This past year has been a roller coaster for cryptocurrency prices, leaving many investors underwater and searching for answers. A growing number of lawsuits have been filed, including class actions against trading platforms, hedge funds, and currency exchangers. Additionally, a recent ABI Journal article raised the prospect of a wave of fraudulent-transfer litigation involving cryptocurrencies. For legal counsel and parties to such lawsuits, it is important to understand how cryptocurrencies work and how investigators go about following the flow of funds involving cryptocurrency transactions (i.e., following the tokens).
The ability to track cryptocurrency funds is also of growing importance to U.S. and international regulators, financial institutions, and law enforcement agencies, which have become increasingly concerned over potential white-collar and financial crime issues, such as securities trading violations and money laundering. In February 2018, Commodity Futures Trading Commission (CFTC) Chairman J. Christopher Giancarlo indicated that the CFTC intends “to be very aggressive, if nothing else, [regarding cryptocurrencies] so that people like my niece can have some security that there aren’t fraudsters and manipulators out there – and there are a lot, too many, far too many of them.”
It remains to be seen how much of the cryptocurrency market is compromised by fraudsters, money launderers, or manipulators who have exploited the market’s pseudoanonymity, decentralized nature, and loose regulation. With fiat money, money launderers can employ complicated techniques often involving shell companies, offshore and/or temporary bank accounts, and nominees, gatekeepers, and other intermediaries. With cryptocurrencies, users may use various anonymization techniques in attempts to obscure the money trail.
Methods to launder fiat money have been around for centuries, and even with the introduction of virtual currencies, the same basic principles apply. It is important to remember the goal of money laundering is to disguise the origin of so-called dirty money generated from illegal activity in order to use it to finance other illegal operations and/or for legitimate purposes – not to make a profit – all while hiding the launderer’s identity. Investigators often describe the process in three stages: placement, layering, and integration.
This stage represents the initial movement of dirty money into the financial system. The goal is twofold: 1) reduce the possibility of physical detection and 2) place the money into a legitimate financial institution. Financial institutions typically have policies, such as reporting thresholds, aimed at guarding against the deposit of illegally obtained funds, and launderers sometimes structure their funds into smaller increments to avoid conflicting with policies. Additionally, funds may be split and deposited across multiple bank accounts.
In this stage, launderers distribute funds across multiple bank accounts in attempts to make it more difficult for investigators to trace the flow of funds. High-profile cases often involve a sophisticated network of accounts held across banking institutions and jurisdictions – with currency exchange transactions further complicating the trail of money. These schemes often involve the use of shell or shelf companies, offshore bank accounts, temporary bank accounts, small financial institutions, and alternative money service businesses (MSBs). Complex computer programs may be used to facilitate the distributions.
U.S. regulations require banks to track activity and identify suspicious behavior through suspicious-activity reports (SARs) filed with the Financial Crimes Enforcement Network (FinCEN) following suspected incidents of money laundering or fraud. FinCEN also requires MSBs to file SARs for suspicious transactions over $2,000, and for banks to keep records for wire transfers over $3,000 and file currency transaction reports for cash transactions over $10,000.
The final stage is the point at which the launderer is reunited with the funds and uses them to make purchases. The funds may be used to pay third parties or purchase high-value items such as real estate, luxury vehicles, luxury goods, businesses, professional sports teams, and even insurance policies that offer annuities.
While techniques to launder cryptocurrencies differ from those used in conventional money laundering, the overall process may be described according to the same three stages.
The first stage involves obtaining a cryptocurrency and creating a wallet to hold the tokens, similar to a bank account. Coins can be obtained through licensed exchangers such as Coinbase, MSBs, Bitcoin ATMs (BTMs), initial coin offerings, property exchanges, and peer-to-peer (P2P) transactions. Purchases can be made using cash, debit cards, wire transfers, and some credit cards. Although licensed exchangers require customer identification, some BTMs and unregistered or private bilateral exchangers allow purchases without identification.
As with conventional money laundering, the goal of this stage is to make it more difficult for investigators to trace the flow of funds. Layering cryptocurrencies may be as simple as transferring funds from one wallet to another, similar to transferring money from one bank account to another. In addition, launderers may use mixing and/or shifting services in attempts to obscure the source of funds.
The final stage is again the point at which the launderer is reunited with the funds and uses them to make purchases. Cryptocurrencies may be converted into fiat currencies through an exchanger. This process usually follows strict identification requirements and supports only more popular coins, such as Bitcoin or Ether. Alternatively, cryptocurrencies may be used directly to purchase goods or pay for services from a limited number of vendors. For example, in January 2014, Overstock.com became the first major retailer to accept Bitcoin, and now even small vendors such as The Uncommons coffee shop in New York City accept the currency, as well. Note, however, that merchants that accept cryptocurrencies are sometimes viewed as being high-risk, particularly for banks.
P2P websites such as LocalBitcoins.com provide anonymous exchange methods. These websites connect buyers and sellers based on purchasing preferences, which range from bank transfers to meeting in person. Further, wallets can be stored online, on phones, and even on hardware such as USBs, making it possible to physically sell crypto-coins for cash.
Also called tumbling or washing services, these involve the transfer of crypto-coins among a pool of customers within the same cryptocurrency. Coins deposited by customers are combined into a larger pool and then replaced with a random set of coins upon withdrawal. Services such as Bitcoin Blender provide an array of additional tools to further obscure the tumbling. Customers can choose to receive their coins through multiple withdrawals and with randomized delays. Such services may be compared to structuring in conventional money laundering. Bitcoin Blender even offers randomized service fees, which hinders investigators from identifying withdrawals based on a set service fee.
CoinJoin is an anonymization method whereby customers route coins through intermediaries to their counterparties’ wallets. Customer coins are comingled with those of the intermediary, and random coins are then sent to the intended recipient wallets. CoinShuffle can be thought of as CoinJoin without an intermediary. Each participant encrypts his or her output address using the other participants’ encryption keys and then passes the encrypted list to the next participant. Each progressive pass shuffles the addresses. The final participant broadcasts the list of addresses to all other participants to verify the presence of their original address and to assign them their new output address. This results in each participant sending and receiving coins to/from a random address. For example, Alice would send one coin to Bob, Bob would send one coin to Charlie, and Charlie would send one coin to Alice.
We can think of cryptocurrency exchangers as similar to stock or currency exchanges. Users can buy or sell coins and, through some exchangers, exchange coins for others. Users can move funds from one cryptocurrency to another, e.g., Bitcoin to Ether. The Bitcoin blockchain will show a deposit to the exchanger’s Bitcoin address, and the Ether blockchain will show a deposit to the customer’s Ether wallet from the exchanger’s Ether wallet.
Since funds have been layered across different coins, information may need to be obtained from the exchangers to trace the coins. While licensed exchangers require customers to identify themselves, countless unlicensed exchangers remain unregulated and do not store identifying information.
The conventional financial system involves a wide variety of intermediaries, e.g., banks, thrifts, clearinghouses, brokerages, and others. By comparison, most cryptocurrencies remove the need for such intermediaries through the use of blockchain technology. Instead of intermediaries, each blockchain transaction is instantaneously notarized and sealed cryptographically. This record is shared with every peer on the network and allows everyone to see every transaction since the creation of the cryptocurrency. Due to the distribution of the blockchain, it is often referred to as a distributed ledger. Unlike with intermediaries, there may be no single party to subpoena to gain access to transaction records.
QR codes and/or public or private keys (or addresses) serve as the main identifying information for traditional cryptocurrencies such as Bitcoin. The public and private keys are strings of alphanumerical characters, much like account numbers. Public keys are viewable by anyone. Linking public keys to private keys or otherwise identifying an owner allows investigators to identify every transaction by that individual.
Alternative cryptocurrencies, such as Zcash and Monero, attempt to increase anonymity through zero-knowledge proofs and other privacy protocols. These methods validate transactions without revealing identifying information about the sender, recipient, or amount transacted. This technology provides an additional challenge to regulators and investigators.
It is evident that blockchain technology brings many benefits and opportunities to transform financial markets, but with anonymization efforts and potentially fraudulent activity, regulators are clamping down.
While the topics we discuss here may present unique challenges to litigants who are trying to trace the flow of their cryptocurrency funds, new tools are emerging every day that aim to help investigators. The most popular tool used by U.S. federal law enforcement and compliance officers today is Chainalysis (www.chainalysis.com), an enhanced due diligence tool that allows users to visualize the source and destination of funds and to spot emerging threats from the deep web. Additionally, the tool may be used for ransomware investigations.
A comprehensive understanding of both conventional and new money laundering techniques involving cryptocurrencies, as well as real-world experience handling big data sets, may be helpful to investigators, regulators, prosecutors, analysts, law enforcement, and legal counsel.
Our thanks to Ross S. Delston, CAMS (attorney and expert witness), for his comments on this article.
Lourdes Miranda, CAMS, CFE
Principal – Miranda Financial Intelligence Consulting
Analyst – Dispute Consulting