seeing I would have been seeing just the uh you know unhosted a a series of unhosted wallets and and transa and and yes there is a um crosschain protocol several hops away. So um in and of itself it's probably not enough uh reason for suspicion and the uh the amount of funds is well is uh almost 10 uh Ethereum is it's large but

uh one transaction like this uh probably would not suffice for me to to raise um red flags and and and report it uh in and of itself be without any additional you know um suspicious factors uh and there were none at at that point. However, later on uh that hack was reported and uh what we saw uh happening is is that this in the the two incoming wallets were labeled as as uh related hacks. this already of course as a as a concern and and it's a direct transaction into a centralized exchange.

So yes, here I would it it would definitely merit um uh SAR filing and any further action as as per the regulations possibly client exit eventually without of course the risk of tipping off. Um however if if these wallets uh were not labeled as uh related to a hug um again uh the use of crosschain bridges is is slightly suspicious. However, as as we know they have legitimate purposes.

uh I would uh possibly place that uh client on monitoring and see whether further activity like that um would be occurring uh after after that uh client is placed on monitoring and if that this kind of uh typology keeps repeating with the with this wallet um I would I would then take further actions. So it's it's repeated um uh risky activity that uh without a label of a hack would uh generate um more suspicious and more actions in in in my view.

>> And how do you know when a hack was labeled? Is there any way to know how and who labeled that hack? >> So it's um our platform, our uh you know algorithms uh that labeled these uh wallets. So, um we know when the hack occurred uh in in November and um as for uh when it was labeled um let me have a look. Um so so how it's usually done is um when um when a hack is reported by a

victim in in the public record uh that you know it's possible to label it. Um so uh it it's probably possible to see when exactly the label was applied but what we know is that when that transaction happened it was accepted. So um the uh label was not there uh as in uh the the funds just came in uh to the exchange.

Very interesting to know, especially if you're um a compliance officer and you actually have these type of hacks because most of these um exchanges or big exchanges usually have like thousands or at least hundreds of transactions a day. So, it's very difficult to actually keep track. >> Um how do you guys keep track of those transactions and how do you actually or or how does it work? Do you keep the track of the transactions and then send out a notification whenever this hack occurs on a transaction that was already performed and then you would be able to guide the client through it or or how does it work?

So um uh this is a tool that and its function is not um is to be used by by a compliance officer as you know uh they they choose to based on the entity's risk appetite and um their own judgment. So uh what um I would do if I were a compliance officer, I would add this wallet on monitoring, you know, and and and and if uh the good practice would be to add this wallet on monitoring, then when it's when it's on monitoring, you would receive an alert that this wallet has been labeled and this risk um the risk has increased and you would be receiving

an alert of new incoming funds to that wallet. So uh you would see already uh repeated activity on that wallet and you would be seeing whether this pattern is is repeating itself as in multiple hops coming from a crosschain bridge. Uh we also place wallets on monitoring uh including for our clients including um operational wallets when the clients wish uh to do that. And uh we also may if if the client choose to be notified notify clients about the risks uh in on the incoming side in relation to their to their wallets. But usually it's it's a tool empowering a compliance officer to do as they wish. And the good

practice is, you know, to monitor uh transaction activity of of your client's wallets, which this tool allows you to to do and um to file suspicious activity reports when there is a reason to do that. So I'll just quickly show you >> uh the monitoring. So So this is the a list of of monitored wallets. If I were a compliance analyst, I would have this list would be longer for me possibly. Um and then uh you would have alerts um on on the transactions and um the alert settings uh would also allow you.

So you see this is uh these are the alerts. We use AI based prioritization for the alerts and um the alert settings themselves is uh are here and you can you know create various typ >> oh sorry sorry about that uh let me look so what I was showing you is.

So these are the alert settings where you can create alerts and um the monitored wallets are also here. the compliance officer would be able to place wallets and monitoring and um the alerts would be coming in and you would use AI prioritization for those alerts to identify the riskiest alerts and you know the uh to to set up the alert scenarios. You would, you know, go here, create an alert. And if you wanted to change the scoring of um a crosschain bridge as a label to high risk, you

would be able to do it here. Uh if you wanted to, you know, uh review all the incoming um flows from from a crosschain bridge. >> Very interesting, Julia. Thank you so much. Is there anyone else that would like to ask a question? All right. If that's not the case, Julia, then I would like to ask you um in your experience because I saw that you had a lot of experience as compliance officer as well, especially in the financial market and um with what you have been learning while um working with Ledger, how would you what would be your key takeaway um after

all your experience as compliance officer, now your experience with this tools of transaction monitoring for a compliance um officer? in the crypto space. What would be kind of like your main takeaway on on how to properly do this type of transactions and how to properly check and how to have, you know, kind of like a critical eye on on when to actually find this type of of red flags that might not be that easy to spot. So my main takeaway after all these years is that if it doesn't make sense to you, uh it's it's probably it's probably fishy. So um

it needs to make economic sense and uh a compliance officer's job is uh to take things with a grain of salt in the sense that uh to be suspicious uh when when things don't make economic sense when you don't understand why funds need to move through different through a number of different hopes. As a minimum, you should be asking the question and you you should be looking at the client's profile what the normal activity looks uh like for this client and and this is like basics things but uh applying common sense is is is my main takeaway and common sense means that it it needs to make economic sense.

It needs to like you need to understand how the client uh what the client told you at the on boarding stage. What the activity be like and and how uh are they operating uh whether it's normal for them to have uh this level of uh of of activity this number of of different hopes and transactions. And another takeaway is is uh do not compare um apples to pairs and vice versa. So you need to do client segmentation. You need to know what normal looks like for uh a group of clients to be able to identify that suspicious activity because um you know uh somebody um a retail client uh frequently accepting payments in crypto

would be acting very differently from um I don't know a large uh B2B client uh you know accepting large volume uh high value transactions. Um, so you need to identify that suspicious activity based on the client group and based on your knowledge of of the client themselves. Thank you so much. That's an amazing takeaway and I agree completely with you. It is very important to keep Yeah, I think one of the most things that will probably lead you to these type of of investigations is actually how the client has been performing in the past and how it's performing now and um if it actually makes sense with the profile they provided.