Cryptocurrency and crime
Cryptocurrency has been used extensively in criminal activities, such as investment and romance scams (often called "pig-butchering"), ransomware payments, thefts and exchange hacks, money laundering and sanctions evasion, darknet-market transactions, and off-chain coercion to obtain private keys. Law enforcement notes that investment fraud and laundering are frequent criminal uses of cr
Overview
Cryptocurrency has been used extensively in criminal activities, such as investment and romance scams (often called "pig-butchering"), ransomware payments, thefts and exchange hacks, money laundering and sanctions evasion, darknet-market transactions, and off-chain coercion to obtain private keys. Law enforcement notes that investment fraud and laundering are frequent criminal uses of cryptocurrencies, while noting that public blockchains can also aid law enforcement in tracing, seizures, and arrests.
Background
Cryptocurrencies are digital assets transferred on distributed ledgers without a central administrator. Transfers are borderless, typically irreversible, and control depends on possession of private keys rather than accounts held by a single intermediary. Criminals use cryptocurrencies when they make certain offences easier than traditional methods. This ease is due, for example, to the ability to move funds quickly across borders, take payment without going through banks, and launder proceeds through lightly regulated services. These traits suit offences such as theft, investment fraud and "pig-butchering," ransomware payments, darknet-market trade, money laundering and sanctions evasion. Since 2019, authorities have tried to limit the criminal misuse of crypto by bringing "virtual assets" and virtual-asset service providers (VASPs) into anti-money-laundering and counter-terrorist-financing (AML/CFT) rules. The standards require licensing or registration, customer due diligence, and the "travel rule" for originator/beneficiary information. Governments pair these with supervision and enforcement (including asset seizures, sanctions, and joint takedowns) and with more cross-border information-sharing among financial-intelligence units and police. However, offenders still work around these controls. Common methods include routing funds through non-compliant or offshore providers; peer-to-peer transfers and OTC brokers; mixers/tumblers, peel-chain transactions, and cross-chain "hops" via bridges; and other anonymity-enhancing tools, sometimes combined with stolen or synthetic identities at compliant platforms. Uneven implementation of AML/CFT standards (including the travel rule) across jurisdictions remains a widely noted gap, and decentralised or extra-jurisdictional services can be harder to disrupt; many investigations therefore still focus on identifying fiat on-/off-ramps and coordinating across borders.
Scope and impact
The overall scale of crypto-related crime is difficult to measure and figures below are not directly comparable, due to the differences in geographies, methodologies, and crime types. Still, recent indicators give a sense of order of magnitude.
Exit scams and Ponzi schemes through initial coin offerings (ICOs)
Most exit scams (or rugpulls), as well as many ponzi schemes involving cryptocurrencies, are performed through Initial Coin Offerings (ICOs), and Satis Group has reported that almost 80% of all projects launched through an ICO in 2017 were scams. These scams usually involve the perpetrators attracting investments from mostly retail investors, inflating the price and subsequently abandoning the project in question after selling off their own shares. The novelty of ICOs accounts for the current lack of governmental regulation. This lack of regulatory measures, as well as the pseudonymity of cryptocurrency transactions and their international nature across countless jurisdictions in many different countries, can make it much more difficult to identify and take legal action against perpetrators involved in these scams. Since 2017, the SEC has been actively pursuing groups and individuals responsible for ICO-related scams.
Ponzi schemes
Ponzi schemes are another common method of utilizing blockchain-based technologies to commit fraud. Most schemes of this sort use multi-level marketing schemes to encourage investors to conduct risky investments. Onecoin is one of the more notable examples of cryptocurrency-ponzi schemes: founded in 2014 by Ruja Ignatova, OneCoin is estimated to have generated US$4 billion in income. While, at least in China, some of the investors' funds have been recovered and several members of the organisation arrested in the U.S., Ignatova herself is still at large. Quadriga was another cryptocurrency ponzi scheme--this time in Canada--which involved $190 million US dollars or $250 million Canadian dollars and was investigated by both the Royal Canadian Mounted Police and the Federal Bureau of Investigation after the death of its owner, Gerald William Cotten, in December 2018.
Money laundering
Due to the inability of third parties to de-pseudonymize crypto transactions, criminal entities have often resorted to using cryptocurrency to conduct money laundering. ICOs lacking KYC guidelines and anti-money laundering procedures are often used to launder illicit funds, due to the pseudonymity they offer. By using ICOs, criminals launder these funds by buying tokens off of legitimate investors and selling them. This issue is intensified by the lack of measures against money laundering implemented by centralized cryptocurrency exchanges. A well-known early example of money laundering using cryptocurrencies is Silk Road. Shut down in 2013, with its founder Ross Ulbricht indicted for a money laundering conspiracy among other counts, the website was used for several illicit activities including money laundering solely using bitcoin as a form of payment. Apart from traditional cryptocurrencies, Non-Fungible Tokens (NFTs) are also commonly used as part of money laundering activities. NFTs are often used to perform Wash Trading by creating several different wallets for one individual, generating several fictitious sales and consequently selling the respective NFT to a third party. According to a report by Chainalysis, these types of wash trades are becoming increasingly popular among money launderers due to the largely anonymous nature of transactions on NFT marketplaces. Auction platforms for NFT sales may face regulatory pressure to comply with anti-money laundering legislation.
Regulatory measures
Canada is generally regarded as the first state actor to implement regulatory measures dealing with money laundering conducted by the usage of cryptocurrencies. By 2013, the Financial Crimes Enforcement Network (FinCEN) — in direct reference to the centralized exchange Mt. Gox — issued regulations making it clear that all crypto-to-fiat exchangers had to apply KYC- as well as anti-money laundering methods. Any suspicious transactions, therefore, have to be reported to the authorities. Centralized exchanges have to register as money transmitters, with the exact definition of who and what constitutes a money transmitter in the crypto sphere being somewhat blurred and regulations differing between the different states of the U.S. An important exemption from these regulations is decentralized exchanges, due to the fact that they do not hold any fiat currency. As part of the Fifth Anti-Money Laundering Directive of 2018 and in an effort to combat money laundering and the financing of terrorism, the European Union has issued a directive that all member-states must make sure that crypto exchanges are licensed and registered. The EU is furthermore planning to take measures to ensure that all customers of cryptocurrency exchanges must verify their identity as part of the registration process.
Regarding NFTs
Auction platforms for NFT sales may face regulatory pressure to comply with anti-money laundering legislation. A February 2022 study from the United States Treasury assessed that there was "some evidence of money laundering risk in the high-value art market," including through "the emerging digital art market, such as the use of non-fungible tokens (NFTs)". The study considered how NFT transactions may be a simpler option for laundering money through art by avoiding transportation or insurance complications in trading physical art. Several NFT exchanges were labeled as virtual asset service providers that may be subject to Financial Crimes Enforcement Network regulations. The European Union has yet to establish specific regulations to combat money laundering through NFTs. The European Commission announced in July 2022 that it was planning to establish regulations by 2024.
Giveaway scam
A cryptocurrency giveaway scam involves scammers compromising or impersonating celebrities, influencers, or well-known companies to falsely claim they are multiplying cryptocurrency or giving away free cryptocurrency via airdrop. A variety of methods are used to promote these scams, primarily through posts and livestreams on social media. YouTube is commonly used to promote this scam. Popular accounts are hacked to stream pre-recorded videos of the impersonated figure, overlaid with fake giveaway announcements that often encourage viewers to visit the scammer's website. In July 2020, Apple co-founder Steve Wozniak and 17 other victims filed a lawsuit against YouTube and its parent company, Google, alleging that the platform allowed scammers to use their name, image and likeness in cryptocurrency giveaway scams. After earlier dismissals based on Section 230, a 2024 California Court of Appeal ruling allowed the case to proceed, finding that YouTube's role may fall outside those legal protections, with the case now pending further proceedings in the lower court. In the 2020 Twitter account hijacking, 130 high-profile accounts, including those of multi-billionaire Elon Musk and then U.S. president Joe Biden, were used to promote a bitcoin giveaway scam. Within minutes of the initial tweets, more than 320 transactions had been sent to one of the wallet addresses, and over US$110,000 worth of bitcoin had been deposited before the scam messages were removed by Twitter. Coinbase blacklisted the bitcoin address and said they stopped over 1,000 transactions, totaling over US$280,000, from being sent.
Paper wallet generators
Paper wallet generators allow users to create a wallet address and corresponding private key. While not dubious in itself, fraudsters can create infected generators that secretly communicate the generated keys to the creator, giving them control of the wallet. In August 2017, a bad actor began advertising an online IOTA wallet seed generator. To gain the victim's trust, they linked to a legitimate GitHub repository, claiming that their website used the same code. In reality, the website used an intentionally predictable random number generator, resulting in the same IOTA wallet seeds being generated. Each of these seeds was logged. On January 19, 2018, the attacker drained approximately US$3.94 million from wallets created during the six-month period. Profiles associated with the website on GitHub, Reddit, and Quora that had provided support to users were deleted, and the website was updated to display the message: "Taken down. Apologies." In January 2019, Europol arrested a 36-year-old man from Oxford, England believed to be behind the attack.
Malware attacks
In February 2014, the Pony virus, which spread to between 100,000 and 200,000 computers through a botnet, was reported to have stolen up to US$220,000 in cryptocurrency from 85 wallets. Researchers later discovered updated versions with the ability to steal 30 types of cryptocurrencies. A type of Mac malware active in August 2013, Bitvanity posed as a vanity wallet address generator and stole addresses and private keys from other bitcoin client software. A different trojan for macOS, called CoinThief, was reported, in February 2014, to be responsible for multiple bitcoin thefts. The software was hidden in versions of some cryptocurrency apps on Download.com and MacUpdate.
Stealers and drainers
A stealer, also known as a drainer or infostealer, is a type of malware designed to steal private information, including private keys from cryptocurrency wallets, enabling attackers to access and transfer the funds to their wallet. The most common infections scan computers for wallet files and upload them to a remote server, where they can be cracked. Many stealers also incorporate keyloggers to record keystrokes, thus bypassing the need to crack the keys.
Wikipedia contributors · Cryptocurrency and crime · revision 1380781033 · CC BY-SA 4.0 · Plain text extracted and formatting adapted; tags derived from linked topics.