Threat Intelligence

7/3/2018
04:35 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cryptocurrency Theft Drives 3x Increase in Money Laundering

The first half of 2018 saw more cryptocurrency theft than all of 2017 combined, driving a rise in digital money laundering as criminals elude authorities.

Cybercriminals are snatching cryptocurrency like never before, driving a rise in money laundering as they hide their digital funds and evade authorities.

The first half of 2018 saw a threefold increase in cryptocurrency theft compared with the full year of 2017, researchers state in CipherTrace's new "Cryptocurrency Anti-Money Laundering Report" for Q2 2018. Attackers launder digital currencies using a variety of tools and technologies, including mixers, chain hopping, privacy coins, and gambling sites, to name a few.

Much of the rise in theft can be attributed to "old-school" cybercriminals who used to target financial institutions with phishing attacks, ransomware, and malware to steal money and credit card information, explains Dave Jevans, CEO of cryptocurrency startup CipherTrace. Now they're finding new targets to build their illicit fortunes: cryptocurrency exchanges.

But many of the actors snatching digital money are new to cybercrime, Jevans adds.

"We're now seeing, in the last probably eight to 12 months, a real influx of new criminals that are highly technically sophisticated," he explains. There's a major difference between seasoned threat actors and those who have been dabbling in cybercrime for less than 12 months: operational security.

It isn't a question of technical prowess so much as lack of experience, Jevans continues. Cybercrime's newest threat actors can craft advanced malware designed to target cryptocurrency addresses and inject similar addresses, under their control, to receive funds. Their malware is designed to target digital funds in a way traditional malware isn't, created by people who grew up learning about virtual currencies and can exploit them in new ways.

The problems start when they secure the money. Traditional phishers and large-scale malware attackers have learned through trial and error how to conceal illegal activity online. New entrants leave tracks all over the place.

"It's clear these people really understand cryptocurrency and crypto assets really, really well," he explains. "What they don't understand is old-school operational security … they're just not sophisticated that way. Legacy folks, they definitely have better operational security. They're better at how they interface with it, how they distribute malicious code, how they manage user handles on different forums."

However, signs indicate the newest actors are smart enough to learn – and they'll be tougher to pin down once they do.

How Virtual Money Laundering Works
The first step of cryptocurrency laundering is called layering. In traditional money laundering, this would involve buying and reselling expensive goods. In the virtual world, it involves putting funds in the cryptocurrency system and moving them around with mixers or using privacy coins. The more money moves, the harder it is to trace.

Mixers, also called tumblers and foggers, accept coins from several customers and mix them together before reallocating mixed funds. They typically require a 1% to 3% fee and have advanced in recent years to better conceal the money's origin. Now, Jevans says, they keep incoming and outgoing funds completely separate on the blockchain so there's no way to link the two.

The Internet also has 100 to 200 gambling sites that serve as money-laundering tools. Thieves create accounts and transfer funds to be laundered. Some make simple bets; some withdraw funds to a new address without making bets at all. Gambling sites often don't have a "know your customer" regulation, so it's tough for law enforcement to learn where money came from.

Privacy coins like Zcash and Monero don't make up the majority of transactions – most actors prefer bitcoin – but Jevans notes many cybercriminals are adopting them to fly under the radar. However, he anticipates these coins will soon be regulated so they comply with AML regulation.

AML Regulation Crackdown
Regulators are narrowing their focus on anti-money laundering (AML) regulation as virtual currencies are exploited to support malicious activity. The 5th Annual Europol Virtual Currency Conference, which recently took place in the Netherlands, became a place of conversation around how controls will be put into place.

"Where we're seeing it going is toward more global standards," Jevans says. "Trends are definitely toward more clear regulation [that is] easier to follow."

The Office of Foreign Assets Control (OFAC) has a list of people, companies, addresses, bank accounts, and countries that are not allowed to conduct business with the US, and it plans to add cryptocurrency addresses to the list. FinCEN says money transmitters in foreign countries will be held accountable if they violate US AML regulations.

The US Secret Service is taking a closer look at privacy coins, such as Monero and Zcash, and their role in cybercrime while advising Congress to consider additional legislative action. On June 20, the Secret Service claimed to have seized over $28 million in digital currencies in its criminal investigations. Main government branches are allegedly considering new regulations.

Related Content:

 

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
seanmajece
50%
50%
seanmajece,
User Rank: Apprentice
8/2/2018 | 5:48:14 AM
My opinion
I've earned a lot of money because of my crypto currency. So I recommedn you to pay attention on it. 
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
7/8/2018 | 12:15:22 AM
Theft Utilizing Cryptocurrency or Cryptocurrency Theft?
Ross Anderson, Ilia Shumailov and Mansoor Ahmed of the Cambridge University Computer Laboratory wrote a great paper titled "Making Bitcoin Legal". It discusses how "the law might actually regulate bitcoin and other cryptocurrencies so as to provide the benefits, ranging from low-cost international money transfers and decentralised resilient operation to competitive innovation, while mitigating the harms specifically the use of cryptocurrencies in extortion, money laundering and other crimes, and the difficulty that crime victims experience in getting redress." It also illustrates that the "characteristics of a payment protocol can depend much more sensitively than one might expect on the surrounding context."

Having just read that paper it called to mind while reading this article on Dark Reading the importance of clearly defining the difference between "cryptocurrency theft" and "theft utilizing cryptocurrency". This speaks to the "surrounding context" noted in the Cambridge paper. The reason drawing this distinction is important is that the value of and the long-term stability of cryptocurrency "may" depend on percentages of coin that are considered "clean". While laundering stolen goods and stolen cryptocurrency through legal transactions is on the rise, there is a difference between weighing the validity of clean coins used in illegal transactions (selling stolen goods) and coin "made clean" through "laundering" stolen cryptocurrency. There are algorithms out there, by the way, to track cryptocurrency through the blockchain, so stolen coin assets are very traceable.

Regardless, this article notes some important facts but to someone not knowledgeable in the basics of cryptocurrency, there might be some confusion as to where in the crime the cryptocurrency sits, and to what extent the coin used in the crime is clean or dirty. Also, it is important to note that just because some cybercriminals are more sophisticated than newer ones who "leave tracks all over the place", it doesn't mean the tech behind cryptocurrency changes; again, coin can be traced and no matter how deep the laundering or the transaction hops, reaching back to the source can still be accomplished. It's all a matter of time in some cases. Regulation seeks to draw clear distinctions and in Europe there are strides that America needs to catch up on and start looking to implement.

Great article - we need more discussion in this area and in plain language that makes the cryptocurrency ecosystem easy to understand to the layperson.     

 
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Turn the NIST Cybersecurity Framework into Reality: 4 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1674
PUBLISHED: 2018-09-20
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109.
CVE-2018-1800
PUBLISHED: 2018-09-20
IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a short time period when installation is occuring. IBM X-Force ID: 149607.
CVE-2018-3864
PUBLISHED: 2018-09-20
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long &quot...
CVE-2018-3865
PUBLISHED: 2018-09-20
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long &quot...
CVE-2018-17254
PUBLISHED: 2018-09-20
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.