8 ms·

So how does one launder a half-billion dollar heist like this? Asking for a friend.

by yborg 4y ago

ZiiS 4y ago
In a non-fiat system why would you need to?
- Railsify 4y ago
  To get a currency that you can pay taxes with, or buy traditional securities.
- toss1 4y ago
  If it is totally non-fiat, where you can buy housing, food, fuel, devices, luxury items, etc., etc., etc., you would not need to cash out to fiat. But seriously, in the current world, if we have a half-billion dollars "worth" of legitimate (or laundered) cryptocurrency, what can you do with it in the real world, especially contrasted to what we can do easily if we have a $$half-billion in legit $, €, £, or ¥ deposits? I don't think we could even buy a Tesla or a pizza anymore. Maybe some things on Craigslist that take crypto?
  - maupin 4y ago
    A quick Google search finds that (it is claimed anyway) you can buy quite a few items from Amazon or Walmart at shopping.io
  - from 4y ago
    Go on Alibaba and you will find that a surprising number of companies take BTC or USDT. The next step in the laundering process is fairly obvious.
intunderflow 4y ago
I would assume they'll try and push as much value into a currency that's meant to be untraceable (such as Monero or Zcash), move the money around a few wallets for safety, then start drip feeding to exchanges and claiming they got into the currency early by mining and are cashing out. At least if I was going to risk a heist like this it's roughly what I would do.
jrm4 4y ago
Tornado Cash might work here; it's a so-called "smart contract" (worst named things ever) that's designed precisely for this.
ynbl_ 4y ago
muttled 4y ago
Even if you manage to hide your tracks digitally on the chains, you still have millions of dollars you have to get out of a KYC off-ramp. You could possibly setup some sort of web service that offers something for crypto, but you'd have to believably falsify tons of customers and what you sold them. Again, this is assuming you've managed to perfectly hide the digital tracks and there's not an aggregated clear migration of the flow between the stolen funds and amounts ending in your account. Shady art and real estate deals are used in "real life", so maybe you could have some sort of NFT or metaverse thing going on. It'd be very difficult to pull off even over a long period of time, and you'd have a lot of people from all walks of life watching those funds, waiting for you to make a single mistake.
- paulpauper 4y ago
  tornado cash, cross chain , etc. plenty of ways to evade tracking
- logicchains 4y ago
  >you still have millions of dollars you have to get out of a KYC off-ramp. Come to Dubai, buy some mansions with crypto (some real estate developers accept crypto), sell those mansions for USD, and voila.
paulpauper 4y ago
If they are smart enough to pull this off, they are probably smart enough launder it. And you don't need to launder all of it. Just $20 million is enough to live like a king for the rest of your life.
- from 4y ago
  The Bitfinex hack shows that this is not always the case. I get the impression that the two nitwits did the hack perfectly but just assumed that mixing with alphabay would be enough. Then they transferred BTC into exchange accounts under their real names.
from 4y ago
1. Deposit to Tornado Cash using a script 2. Wait a year 3. Withdraw in batches (not all at once) 4. Move to Dubai 5. Find some sketchy guys who charge ~20-30% to go crypto -> wire transfer and don’t care about source of funds 6. Work with those guys to come up with documentation to placate compliance officers This may not work forever because Dubai is probably going to have a big crackdown due to getting put on the FATF greylist. This also works in some Eastern European countries.
- hey2022 4y ago
  I thought Tornado Cash already spits out untraceable crypto. So it's not enough to use a mixer? Would you not be able to slowly withdraw from Tornado Cash and just exchange for fiat?
  - from 4y ago
    Imagine you steal 10,500 ETH. Then you deposit it into Tornado Cash. Then a year later a new address withdraws exactly 10,500 ETH from Tornado Cash (100 ETH at a time). That would look pretty suspicious. Exactly you should slowly withdraw from Tornado. But you cannot use companies like Coinbase Gemini et al because they will ask about source of funds after a certain amount which you obviously do not want to reveal and coins that pass through Tornado are tainted now due to Tornado getting put on the OFAC list so they may freeze your accounts. So that’s where the sketchy people come in.
    - paulpauper 4y ago
      all you need is plausible deniability . If the govt. cannot prove you stole, then they cannot just prosecute you for using tornado cash (as far as the US is concered). Of course, exchanges may refuse to accept your coins if they are tied to tornado cash.
      - from 4y ago
        Any US person who has interacted with Tornado Cash after the OFAC designation has commited a felony (IEEPA violation). That means all funds tracable to it can be subject to forfeiture, and if you are directly receiving amounts of money from Tornado that substantially exceed your income for the past couple years you make the governments forfeiture case even easier. You are right that they may not be able to charge you with the initial crime. That is why you would want to leave the US for a jurisdiction that doesn’t care about those kind of things and work with people who aren’t regulated.
dzdt 4y ago
Create NFT's with your real identity that can pass bank KYC and sell them for huge amounts of tumbled crypto to your hacker identity.

So how does one launder a half-billion dollar heist like this? Asking for a friend.

by yborg 4y ago

So how does one launder a half-billion dollar heist like this? Asking for a friend.

ZiiS 4y ago

In a non-fiat system why would you need to?

Railsify 4y ago
To get a currency that you can pay taxes with, or buy traditional securities.
toss1 4y ago
If it is totally non-fiat, where you can buy housing, food, fuel, devices, luxury items, etc., etc., etc., you would not need to cash out to fiat. But seriously, in the current world, if we have a half-billion dollars "worth" of legitimate (or laundered) cryptocurrency, what can you do with it in the real world, especially contrasted to what we can do easily if we have a $$half-billion in legit $, €, £, or ¥ deposits? I don't think we could even buy a Tesla or a pizza anymore. Maybe some things on Craigslist that take crypto?
- maupin 4y ago
  A quick Google search finds that (it is claimed anyway) you can buy quite a few items from Amazon or Walmart at shopping.io
- from 4y ago
  Go on Alibaba and you will find that a surprising number of companies take BTC or USDT. The next step in the laundering process is fairly obvious.

intunderflow 4y ago

I would assume they'll try and push as much value into a currency that's meant to be untraceable (such as Monero or Zcash), move the money around a few wallets for safety, then start drip feeding to exchanges and claiming they got into the currency early by mining and are cashing out. At least if I was going to risk a heist like this it's roughly what I would do.

jrm4 4y ago

Tornado Cash might work here; it's a so-called "smart contract" (worst named things ever) that's designed precisely for this.

ynbl_ 4y ago

muttled 4y ago

Even if you manage to hide your tracks digitally on the chains, you still have millions of dollars you have to get out of a KYC off-ramp. You could possibly setup some sort of web service that offers something for crypto, but you'd have to believably falsify tons of customers and what you sold them. Again, this is assuming you've managed to perfectly hide the digital tracks and there's not an aggregated clear migration of the flow between the stolen funds and amounts ending in your account. Shady art and real estate deals are used in "real life", so maybe you could have some sort of NFT or metaverse thing going on. It'd be very difficult to pull off even over a long period of time, and you'd have a lot of people from all walks of life watching those funds, waiting for you to make a single mistake.

paulpauper 4y ago
tornado cash, cross chain , etc. plenty of ways to evade tracking
logicchains 4y ago
>you still have millions of dollars you have to get out of a KYC off-ramp. Come to Dubai, buy some mansions with crypto (some real estate developers accept crypto), sell those mansions for USD, and voila.

paulpauper 4y ago

If they are smart enough to pull this off, they are probably smart enough launder it. And you don't need to launder all of it. Just $20 million is enough to live like a king for the rest of your life.

from 4y ago
The Bitfinex hack shows that this is not always the case. I get the impression that the two nitwits did the hack perfectly but just assumed that mixing with alphabay would be enough. Then they transferred BTC into exchange accounts under their real names.

from 4y ago

1. Deposit to Tornado Cash using a script 2. Wait a year 3. Withdraw in batches (not all at once) 4. Move to Dubai 5. Find some sketchy guys who charge ~20-30% to go crypto -> wire transfer and don’t care about source of funds 6. Work with those guys to come up with documentation to placate compliance officers This may not work forever because Dubai is probably going to have a big crackdown due to getting put on the FATF greylist. This also works in some Eastern European countries.

hey2022 4y ago
I thought Tornado Cash already spits out untraceable crypto. So it's not enough to use a mixer? Would you not be able to slowly withdraw from Tornado Cash and just exchange for fiat?
- from 4y ago
  Imagine you steal 10,500 ETH. Then you deposit it into Tornado Cash. Then a year later a new address withdraws exactly 10,500 ETH from Tornado Cash (100 ETH at a time). That would look pretty suspicious. Exactly you should slowly withdraw from Tornado. But you cannot use companies like Coinbase Gemini et al because they will ask about source of funds after a certain amount which you obviously do not want to reveal and coins that pass through Tornado are tainted now due to Tornado getting put on the OFAC list so they may freeze your accounts. So that’s where the sketchy people come in.
  - paulpauper 4y ago
    all you need is plausible deniability . If the govt. cannot prove you stole, then they cannot just prosecute you for using tornado cash (as far as the US is concered). Of course, exchanges may refuse to accept your coins if they are tied to tornado cash.
    - from 4y ago
      Any US person who has interacted with Tornado Cash after the OFAC designation has commited a felony (IEEPA violation). That means all funds tracable to it can be subject to forfeiture, and if you are directly receiving amounts of money from Tornado that substantially exceed your income for the past couple years you make the governments forfeiture case even easier. You are right that they may not be able to charge you with the initial crime. That is why you would want to leave the US for a jurisdiction that doesn’t care about those kind of things and work with people who aren’t regulated.

dzdt 4y ago

Create NFT's with your real identity that can pass bank KYC and sell them for huge amounts of tumbled crypto to your hacker identity.