Threat Intelligence

7/3/2018
04:35 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cryptocurrency Theft Drives 3x Increase in Money Laundering

The first half of 2018 saw more cryptocurrency theft than all of 2017 combined, driving a rise in digital money laundering as criminals elude authorities.

Cybercriminals are snatching cryptocurrency like never before, driving a rise in money laundering as they hide their digital funds and evade authorities.

The first half of 2018 saw a threefold increase in cryptocurrency theft compared with the full year of 2017, researchers state in CipherTrace's new "Cryptocurrency Anti-Money Laundering Report" for Q2 2018. Attackers launder digital currencies using a variety of tools and technologies, including mixers, chain hopping, privacy coins, and gambling sites, to name a few.

Much of the rise in theft can be attributed to "old-school" cybercriminals who used to target financial institutions with phishing attacks, ransomware, and malware to steal money and credit card information, explains Dave Jevans, CEO of cryptocurrency startup CipherTrace. Now they're finding new targets to build their illicit fortunes: cryptocurrency exchanges.

But many of the actors snatching digital money are new to cybercrime, Jevans adds.

"We're now seeing, in the last probably eight to 12 months, a real influx of new criminals that are highly technically sophisticated," he explains. There's a major difference between seasoned threat actors and those who have been dabbling in cybercrime for less than 12 months: operational security.

It isn't a question of technical prowess so much as lack of experience, Jevans continues. Cybercrime's newest threat actors can craft advanced malware designed to target cryptocurrency addresses and inject similar addresses, under their control, to receive funds. Their malware is designed to target digital funds in a way traditional malware isn't, created by people who grew up learning about virtual currencies and can exploit them in new ways.

The problems start when they secure the money. Traditional phishers and large-scale malware attackers have learned through trial and error how to conceal illegal activity online. New entrants leave tracks all over the place.

"It's clear these people really understand cryptocurrency and crypto assets really, really well," he explains. "What they don't understand is old-school operational security … they're just not sophisticated that way. Legacy folks, they definitely have better operational security. They're better at how they interface with it, how they distribute malicious code, how they manage user handles on different forums."

However, signs indicate the newest actors are smart enough to learn – and they'll be tougher to pin down once they do.

How Virtual Money Laundering Works
The first step of cryptocurrency laundering is called layering. In traditional money laundering, this would involve buying and reselling expensive goods. In the virtual world, it involves putting funds in the cryptocurrency system and moving them around with mixers or using privacy coins. The more money moves, the harder it is to trace.

Mixers, also called tumblers and foggers, accept coins from several customers and mix them together before reallocating mixed funds. They typically require a 1% to 3% fee and have advanced in recent years to better conceal the money's origin. Now, Jevans says, they keep incoming and outgoing funds completely separate on the blockchain so there's no way to link the two.

The Internet also has 100 to 200 gambling sites that serve as money-laundering tools. Thieves create accounts and transfer funds to be laundered. Some make simple bets; some withdraw funds to a new address without making bets at all. Gambling sites often don't have a "know your customer" regulation, so it's tough for law enforcement to learn where money came from.

Privacy coins like Zcash and Monero don't make up the majority of transactions – most actors prefer bitcoin – but Jevans notes many cybercriminals are adopting them to fly under the radar. However, he anticipates these coins will soon be regulated so they comply with AML regulation.

AML Regulation Crackdown
Regulators are narrowing their focus on anti-money laundering (AML) regulation as virtual currencies are exploited to support malicious activity. The 5th Annual Europol Virtual Currency Conference, which recently took place in the Netherlands, became a place of conversation around how controls will be put into place.

"Where we're seeing it going is toward more global standards," Jevans says. "Trends are definitely toward more clear regulation [that is] easier to follow."

The Office of Foreign Assets Control (OFAC) has a list of people, companies, addresses, bank accounts, and countries that are not allowed to conduct business with the US, and it plans to add cryptocurrency addresses to the list. FinCEN says money transmitters in foreign countries will be held accountable if they violate US AML regulations.

The US Secret Service is taking a closer look at privacy coins, such as Monero and Zcash, and their role in cybercrime while advising Congress to consider additional legislative action. On June 20, the Secret Service claimed to have seized over $28 million in digital currencies in its criminal investigations. Main government branches are allegedly considering new regulations.

Related Content:

 

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
7/8/2018 | 12:15:22 AM
Theft Utilizing Cryptocurrency or Cryptocurrency Theft?
Ross Anderson, Ilia Shumailov and Mansoor Ahmed of the Cambridge University Computer Laboratory wrote a great paper titled "Making Bitcoin Legal". It discusses how "the law might actually regulate bitcoin and other cryptocurrencies so as to provide the benefits, ranging from low-cost international money transfers and decentralised resilient operation to competitive innovation, while mitigating the harms specifically the use of cryptocurrencies in extortion, money laundering and other crimes, and the difficulty that crime victims experience in getting redress." It also illustrates that the "characteristics of a payment protocol can depend much more sensitively than one might expect on the surrounding context."

Having just read that paper it called to mind while reading this article on Dark Reading the importance of clearly defining the difference between "cryptocurrency theft" and "theft utilizing cryptocurrency". This speaks to the "surrounding context" noted in the Cambridge paper. The reason drawing this distinction is important is that the value of and the long-term stability of cryptocurrency "may" depend on percentages of coin that are considered "clean". While laundering stolen goods and stolen cryptocurrency through legal transactions is on the rise, there is a difference between weighing the validity of clean coins used in illegal transactions (selling stolen goods) and coin "made clean" through "laundering" stolen cryptocurrency. There are algorithms out there, by the way, to track cryptocurrency through the blockchain, so stolen coin assets are very traceable.

Regardless, this article notes some important facts but to someone not knowledgeable in the basics of cryptocurrency, there might be some confusion as to where in the crime the cryptocurrency sits, and to what extent the coin used in the crime is clean or dirty. Also, it is important to note that just because some cybercriminals are more sophisticated than newer ones who "leave tracks all over the place", it doesn't mean the tech behind cryptocurrency changes; again, coin can be traced and no matter how deep the laundering or the transaction hops, reaching back to the source can still be accomplished. It's all a matter of time in some cases. Regulation seeks to draw clear distinctions and in Europe there are strides that America needs to catch up on and start looking to implement.

Great article - we need more discussion in this area and in plain language that makes the cryptocurrency ecosystem easy to understand to the layperson.     

 
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Locked device, Ha! I knew there was another way in.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10886
PUBLISHED: 2018-07-16
ant before version 1.9.12 unzip and untar targets allows the extraction of files outside the target directory. A crafted zip or tar file submitted to an Ant build could create or overwrite arbitrary files with the privileges of the user running Ant.
CVE-2018-10859
PUBLISHED: 2018-07-16
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex
CVE-2018-14324
PUBLISHED: 2018-07-16
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a &q...
CVE-2018-14325
PUBLISHED: 2018-07-16
In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp.
CVE-2018-14326
PUBLISHED: 2018-07-16
In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.