4 ms·

This is the tweet that ties the rise of ransomware to crypto anonymity: 1) Receive ETH tied to crime 2) Send to tornado.cash 3) Withdraw from tornado.cash 4

by gabaix 5y ago

This is the tweet that ties the rise of ransomware to crypto anonymity: 1) Receive ETH tied to crime 2) Send to tornado.cash 3) Withdraw from tornado.cash 4) Now you have clean ETH in a fresh wallet not tied to identity 5) Use a DeFi non-KYC exchange to swap for another token 6) Use KYC exchange to swap token for dollars/euros (https://twitter.com/smdiehl/status/1395686872400211973?s=21 https://twitter.com/smdiehl/status/1395686872400211973?s=21) Can anyone confirm that this method truly anonymize? If so, what can the US government do to prevent anonymization? Will it work, meaning it would make extortion significantly harder?

yuvadam 5y ago
As someone who has went through way too many KYC/AML dances, this method means nothing. The moment you try to pocket fiat into a regulated bank or exchange, they will look at the entire chain of transactions. Mixers are a red flag. Unregulated exchanges are a red flag. There is no way in hell those funds are laundered back into the existing banking system.
- fumblebee 5y ago
  Red flags don't mean much. Building AML models is hard, and often yield an overwhelming number of false positives that arise from an over-reliance on those indicators. Sure, a positive prediction might lead to a SAR, but unfortunately that doesn't mean much either. In the majority of cases it will lead to the customer being off-boarded, in which case they'll simply go to another bank with more lacklustre controls. A SAR won't lead to a prosecution unless it sparks a new case in law enforcement (rare due to resource constraints), or whether it supports part of an ongoing case. Sadly, that money will probably be laundered.
- spraynpray 5y ago
  To elaborate on this, tornado.cash actually gives you a cryptographic proof of the transaction, which allows you to reveal the origin of the funds to whoever you choose. So an obvious regulatory alternative to the nuclear option would be to require to reveal the origin to the authorities upon request. On a more general note, this is one example of how engineering solves the OPs point of criticism, but it requires some research/education. Ofc someone could fork tornado.cash and not hand out these cryptographic proofs, but I would assume that this clone would not find consensus/acceptance with an informed general public. An informed general public will also not accept prediction markets without a consensus model that prevents paid hits (all of the ones I know [augur, gnosis] include functionality to prevent evil stuff like this), just as an informed general public will not agree to trade on a system that gives carte blanche to criminals.
- stevehawk 5y ago
  OTOH, it seems like the US perpetually leaves loopholes in its banking regulations that allow for money laundering if you're a big enough bank customer. https://www.cbsnews.com/news/bank-scandal-2020-2-trillion-transaction-suspected-illegal-activity-money-laundering/ https://www.cbsnews.com/news/bank-scandal-2020-2-trillion-tr...
- tim333 5y ago
  I've made reasonably large crypto profits and returned them to the existing banking system and no questions were asked to the source of the profits although they knew who I was naturally. If you go to say Kraken, change fiat to Bitcoin, send it to say Bitmex, speculate and reverse the process it's quite hard for them to say if you got luck speculating or topped up your account with dirty money. And I imagine the criminals use places much less fussy than Kraken which is US regulated.
dangerface 5y ago
Don't think this works unless you use an anonymous crypto like zcash even then can be tracked but much harder. I dunno how much any of it matters tbh when you use your KYC exchange to finally cash out they will just ask you to prove where you got the money or no cash for you.
QK115 5y ago
This doesn't work as written. For example, if you make 5 deposits of 1 ETH from an account that action is public. If you then make 5 withdrawals of 1 ETH into another account that is also public. Without a lot of extra work in between 2) and 3) it's trivial to see that an amount goes into the pot and then that amount comes out of the pot and link them. Even if the direct link between them is encrypted. Besides, anonymity doesn't mean laundering. Laundering is about creating a seemingly legit source of bad money. If an exchange follows the source of the funds and sees tornado.cash, they're going to know something is up, even if they can't see the inputs.

by gabaix 5y ago

yuvadam 5y ago

As someone who has went through way too many KYC/AML dances, this method means nothing. The moment you try to pocket fiat into a regulated bank or exchange, they will look at the entire chain of transactions. Mixers are a red flag. Unregulated exchanges are a red flag. There is no way in hell those funds are laundered back into the existing banking system.

fumblebee 5y ago
Red flags don't mean much. Building AML models is hard, and often yield an overwhelming number of false positives that arise from an over-reliance on those indicators. Sure, a positive prediction might lead to a SAR, but unfortunately that doesn't mean much either. In the majority of cases it will lead to the customer being off-boarded, in which case they'll simply go to another bank with more lacklustre controls. A SAR won't lead to a prosecution unless it sparks a new case in law enforcement (rare due to resource constraints), or whether it supports part of an ongoing case. Sadly, that money will probably be laundered.
spraynpray 5y ago
To elaborate on this, tornado.cash actually gives you a cryptographic proof of the transaction, which allows you to reveal the origin of the funds to whoever you choose. So an obvious regulatory alternative to the nuclear option would be to require to reveal the origin to the authorities upon request. On a more general note, this is one example of how engineering solves the OPs point of criticism, but it requires some research/education. Ofc someone could fork tornado.cash and not hand out these cryptographic proofs, but I would assume that this clone would not find consensus/acceptance with an informed general public. An informed general public will also not accept prediction markets without a consensus model that prevents paid hits (all of the ones I know [augur, gnosis] include functionality to prevent evil stuff like this), just as an informed general public will not agree to trade on a system that gives carte blanche to criminals.
stevehawk 5y ago
OTOH, it seems like the US perpetually leaves loopholes in its banking regulations that allow for money laundering if you're a big enough bank customer. https://www.cbsnews.com/news/bank-scandal-2020-2-trillion-transaction-suspected-illegal-activity-money-laundering/ https://www.cbsnews.com/news/bank-scandal-2020-2-trillion-tr...
tim333 5y ago
I've made reasonably large crypto profits and returned them to the existing banking system and no questions were asked to the source of the profits although they knew who I was naturally. If you go to say Kraken, change fiat to Bitcoin, send it to say Bitmex, speculate and reverse the process it's quite hard for them to say if you got luck speculating or topped up your account with dirty money. And I imagine the criminals use places much less fussy than Kraken which is US regulated.

dangerface 5y ago

Don't think this works unless you use an anonymous crypto like zcash even then can be tracked but much harder. I dunno how much any of it matters tbh when you use your KYC exchange to finally cash out they will just ask you to prove where you got the money or no cash for you.

QK115 5y ago

This doesn't work as written. For example, if you make 5 deposits of 1 ETH from an account that action is public. If you then make 5 withdrawals of 1 ETH into another account that is also public. Without a lot of extra work in between 2) and 3) it's trivial to see that an amount goes into the pot and then that amount comes out of the pot and link them. Even if the direct link between them is encrypted. Besides, anonymity doesn't mean laundering. Laundering is about creating a seemingly legit source of bad money. If an exchange follows the source of the funds and sees tornado.cash, they're going to know something is up, even if they can't see the inputs.