‘Crypto’ anti-money laundering efforts need to incorporate tradfi tools

Getting your Trinity Audio player ready...

‘Crypto’ has helped money launderers wash nearly $100 billion worth of the illicit proceeds of crime since 2019, according to a new Chainalysis report.

On July 10, the blockchain sleuths at Chainalysis issued a new Money Laundering and Cryptocurrency Report (summary and link to download full report here). The report details the extent to which money launderers use blockchain technology “to launder funds from a broader range of illicit activities beyond the conventional understanding of crypto crime,” including narcotics trafficking and fraud.

The report claims that “since 2019, nearly $100 billion in funds have been sent from known illicit wallets,” aka blockchain addresses connected with exchange heists, digital currency scams, darknet market proceeds, and such. These funds were sent to “conversion services,” aka centralized digital asset exchanges, decentralized finance (DeFi) services, gambling sites, coin mixers, and cross-chain bridges.

The biggest single year for the transfer of funds by illicit wallets to conversion services was 2022 when $30 billion in transactions was recorded. That was the year that Russia invaded Ukraine and the West imposed economic sanctions on Russian individuals/entities, including the Russia-based Garantex exchange. 2023 saw the second largest illicit transaction total at around $24 billion.

The above figures don’t include transactions where digital assets are used to launder funds, but the illicit activity source is either unidentified or off-chain, such as drug traffickers paying distributors with tokens.

Countering this flow of illicit funds will require investigators to possess an understanding not only of blockchain transaction tracing but also ‘traditional’ money laundering tactics. These include the three-stage process known as placement, layering, and integration that washes dirty money clean of the stains that typically set off alarms at traditional financial institutions.

Hopping all the way to the bank

“Crypto-based” layering can involve ‘hops,’ in which funds are sent through multiple intermediary wallets, defined by Chainalysis as distinct unidentified wallets between two known endpoints. These wallets may or may not be controlled by the same individual/entity, but they can also involve using a conversion service.

Chainalysis says these intermediary wallets can account for 80% of the total value of illicit flows through laundering channels. As with the total sums laundered through illicit transactions, the use of intermediary wallets involving illicit flows peaked in late 2022.

The report found greater use of intermediary wallets before illicit funds are sent to digital asset exchanges that employ ‘know your customer’ (KYC) programs compared to funds sent to less diligent exchanges. Exchanges are also advised to monitor so-called ‘consolidation’ wallets that receive funds from multiple wallets before the accumulated funds are transferred to an exchange.

There’s always a Tether connection

Chainalysis says stablecoins account for “an increasing portion” of the illicit funds passing through intermediary wallets, in keeping with the group’s previous finding that stablecoins “now account for the majority of all illicit transaction volume.” In particular, stablecoins are associated with transactions involving sanctioned entities, terrorism, and scams—including the increasingly popular ‘pig butchering’ scams.

From just 10% of illicit transaction volume in 2020, stablecoins accounted for around 60% of “crypto” crime in 2023. Chainalysis attributes this to the overall increase in stablecoin adoption over the past few years, as even crooks prefer assets that aren’t prone to dramatic devaluations on an hourly basis.

Tether (USDT) is the world’s largest stablecoin by market cap and has routinely been linked with all manner of serious criminals and terrorists. Tether appears to play a key role in laundering funds through China-based over-the-counter (OTC) brokers.

The report cites one OTC broker’s Mandarin-language pitch on their Telegram channel touting their “24-hour self-service redemption.” The channel claims to have “sold a large amount of USDT stolen from overseas,” with on-chain analysis backing up the broker’s claim of averaging $3 million per day this year.

Layering up

As law enforcement grows more capable of tracking crooks’ intermediary hops, crooks are utilizing other layering tools to further obfuscate their trail. While the use of coin mixers appeared to peak in mid-2022—in part due to that year’s sanctioning of Tornado Cash by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC)—their use has increased of late, “consistent with a general uptick in market activity.”

Privacy coins such as Monero and Zcash are also seeing a resurgence, their use spiking dramatically in the past nine months. Chainalysis attributed the rise in part due to Monero-friendly instant exchangers, which don’t require KYC checks and are proving popular with purveyors of child sex abuse material (CSAM).

Privacy coins’ popularity had declined as a number of centralized exchanges delisted tokens due to increased regulatory scrutiny. It didn’t help that, in addition to its popularity with child abusers, terror groups such as the Islamic State in Khorasan openly promoted Monero as a funding mechanism.

Cross-chain bridges also hit a new peak in popularity this year—$234 million in illicit inflows in January alone—as crooks looking to send coins to/from mixers sought an extra level of confuse-a-Fed obfuscation.

Over half of illicit funds travel through centralized exchanges due to crooks’ desire to convert their ill-gotten gains to cold hard cash. Transfers from illicit wallets to exchanges peaked in 2022 at nearly $2 billion per month but have since fallen to around $780 million/month.

Chainalysis says this decline is likely due to regulators putting pressure on exchanges to improve their anti-money laundering (AML) programs. In other cases, these programs were beefed up only after law enforcement agencies got involved and required improvements as part of a legal settlement.

New crooks, old tricks

Crooks, using traditional financial channels in the U.S., learned long ago to keep individual cash transactions below the $10,000 mark that requires reporting under the Bank Secrecy Act. American regulations impose similar requirements on digital asset transactions exceeding $3,000, while the global Financial Action Task Force (FATF) sets that bar even lower at just $1,000.

While crooks may think they’re smart by ‘structuring’ larger transfers into a series of transactions just under the reporting limits, tradfi institutions have learned to watch out for such attempts at subterfuge and digital asset service providers are well-advised to do likewise.

Another potential red flag comes from multiple transactions for the same amount or in rounded figures. Chainalysis cited a particular suspected bad actor associated with North Korea’s “crypto” hacking activities that transferred 308 BTC to an exchange over four days in multiple transactions, each transfer in rounded numbers.

An individual/entity’s willingness to pay higher-than-average transaction fees to ensure a speedier blockchain transfer can also be a warning sign. Chainalysis notes that “significant fee surges often coincide with inflows to Tornado Cash from wallets holding stolen funds.”

The bottom line is that to effectively reduce blockchain-based money laundering, digital asset service providers need to use all the tools at their disposal, including those from the tradfi institutions they routinely mock.

Watch: Teranode is the future of the Bitcoin network