Cryptocurrency Theft Drives 3x Increase in Money Laundering

Cybercriminals are snatching cryptocurrency like never before, driving a rise in money laundering as they hide their digital funds and evade authorities.

The first half of 2018 saw a threefold increase in cryptocurrency theft compared with the full year of 2017, researchers state in CipherTrace's new "Cryptocurrency Anti-Money Laundering Report" for Q2 2018. Attackers launder digital currencies using a variety of tools and technologies, including mixers, chain hopping, privacy coins, and gambling sites, to name a few.

Much of the rise in theft can be attributed to "old-school" cybercriminals who used to target financial institutions with phishing attacks, ransomware, and malware to steal money and credit card information, explains Dave Jevans, CEO of cryptocurrency startup CipherTrace. Now they're finding new targets to build their illicit fortunes: cryptocurrency exchanges.

But many of the actors snatching digital money are new to cybercrime, Jevans adds.

"We're now seeing, in the last probably eight to 12 months, a real influx of new criminals that are highly technically sophisticated," he explains. There's a major difference between seasoned threat actors and those who have been dabbling in cybercrime for less than 12 months: operational security.

It isn't a question of technical prowess so much as lack of experience, Jevans continues. Cybercrime's newest threat actors can craft advanced malware designed to target cryptocurrency addresses and inject similar addresses, under their control, to receive funds. Their malware is designed to target digital funds in a way traditional malware isn't, created by people who grew up learning about virtual currencies and can exploit them in new ways.

The problems start when they secure the money. Traditional phishers and large-scale malware attackers have learned through trial and error how to conceal illegal activity online. New entrants leave tracks all over the place.

"It's clear these people really understand cryptocurrency and crypto assets really, really well," he explains. "What they don't understand is old-school operational security … they're just not sophisticated that way. Legacy folks, they definitely have better operational security. They're better at how they interface with it, how they distribute malicious code, how they manage user handles on different forums."

However, signs indicate the newest actors are smart enough to learn – and they'll be tougher to pin down once they do.

How Virtual Money Laundering Works
The first step of cryptocurrency laundering is called layering. In traditional money laundering, this would involve buying and reselling expensive goods. In the virtual world, it involves putting funds in the cryptocurrency system and moving them around with mixers or using privacy coins. The more money moves, the harder it is to trace.

Mixers, also called tumblers and foggers, accept coins from several customers and mix them together before reallocating mixed funds. They typically require a 1% to 3% fee and have advanced in recent years to better conceal the money's origin. Now, Jevans says, they keep incoming and outgoing funds completely separate on the blockchain so there's no way to link the two.

The Internet also has 100 to 200 gambling sites that serve as money-laundering tools. Thieves create accounts and transfer funds to be laundered. Some make simple bets; some withdraw funds to a new address without making bets at all. Gambling sites often don't have a "know your customer" regulation, so it's tough for law enforcement to learn where money came from.

Privacy coins like Zcash and Monero don't make up the majority of transactions – most actors prefer bitcoin – but Jevans notes many cybercriminals are adopting them to fly under the radar. However, he anticipates these coins will soon be regulated so they comply with AML regulation.

AML Regulation Crackdown
Regulators are narrowing their focus on anti-money laundering (AML) regulation as virtual currencies are exploited to support malicious activity. The 5th Annual Europol Virtual Currency Conference, which recently took place in the Netherlands, became a place of conversation around how controls will be put into place.

"Where we're seeing it going is toward more global standards," Jevans says. "Trends are definitely toward more clear regulation [that is] easier to follow."

The Office of Foreign Assets Control (OFAC) has a list of people, companies, addresses, bank accounts, and countries that are not allowed to conduct business with the US, and it plans to add cryptocurrency addresses to the list. FinCEN says money transmitters in foreign countries will be held accountable if they violate US AML regulations.

The US Secret Service is taking a closer look at privacy coins, such as Monero and Zcash, and their role in cybercrime while advising Congress to consider additional legislative action. On June 20, the Secret Service claimed to have seized over $28 million in digital currencies in its criminal investigations. Main government branches are allegedly considering new regulations.

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.