5 ms·

"He was taken aback by what he saw: Many of this child abuse site’s users—and, by all appearances, its administrators—had done almost nothing to obscure their c

"He was taken aback by what he saw: Many of this child abuse site’s users—and, by all appearances, its administrators—had done almost nothing to obscure their cryptocurrency trails. An entire network of criminal payments, all intended to be secret, was laid bare before him." It is a weird story. On the one end, anyone using crypto by now should know, there is a trail following it ( there are means to obscure it, but a lot of ways to screw up too ). On the other, does that mean this investigation was a low hanging fruit?

colechristensen 5y ago
In order to use crypto secretly you have to heavily launder your money in a way that’s not easy or guaranteed to work.. and the laundering itself is a crime which isn’t so easy to hide. People think it’s private because they are told so but actually it’s a public ledger where anyone can see what you’ve spent and associate you fairly easily by your behavior and links to not so secret crypto addresses.
- lmeyerov 5y ago
  We've been getting increasingly involved in crypto investigation discussions, and largely: - money side is getting more anonymous, e.g., monero / tornado - ... in theory. Money crime still often using less anonymous schemes and often at exchange points, so chainanalysis-style companies still make sense, though decreasingly so IMO. A lot of the startups have shifted to verifying contracts, or providing (dubious) KYC risk scores, and interesting to consider why. - For our customer base (half of which are sec/fraud/crime teams)... what's happening is the criminal platforms + participants have broken (digital) operational security. So it is more about offchain data (app logs, ...) and sometimes combining onchain<>offchain data. So not too different from our projects tracking malware/phishing/misinformation/etc via OSINT techniques (IP addresses, unmasked metadata, ...), or detecting account takeovers on their websites - ... more new, IMO, in this space is areas like graph neural networks that have the potential to act smarter & more automatically, e.g., understanding behavior. Very early days here though, so interesting times !
- ksksks1 5y ago
  Not really. You buy mining resources to mine it as opposed to purchasing already mined bitcoin. There’s rarely any paper trail between buying GPUs/ASICs and the mining itself. That’s why these currently sell above the amount they’d be profitable mining with. Because illicit actors are willing to pay a premium for anonymous crypto.
  - colinmhayes 5y ago
    Where can you buy GPUs/ASICs with crypto? Or are you just talking about the buyers? If the sellers get spooked I'm not sure it matters if buyers are safe.
- ls15 5y ago
  > In order to use crypto secretly you have to heavily launder your money in a way that’s not easy or guaranteed to work.. and the laundering itself is a crime which isn’t so easy to hide. Or you use Monero, which as far as I know is not illegal, let alone a crime.
cdumler 5y ago
My experience with friends in law enforcement is that what defines the majority criminals is a lack of understanding of risk. That lack creates a strong sense of "I know how to get away with this." I remember a story of a guy being busted who ran a business, bought his $500k house in cash, his half dozen trucks in cash, and yet paid almost nothing in taxes. The thought was, "I'll under-report my income, and pay everything all in cash so they can't trace anything!" Except for the fact that transactions over $10K get reported to the IRS, not to mention all of the property to various agencies which circle back to the IRS. People who have a least a clue what could go wrong tend to also realize they probably aren't seeing other ways for it go wrong, as well.
- throwawayboise 5y ago
  Bank transactions over 10K get reported. If I roll into my local Chevy dealer and buy a $75,000 truck for cash, does that get reported?
  - rootusrootus 5y ago
    > does that get reported? Yes, absolutely. The same law that provides for banks reporting deposits and withdrawals over $10K also puts similar requirements on retail establishments that accept payments that large.
    - notch656a 5y ago
      Although in practice they're probably buying a $9k salvage truck in cash, then paying mechanics in cash to fix it up to be a $75k truck. The same thing happens with houses. Someone buys an absolute dumpster fire in cash. Then they pay contractors to fix it up nice, beautiful appliances, tiling etc. The house gets sold and the money ends up all in the white.
  - meetups323 5y ago
    What do you think Chevy is doing with that 75k besides putting it in a bank of some sort?
x86_64Ubuntu 5y ago
I don't think it was low-hanging at the time (2017). They had to figure out how to trace the bitcoin chain to unmask users. They also had to cast a wide international net with different jurisdictions and rules to get the people arrested by their locality. Now having a clearnet IP address over Tor website, as well as converting straight to fiat using standard exchanges is about as low-hanging as it gets.

colechristensen 5y ago

In order to use crypto secretly you have to heavily launder your money in a way that’s not easy or guaranteed to work.. and the laundering itself is a crime which isn’t so easy to hide. People think it’s private because they are told so but actually it’s a public ledger where anyone can see what you’ve spent and associate you fairly easily by your behavior and links to not so secret crypto addresses.

lmeyerov 5y ago
We've been getting increasingly involved in crypto investigation discussions, and largely: - money side is getting more anonymous, e.g., monero / tornado - ... in theory. Money crime still often using less anonymous schemes and often at exchange points, so chainanalysis-style companies still make sense, though decreasingly so IMO. A lot of the startups have shifted to verifying contracts, or providing (dubious) KYC risk scores, and interesting to consider why. - For our customer base (half of which are sec/fraud/crime teams)... what's happening is the criminal platforms + participants have broken (digital) operational security. So it is more about offchain data (app logs, ...) and sometimes combining onchain<>offchain data. So not too different from our projects tracking malware/phishing/misinformation/etc via OSINT techniques (IP addresses, unmasked metadata, ...), or detecting account takeovers on their websites - ... more new, IMO, in this space is areas like graph neural networks that have the potential to act smarter & more automatically, e.g., understanding behavior. Very early days here though, so interesting times !
ksksks1 5y ago
Not really. You buy mining resources to mine it as opposed to purchasing already mined bitcoin. There’s rarely any paper trail between buying GPUs/ASICs and the mining itself. That’s why these currently sell above the amount they’d be profitable mining with. Because illicit actors are willing to pay a premium for anonymous crypto.
- colinmhayes 5y ago
  Where can you buy GPUs/ASICs with crypto? Or are you just talking about the buyers? If the sellers get spooked I'm not sure it matters if buyers are safe.
ls15 5y ago
> In order to use crypto secretly you have to heavily launder your money in a way that’s not easy or guaranteed to work.. and the laundering itself is a crime which isn’t so easy to hide. Or you use Monero, which as far as I know is not illegal, let alone a crime.

cdumler 5y ago

My experience with friends in law enforcement is that what defines the majority criminals is a lack of understanding of risk. That lack creates a strong sense of "I know how to get away with this." I remember a story of a guy being busted who ran a business, bought his $500k house in cash, his half dozen trucks in cash, and yet paid almost nothing in taxes. The thought was, "I'll under-report my income, and pay everything all in cash so they can't trace anything!" Except for the fact that transactions over $10K get reported to the IRS, not to mention all of the property to various agencies which circle back to the IRS. People who have a least a clue what could go wrong tend to also realize they probably aren't seeing other ways for it go wrong, as well.

throwawayboise 5y ago
Bank transactions over 10K get reported. If I roll into my local Chevy dealer and buy a $75,000 truck for cash, does that get reported?
- rootusrootus 5y ago
  > does that get reported? Yes, absolutely. The same law that provides for banks reporting deposits and withdrawals over $10K also puts similar requirements on retail establishments that accept payments that large.
  - notch656a 5y ago
    Although in practice they're probably buying a $9k salvage truck in cash, then paying mechanics in cash to fix it up to be a $75k truck. The same thing happens with houses. Someone buys an absolute dumpster fire in cash. Then they pay contractors to fix it up nice, beautiful appliances, tiling etc. The house gets sold and the money ends up all in the white.
- meetups323 5y ago
  What do you think Chevy is doing with that 75k besides putting it in a bank of some sort?

x86_64Ubuntu 5y ago

I don't think it was low-hanging at the time (2017). They had to figure out how to trace the bitcoin chain to unmask users. They also had to cast a wide international net with different jurisdictions and rules to get the people arrested by their locality. Now having a clearnet IP address over Tor website, as well as converting straight to fiat using standard exchanges is about as low-hanging as it gets.