Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

7/3/2018
04:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Cryptocurrency Theft Drives 3x Increase in Money Laundering

The first half of 2018 saw more cryptocurrency theft than all of 2017 combined, driving a rise in digital money laundering as criminals elude authorities.

Cybercriminals are snatching cryptocurrency like never before, driving a rise in money laundering as they hide their digital funds and evade authorities.

The first half of 2018 saw a threefold increase in cryptocurrency theft compared with the full year of 2017, researchers state in CipherTrace's new "Cryptocurrency Anti-Money Laundering Report" for Q2 2018. Attackers launder digital currencies using a variety of tools and technologies, including mixers, chain hopping, privacy coins, and gambling sites, to name a few.

Much of the rise in theft can be attributed to "old-school" cybercriminals who used to target financial institutions with phishing attacks, ransomware, and malware to steal money and credit card information, explains Dave Jevans, CEO of cryptocurrency startup CipherTrace. Now they're finding new targets to build their illicit fortunes: cryptocurrency exchanges.

But many of the actors snatching digital money are new to cybercrime, Jevans adds.

"We're now seeing, in the last probably eight to 12 months, a real influx of new criminals that are highly technically sophisticated," he explains. There's a major difference between seasoned threat actors and those who have been dabbling in cybercrime for less than 12 months: operational security.

It isn't a question of technical prowess so much as lack of experience, Jevans continues. Cybercrime's newest threat actors can craft advanced malware designed to target cryptocurrency addresses and inject similar addresses, under their control, to receive funds. Their malware is designed to target digital funds in a way traditional malware isn't, created by people who grew up learning about virtual currencies and can exploit them in new ways.

The problems start when they secure the money. Traditional phishers and large-scale malware attackers have learned through trial and error how to conceal illegal activity online. New entrants leave tracks all over the place.

"It's clear these people really understand cryptocurrency and crypto assets really, really well," he explains. "What they don't understand is old-school operational security … they're just not sophisticated that way. Legacy folks, they definitely have better operational security. They're better at how they interface with it, how they distribute malicious code, how they manage user handles on different forums."

However, signs indicate the newest actors are smart enough to learn – and they'll be tougher to pin down once they do.

How Virtual Money Laundering Works
The first step of cryptocurrency laundering is called layering. In traditional money laundering, this would involve buying and reselling expensive goods. In the virtual world, it involves putting funds in the cryptocurrency system and moving them around with mixers or using privacy coins. The more money moves, the harder it is to trace.

Mixers, also called tumblers and foggers, accept coins from several customers and mix them together before reallocating mixed funds. They typically require a 1% to 3% fee and have advanced in recent years to better conceal the money's origin. Now, Jevans says, they keep incoming and outgoing funds completely separate on the blockchain so there's no way to link the two.

The Internet also has 100 to 200 gambling sites that serve as money-laundering tools. Thieves create accounts and transfer funds to be laundered. Some make simple bets; some withdraw funds to a new address without making bets at all. Gambling sites often don't have a "know your customer" regulation, so it's tough for law enforcement to learn where money came from.

Privacy coins like Zcash and Monero don't make up the majority of transactions – most actors prefer bitcoin – but Jevans notes many cybercriminals are adopting them to fly under the radar. However, he anticipates these coins will soon be regulated so they comply with AML regulation.

AML Regulation Crackdown
Regulators are narrowing their focus on anti-money laundering (AML) regulation as virtual currencies are exploited to support malicious activity. The 5th Annual Europol Virtual Currency Conference, which recently took place in the Netherlands, became a place of conversation around how controls will be put into place.

"Where we're seeing it going is toward more global standards," Jevans says. "Trends are definitely toward more clear regulation [that is] easier to follow."

The Office of Foreign Assets Control (OFAC) has a list of people, companies, addresses, bank accounts, and countries that are not allowed to conduct business with the US, and it plans to add cryptocurrency addresses to the list. FinCEN says money transmitters in foreign countries will be held accountable if they violate US AML regulations.

The US Secret Service is taking a closer look at privacy coins, such as Monero and Zcash, and their role in cybercrime while advising Congress to consider additional legislative action. On June 20, the Secret Service claimed to have seized over $28 million in digital currencies in its criminal investigations. Main government branches are allegedly considering new regulations.

Related Content:

 

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
seanmajece
50%
50%
seanmajece,
User Rank: Apprentice
8/2/2018 | 5:48:14 AM
My opinion
I've earned a lot of money because of my crypto currency. So I recommedn you to pay attention on it. 
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
7/8/2018 | 12:15:22 AM
Theft Utilizing Cryptocurrency or Cryptocurrency Theft?
Ross Anderson, Ilia Shumailov and Mansoor Ahmed of the Cambridge University Computer Laboratory wrote a great paper titled "Making Bitcoin Legal". It discusses how "the law might actually regulate bitcoin and other cryptocurrencies so as to provide the benefits, ranging from low-cost international money transfers and decentralised resilient operation to competitive innovation, while mitigating the harms specifically the use of cryptocurrencies in extortion, money laundering and other crimes, and the difficulty that crime victims experience in getting redress." It also illustrates that the "characteristics of a payment protocol can depend much more sensitively than one might expect on the surrounding context."

Having just read that paper it called to mind while reading this article on Dark Reading the importance of clearly defining the difference between "cryptocurrency theft" and "theft utilizing cryptocurrency". This speaks to the "surrounding context" noted in the Cambridge paper. The reason drawing this distinction is important is that the value of and the long-term stability of cryptocurrency "may" depend on percentages of coin that are considered "clean". While laundering stolen goods and stolen cryptocurrency through legal transactions is on the rise, there is a difference between weighing the validity of clean coins used in illegal transactions (selling stolen goods) and coin "made clean" through "laundering" stolen cryptocurrency. There are algorithms out there, by the way, to track cryptocurrency through the blockchain, so stolen coin assets are very traceable.

Regardless, this article notes some important facts but to someone not knowledgeable in the basics of cryptocurrency, there might be some confusion as to where in the crime the cryptocurrency sits, and to what extent the coin used in the crime is clean or dirty. Also, it is important to note that just because some cybercriminals are more sophisticated than newer ones who "leave tracks all over the place", it doesn't mean the tech behind cryptocurrency changes; again, coin can be traced and no matter how deep the laundering or the transaction hops, reaching back to the source can still be accomplished. It's all a matter of time in some cases. Regulation seeks to draw clear distinctions and in Europe there are strides that America needs to catch up on and start looking to implement.

Great article - we need more discussion in this area and in plain language that makes the cryptocurrency ecosystem easy to understand to the layperson.     

 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.