Cryptocurrency crime and compliance in 2020

Transcript

with chain analysis and what I have for you guys today is a little presentation on the state of cryptocurrency related crime there's a lot of content for the time that I have so I'm gonna go kind of fast feel free to catch me at the end if you want the slides or if you have some questions that we didn't have time to cover but in a nutshell I'm gonna walk you through a little bit of what happened over the last year looking at some specific type ologies and so I mean things like terrorism financing and dark net markets and how they've been evolving most recently and tied together with some of the private public

initiatives that have been arising and developing to address some of these concerns so let's jump right into it and I think an interesting starting point is to look at what we consider to be the share of cryptocurrency related activity that is considered to be illicit and maybe some definitions here would be useful when we're talking about illicit activity what we're really doing is we're creating clusters of the addresses that we find to be controlled by one entity so that could be a scan cluster or a darknet market so we have different

ways of grouping together all of these addresses and then what we do is attribution so we will give them a name and pretend within one of these different topologies and so over the last few years actually the trend was quite positive if you look at the relative share of this activity I was going down from 2018 to 2019 there's actually an uptick so in relative terms we went from about 0.4 here to about 1.1 over there so overall the takeaway is that it's still a very small amount of the activity that's tied to illicit entities but it did go up last year and it's

interesting because she was also a big year for compliance it was a big year for cryptocurrency related compliance initiatives we're gonna dive in deeper into the why here but first I think it's interesting to point out that there are some outliers when you look at all of this data here we're looking at sorry looking at different type ologies again so terrorism financing scams sanctions things like that dark net markets and most of these are actually hard to see on the screen the yellow is dark net markets and it's been remarkably consistent over the last few years the thing that stands out here is that big spike in the first half of 2019 and

that's part of the scans category and specifically what we're seeing here is the plus token scam it's a Ponzi scheme that took in billions and it's making the share of illicit activity peak at over 3% there which was quite high so we're talking about a lot of money and it's interesting to look at how the the money laundering process compares to what we're seeing in the fiat world because it is actually very very similar but first a few observations there is an infrastructure in place that's enabling this we're going to look at some of the key components of it and who the players are and it's actually a small amount of

people that are doing the the book of this processing of illicit funds and is that these insights are only possible with this research because of the public nature of the data so it's interesting to look first at the off ramps so these are the places where criminals are converting the crypto assets back into fiat and making an exit and there's a couple things I want to point out up till mid 2017 there was a big portion of these funds being risky services so these are exchanges for example that

don't do any sort of kyc AML and it falls off suddenly mid-july right that coincides with the takedown of a few big platforms that were being used for many laundering I'm thinking about btc-e and wax for example and the guy who was behind btc-e Alexandra Vinick was actually just extradited to France from Greece as opposed to Russia which is where he wanted to go and the other trend that's interesting is this really big increase on the right side in the yellow and the pink sari category which is exchanges regular kyc exchanges so why is it that criminals are turning to these more or less regulated platform

we'll look at that in a second and it's not just a few players it's also just a few specific platforms here we're looking at Bitcoin only activity in 2019 so illicit funds processed by exchanges and there's two outliers again Hobie and Finance which made up more than half of the laundering here and so it's interesting what's up with AIPAC reasons for that we're gonna dive in nothing to spend too much time on this slide but what we're looking at is again violence and will be accounts the

interesting number is this 11 here this is accounts at Roby and Finance that were responsible for 327 million in illicit funds laundering when you compare that with over here in the 0 to $100 range you have two hundred and fourteen thousand accounts doing laundry Nevada state funds so it's really just a few big fish that were interested in here and those are the guys that we're going to be talking about in the next few slides or so and so it's really hard for our analysts and researchers to get data what's going on because we're talking about brokers OTC brokers that

are using these platforms for liquidity what did was we have a professional services team so these are investigators that have a background in and he money laundering and terrorism related intelligence stuff like that that are now collaborating with our analysts and researchers to work on the APEC OTC situation and they are putting together this list called we call the rogue 100 and so through their investigative work they're able to find addresses that are connected through these OTCs and this is something that we are using a lot in our analysis now so it's called the rogue

100 and I guess the main takeaway is that in Europe and other jurisdictions ot seas go for a lot of kyc AML but it's all dependent on the region a pack in particular is for us a cause of concern and something that we're looking at very closely so scams it start with this because it's making up such a big part of the fan flows they're on the rise they typically target vulnerable people so they can be new investors people were excited about getting into crypto to trusting older people but really anybody can fall victim because the

scans can be so sophisticated but again we find that there's a small number of organized groups that are responsible for a lot of this activity and that they rely on some of these corrupt OTC brokers I don't know if you heard two or three days ago there was an announcements by a faculty office for a foreign asset controlled as to chinese individuals were blacklisted and 20 bitcoin addresses added to the effect blacklist because they were found to have laundered more than 200 million for lazarus which is a group with ties to North Korea we're going to talk about those guys in a minute as well but in our systems analysis we will flag these

addresses and trigger alerts for our clients if anybody sees a transaction that's have any links to to these groups still on the scans still with Ponzi's so what we see here on the screen it is 2017 2018 2019 and different types of scamsters investment scans are a ponzi schemes obviously but also fake token sales and blackmail a couple of things jump out right away there's a lot of orange on the screen that's the Ponzi schemes and there's a big uptick also from 2018 through 2019 so in 2017 that big orange blurb is bit connect the Ponzi scheme and 2019 there's a number

of them there's about six pansies in there but plus token is really making up the bulk of that column that you see there and again and this might be counterintuitive for people who know blockchain well scammers have been mainly relying last year on exchanges to off-ramp their their loot but when you look at the AIPAC situation and what's going on with will be in finance for example maybe it starts making a little bit more more sense so a few takeaways these platforms needs to educate their customers if it looks too good to be true it probably is

don't send your crypto to somebody who's promising to there are there's an infrastructure in place that's enabling this laundering and it's important to educate ourselves around this situation and ransomware I find to be extremely fascinating its evolved a lot recently we see the emergence of two big categories there is the traditional ransomware that with large criminal groups behind them or perhaps even nation level actors they're targeting specific targets and they either want

really big payout or they don't care about the money at all it's just about creating chaos and that's what we saw in not pea string which encrypted lots of systems you know hospitals everything even mercy lost the shipping company lost hundreds of millions and there were there were no keys or there's no passwords to decrypt another thing that's interesting is that a lot of the victims are in North America a lot of the payments are coming from North America but we're seeing the share it will off quite quickly what we're looking at here is a number of different ransomware strains and how they were

dominating what their market share was over and how did share evolved over time you see that up until 2016 or so there were a few big strains dominated dominating they had big powerful criminal groups behind them they were very sophisticated but then you see it's all splintering up a little bit and there's more competition between these strains and this coincides with the emergence of grass or ransomware as a service so it's not possible to go in a darknet forum and our platform and buy with cryptocurrency software that will help you infect other computers with ransomware and it's really falling into

a different category so what we're looking at here are different strains these columns and the size of the column is the average payments that they will command the color red is that first category which typically is backed by an organized criminal group or state actor or and the yellow ones are strains that are specific to ransomware as a service so you'll see right away that's the payments that these Raths software's get are much smaller so what people are doing is they're buying this software on the darknet and just sort of casting a big net and hoping that something sticks so it's a very different approach than

the other more traditional ransomware and this is what I was saying about North America taking up the majority of the victims but more recently we've seen the global and European shares increased significantly this is also a very interesting example it's a specific ransomware as a service train called Saudi no key B we're looking here it's two different transactions which are ransomware payments and this is an interesting strain because the developer has actually built a functionality in the software that will immediately sense a portion of the payouts to that that creator and the rest goes to the person

who bought it on the dark web and deployed it so these ransomware tools can be very sophisticated really interesting some of them have customer support if the victim doesn't know how to buy Bitcoin there'll be a little number please call this number what explain how to buy Bitcoin it's it's just crazy and so a few things that we recommend of course is to not be quiet we need to be able to but also just we want these victims and companies typically their companies to be aware that there's a lot you can do to trace

funds and we've worked a lot with insurance companies and all their other types of victims to do recovery successfully then there's other types of ransomware or sextortion that are targeting individuals but here were mainly looking at organizations and larger entities so hacks they've been getting a lot more sophisticated we're going to look at an interesting example by lazarus the north korean links group what we're looking at here is a hacks of exchanges so not investment companies not online wallets only hacks where the

funds of the platform or the users were accessed so not exit scams and also we removed some hacks that were reported to us prior as long as it didn't significantly skew the data I'll point out a couple things the 2014 sorry column is Mount GOx the big pink blur in 2018 is quaint check and a few things that are obvious right away is that the number of hacks that fall into the scatter is still increasing from 2017 to 2019 you see there's a big increase but the size of the the amounts being hacked are becoming smaller and 2019 that's obvious

with the height of the column what we take away from that is that these platforms are becoming more adept at using cold storage and managing their funds in a secure way but there's still a lot of attacks being made and the level of sophistication is really impressive I like this example this is the dragon X platform they were hacked for about seven million USD worth of crypto last year by was later determined to be Lazarus and they did something pretty sophisticated they built a fake website fake social network profiles but they also went a step further they

pretended that this company was making a trading bot and they claimed that they wanted access to the exchange for liquidity and they started seducing some of the people at that platform offering a free trial of the trading bot which they actually built but there was also software in there which could grab private keys which is what happened so the one thing that the exchange did well was to report it immediately and we were able to disseminate a list of the addresses where the funds had first been sent and so at some exchanges where the criminals tried to convert the funds to Bitcoin before laying layering it

somewhere else we were able to capture that and there was a fear my trying a few other things sense to a number of exchanges those are the yellow dots those are the exchanges where criminals try to convert the assets to Bitcoin which is what they did before sending it to these little black dots which are private wallets which they then forwarded to this coin join was naughty wallet which has a quaint ring protocol so this is where this was all consolidated again and I'm pretty sure that's where we stopped tracking it very interesting case and the way that these criminals are now off tramping or

exiting the crypto has also changed we're looking at 2017 2018 2019 and they used to rely heavily on these low key YC exchanges but in the last year they've also started using these coins earn Wallace which we've just mentioned and letting that big blue blurb is the unspent so they're letting funds sit somewhere much longer now and that could be for different reasons maybe they're thinking about other ways they can use to layer this and put it back more efficiently in the system so this is what we recommend reported quickly because we can actually freeze these

funds as soon as they hit exchanges when we have a black list so dark net markets we're going to go quite quickly there's a big uptick in activity here over last year specifically it's not just drugs you can buy PDFs you can buy hacking kids and that uptick is what we see there in the yellow bar going up from 2018 from 2019 that's the uptick in the relative share big drop from 2015 there which was sort of the golden age but in absolute terms the the money spent is the highest it's ever been at almost 800 million so that's concerning and these platforms are sophisticated you know so this is a Empire market you can there's thousands

of listings there are reviews it's like any other sort of platform that where you can buy and sell good and they're in competition with each other so here you have different platforms alpha beta H was totally dominating in 2016 but now you see it's splintered again and we have the Empire market empire market which is again becoming very prominent and so like I said it's not just drugs you can also buy credit card information for example this is something that we will tag in our systems as well and that we work a lot with financial institutions to make this obvious to them so recommendations to educate yourself the strategies used by the

criminals are always evolving for financial institutions we recommend they pay extra attention to carding shops this is the last last typology we're going to talk about terrorism financing also still in its infancy it used to be literally a guy posting his deposit address at Queen base would get captured right away and reported but it's becoming more sophisticated like for example they have landing pages will generate a unique address for any person that visits then asking that person for funds so it's evolving quickly and we have our eyes on it but we still see a lot of misinformation for example these sensationalist titles breaking isis use

because going to fund these bombings because somebody started doing research but with incomplete data set so there's an analysis firm that was looking at this deposit address here at containments and there was very little activity there but they started looking at the transactions and they saw one transaction for $10,000 April 2019 with this address over here so they made a report that there was a lot of financing going on especially since they were looking at had processed more than 150 million but we took another look at it and we quickly figured out that both of those addresses working within the same

organization and they were actually looking at how that company was managing the funds internally so they reach the wrong conclusions sort of happened here this is in Israel with Hamas there was an address at a Gaza base many service called cash four PS and looking at this and they saw that the cluster had processed more than three hundred and thirty thousand seventy Bitcoin today worth about twenty million which obviously looks like a huge amount of money but again they were using an incomplete data set most of those transactions were happening way before the Gaza that address was being used for any sort of terrorism financing

also of that amount very small amount was actually received from the outside the majority were internal fan flows so really public data is not enough she needs to contextualize it and read and that's what thank you so much may be time for a question or two we can you guys just do that outside I guess oh yeah no problem yeah sorry about that