Why Some Criminals Love Crypto - Dynamic Securities Analytics, Inc.

Why do some criminals love crypto? It’s more than just anonymity.

Valuable Features of Financial Products to Bad Actors

It is useful to understand how a bad actor evaluates financial products generally before addressing cryptocurrency specifically. When a bad actor wants to conduct a financial transaction, they will assess whether a financial product can move funds:

far,
fast,
in large amounts,
irreversibly,
anonymously,
and to a third-party.

There is no one feature that drives bad actors to a particular type of financial product. Anonymity is just one feature that bad actors weigh.

While a truckload of nickels and dimes is anonymous, it cannot be moved far or fast. Gift cards are also anonymous but usually have a dollar cap and are not ideal for moving large amounts at once. For example, paying a $150 million dollar bribe to a foreign government official with gift cards, even with a $2,000 cap, would require roughly 75,000 gift cards.

Wires can move large amounts, far but are reversible if caught early. For example, in fiscal year 2023, the FBI’s Recovery Asset Team initiated the Financial Kill Chain on 2,763 complaints with a reported loss of $689 million. Of the reported loss, $507 million was successfully frozen with the assistance of banks- a 74% success rate.

Why do Criminals use Cryptocurrency?

Cryptocurrency is attractive to bad actors because it has so many of the features they value in a financial product.

Blockchain based cryptocurrency transactions move seamlessly across international borders (far) and can be settled in minutes (fast). There is no cap on the value of cryptocurrency that can be transferred in a transaction (in large amounts). In most instances, a cryptocurrency transaction cannot be reversed once it has been added to the blockchain (irreversibly). Cryptocurrency wallets are pseudonymous, meaning the true owner of the wallet may never be linked to a given wallet address (anonymously) and the same can be true for the recipient (to a third-party).

However, anonymity is not a priority for all bad actors using cryptocurrency. As is the case for many residing outside of the United States, especially within adversary nation-states, because it is difficult for our regulatory and legal systems to hold them accountable. Additionally, the anonymity, or even pseudonymity, of wallet addresses makes it challenging to determine when transactions are sending funds to another party or just to another wallet owned by the originator.

Illogic of Ill-Suited for Illicit Finance

While some commentators argue that blockchain transparency makes cryptocurrency ill-suited for illicit finance. If we follow that (il)logic, then:

The weight and bulk of currency make cash ill-suited for illicit finance.
The reversibility of wires makes it ill-suited for illicit finance.
The dollar limit on Zelle transfers makes it ill-suited for illicit finance.
The physical location of real estate makes it ill-suited for illicit finance.
The names and addresses printed on checks make checks ill-suited for illicit finance.

However, as demonstrated above, no one factor deters bad actors from finding ways to use financial products. Dismissing cryptocurrency as a useful tool for illicit finance just because some transactions are pseudonymously recorded on a blockchain is misguided. And is wholly inconsistent with cryptocurrency Suspicious Activity Reports (SAR), IC3 advisories, or CFPB consumer complaints.

The Journey of Criminal Proceeds

Criminal proceeds can initially be generated in one financial product and the value transferred to other types of financial products.

For example, if the criminal proceeds initially were generated in cash or via wire transfers to bank accounts, crypto may be used later to launder the funds. The reverse is also true—crypto native criminal proceeds (ex. dark markets, crypto hacks, and ransomware) will likely be converted to traditional financial products when the criminal wants to spend the proceeds, as crypto remains little used as a means of payment.

Do All Bad Actors Need Features Offered by Crypto?

The features offered by cryptocurrency as a financial product may not be needed by all criminals, even those engaged in the same crime.

Consider the following drug dealers:

A high school student selling Oxy stolen from her parents’ medicine cabinet may not need to move large dollar amounts overseas.
A local cocaine dealer may operate in cash or using P2P payment apps. But as one moves up the cocaine supply chain, funds are consolidated (large) and need to be remitted back to the drug cartel source country (far).
A fentanyl manufacturer or vendor that only accepts payment in crypto.

Which Criminals Love Crypto?

Ideal Match

The ideal “match” between a bad actor and cryptocurrency, is one who needs to move large amounts, far, fast, irreversibly, anonymously and to a third party.

Ransomware actors meet all six of these criteria. Therefore, it should be unsurprising that FinCEN found that every ransomware event reported in BSA data in Q1 & Q2 2021 demanded payment in cryptocurrency.

Far and Large Amounts

Certain criminals relish the far and large amounts features of cryptocurrency:

Transnational Criminal Organizations. “Traditional” TCOs engaged in drug trafficking, human smuggling, counterfeiting, etc. As the name implies, TCOs operate across borders. While this doesn’t mean that funds always will need to travel far, it often does. One estimate concluded that TCOs generated 40% of all illicit proceeds globally, which roughly equals hundreds of billions of dollars. Crypto can assist TCOs with moving large amounts, far.
Corrupt Foreign Government Officials. Corrupt government officials have a need to transfer large amounts of funds… across borders (far)…preferably anonymously. Global AML laws have highlighted risks posed by Politically Exposed Persons. Cryptocurrency transactions (especially those conducted wallet to wallet) can help corrupt officials remain anonymous.

While there is no honor among thieves, criminals that work together (TCOs) or rely upon each other (bribe payor / bribe recipient), may be less concerned with fast or irreversible payments.

Irreversible, Fast, and to Third Parties

Other criminals are more focused on the irreversibility, third-party and fast aspects of crypto:

Fraudsters. Fraudsters engaging in scams including pig butchering, crypto investment scams, and law enforcement impersonation know that once the victim has sent them (a third party) crypto, the odds of clawing it back (reversibility) are next to none. Some frauds/scams hit up many victims for smaller amounts, which total up to large amounts.
Hackers. As David Gerard pointed out, every crypto platform is a crypto pinata…hit it just right, and all the money falls out. Hacks and exploits can steal millions of dollars of cryptos in minutes (fast).

As many fraudsters and hackers are located abroad, they also appreciate the far feature of crypto.

Anonymity

It’s safe to assume that bad actors prefer anonymity in their financial transactions. But even among criminals, some are more concerned about anonymity than others.

For criminals involved in Child Sexual Abuse Material (CSAM) whether vendors/marketplaces or purchasers, anonymity is the key feature they desire in a financial product. These criminals may not need to move funds far, in large amounts, or irreversibly but they do seek anonymity.

A comment by a former CSAM federal prosecutor that has stuck with me is that cryptocurrency has commercialized CSAM. A full exploration of that topic is for another day but Europol reports:

“The monetisation of child sexual abuse material (CSAM) is a growing threat…CSAM is mainly commercialised through dedicated marketplaces and forums on the dark web…Most of the transactions use cryptocurrencies as means of payment.”

Here are a few examples of the CSAM / crypto nexus:

CSAM Crypto

Next, criminals located in the United States may have increased demand for anonymity due to the U.S.’s law enforcement capabilities even if they do not need to move large amounts, far, fast, or irreversibly.

Finally, terrorists and groups considered national security threats by the United States, may also seek anonymity to avoid the US military.

Which Bad Actors “Aren’t That Into” Crypto?

Per FinCEN:

With few exceptions, criminals are motivated by one thing-profit. Greed drives the criminal, and the end result is that illegally-gained money must be introduced into the nation’s legitimate financial systems. Money laundering involves disguising financial assets so they can be used without detection of the illegal activity that produced them. Through money laundering, the criminal transforms the monetary proceeds derived from criminal activity into funds with an apparently legal source.

He's just not that into crypto

No or Little Profit

Some crimes are more profitable than others, and some criminals are better at generating a profit. For example, UNDOC reported that the “income distribution of drug traffickers tends to be extremely uneven, with a few traffickers accounting for the bulk of the drugs sold on the market, and a large number earning just the bare minimum to survive.” Levi and Soudijn note that “if the criminal profit was small to begin with, efforts at concealment become pointless and cost-inefficient.”

If a bad actor is engaged in non-crypto native crimes with a small profit margin, they could lose their profit by laundering via crypto in two ways.

First, there is the cost associated with converting fiat to crypto. If the bad actor deposits cash into a bitcoin ATM, they may face undisclosed fees and bitcoin price mark-ups of 40%. When a criminal uses a crypto exchange, they will pay fees and/or price mark-ups. If the bad actor transacts directly on the blockchain, they will pay transaction fees.

Second, crypto price fluctuations can wipe out profits. Bad actors will also have to worry about hacks, losing their keys, kidnappings, crypto exchange collapses, and other calamities that regularly befall crypto holders.

Hedonists

Certain criminals generate a profit but don’t launder the funds (i.e. introduce the funds into legitimate financial institutions), instead they spend the profits on hedonistic lifestyles. In other words, criminals spend money in strip clubs, casinos, bottle service and personal drug consumption. Therefore, if the criminal is arrested, there may be no assets to seize because they spent the profits on intangibles or consumables, or at best a Lambo.

Nothing to Fear

If you are a criminal engaging in domestic, non-crypto native crimes (ex. illegal logging, prostitution, corruption) and have little fear of your government acting against you or banks blocking you, then crypto’s features may not be worth the added hassle and expense. There are plenty of criminal states, failed states, under-resourced states, and kleptocracies in the world where bad actors don’t need to hide.

Blockchain Analytics Does Not Change Features of Crypto

Blockchain analytics, coupled with examples of law enforcement successfully tracing cryptocurrency across the blockchain may have caused bad actors to change how they use cryptocurrency. That is to be applauded. The days of publicly listing a static bitcoin wallet address to receive illicit funds may be over.

However, blockchain analytics does not change the features of cryptocurrency that are most attractive to bad actors: namely, the ability to move value far, fast, irreversibly…in large amounts. Additionally, when criminals use obfuscation methods, they may evade attribution (anonymity/third party). And criminal proceeds generated off-chain but laundered via crypto are usually not identified by blockchain analytics at all (or only after Law Enforcement publicly lists wallet addresses).

Which Criminals Love Crypto the Most?

In conclusion, the criminals who love crypto need to move large amounts of value far, fast, irreversibly, anonymously, and to a third party. Large, transnational bad actors (including nation-states), need most or all of the features offered by cryptocurrency and therefore embrace cryptocurrency for financial transactions.

_____________________________________