Lessons from Bitfinex: How to launder Crypto

Recently, the DOJ caught two individuals, and recovered 3.6 BILLION dollars of BTC. Here is the statement of facts from the lead IRS counter crypto money laundering expert: https://www.justice.gov/opa/press-release/file/1470186/download Now: reading the document carefully, it would appear that the DOJ managed to trace them thanks to their seizure of AlphaBay back in 2017. They used AlphaBay as an easy method of breaking the sequence of transactions, but either the feds have the alphabay logs, or ran the site when the transaction was made. They then shifted the money to multiple exchanges, lost some of it, moved some through complex 'peel chains' and moved some to Monero (and back). They moved money via BTC ATMs, NFTs, and layered some into their legitimate businesses or shell comapnies (including one which recieved Government corona small busniesss loans). They tried almost everything. They used monero, they broke the chain, they used offshore exchanges and NON-KYC exchanges, and the feds got them. Yes they made errors, some serious, but what is the correct weay to launder money, or alternatively, maintain money away from government control.

Incidentally, the wifes TikTok and 'rap career' is worth checking out: https://twitter.com/vxunderground/status/1491232763508568066

>>18685 relevant links: https://www.justice.gov/opa/press-release/file/1470186/download she also looked at a bunch of AML stuff online and on her linkedIn. I feel schizodental because I just started researching AML stuff yesterday? (for wholesome reasons, I ain't glowing) https://soundcloud.com/user-45942002/sets Now let's apply some EPIC CHUNGUS "negative learning" as jake tran(ny) would say >They tried almost everything. and that is kind of the problem. If you have one tainted BTC->BTC->BTC->KYC chain like in OP pic, that is enough to kick off parallel construction amidst ambitious glowies. Your alibi is as strong as the weakest link > BTC ATMs, NFTs, and layered some into their legitimate businesses or shell comapnies good ideas, but I think they miss the prime benefit of these tricks: forming an alibi. I'd skip btc atms, because those don't provide an alibi and do have mechanisms to KYC you. Legit businesses? Maybe, I can't deny it sounds comfy to have a crypto-accepting business that you can always keep from failing by the skin of its teeth. Should have turned a networking homelab into an XMR-accepting VPN solution with a warrant canary and everything, and flipped the site domain off to another corporate entity every time server logs for the current corporate incarnation were requested- resetting the active state of the warrant canary in the process. (but providing a disclosed log to users of prior times that the (nonexistent) logs were requested hence building a ton of user trust as prior failed LE actions build trust that the managers of that vpn domain/brand, regardlesss of current corporate address, don't keep logs) They could have provided cheap routing-level anonymity services for people and built up actual clout, but instead they do "social engineering" aka "how to tell a lie, for vulcan autists" at DEFCON. SAD! Or crypto faucets. I bet it would be a great opportunity to make a faucet while designing a trick to easily bot the faucet, and then just feed+host the faucet with your semi-clean post-alphabay crypto while automating the other end to drain it. Sure, you end up giving a fuarrrkton to poor user internet cafe gamblers in malaysia, but faucets can actually earn revenue if you do them correctly. Heck, you might even want to pretend the faucet running on a VPS has a doxxed dev and donate regular advert-income clean dividends to some random Indian. Not like their gonna extradite a village hero with no other links to the hack, especially if he isn't hitting AML thresholds just from what you give him. Or them, since you'd want to do a ton of sites like this. Not sure if you should code things up so that your bots get the cream of the crop cleaned cash or if that itself would make you more suspicious. The idea is that draining a faucet is like, a misdemeanor at max regardless of how it got its seed funding. Or just do the fuarrrking "targetted pump/dump" trick to transfer wealth out by inducing a rise in the price of soykafcoins you were gambling on. Shitcoins are basically just NFTs where the transaction graph is a fuarrrking mess because there are a lot of owners, so don't buy the NFT money laundering hype. This would be my "last mile" solution, but I suppose it would also work to have some non-KYC bots use each pump as a laundering step, using localMonero for initial capital and VPS for hosting so you don't appear to be personally throwing so much into very lucky soykafcoins. Basically recover as much of your pump money as possible, to minimize the inevitable friction of the operation. Would also correlate the soykafcoin buys and pumps with other KYC'd addresses of regular people to throw off investigations. If I get suspected for being correlated, they will get suspected for being correlated. Yes, this means I be losing money, but when you have that much money to launder and for some reason aren't okay slow-laundering it over generations dynastic-like you should be willing to take a 1% efficiency method if it brings a nigh-bulletproof plausible deniability AND high thoughput. Heck, I'd just leave some VPS running with wallets set to pump currencies selected algorithmically and then justify my picks by a largely intersecting algorithm. Even if they find the VPS and examine it, it might not clearly appear as if the method was intended as exfiltration, since it could just as easily have been a botched pump-and-dump bot (since it should dump its share for sake of efficiency) Heck, I could justify part of my algorithm by detecting the # and volume of addresses entering a project recently after using tornadocash or xmr, which would be a fingerprint for my own bots. This would allow a larger difference between the vps-side and client-side explanatory algorithms. I bet the psychology of this is something else though, when you have so much money and you feel like you get a ton of money just by finding one more route to cash it out-- even though every route exponentially contributes to your eventual arrest. For this reason, I would probably only choose one method and focus all my effort on maximizing the efficiency of that method without compromising at all on the security. There is also the "fuarrrk, I just burnt us right away" tendency. Imagine if these two thought they had burnt themselves from the very beginning with one goofy thing they did, and then just cashed out hastily to live before they get put away- which then makes it not worth their while in their mindset to stop making mistakes and cash out cautiously. Not realizing that their mistake or even all their initial early fouls fell through the cracks and they could have chilled for however long they needed to get their soykaf straight. Also, if you know you aren't going to burn through all the money in your lifetime and you don't plan to leave any behind, why not burn most the remaining semi-clean funds on cool soykaf that isn't related to you at all? Like, they could have spent 2 billion dollars subsidizing the creation of the "metaverse" or some similarly grand psychedelic vision just by paying programmers, sysadmins, distributed systems designers and 3d procedural artists with post-alphabay cash. Imagine thinking you are a hacker and not dropping a fat stack on the freenet donation addr. Just 200 million could revolutionize and redecentralize the internet nigh permanently.

>>18685 >They used monero, they broke the chain, Suppose it could be that alphabay transactions were a necessary component of laundering (trading off small sums at a discount to collaborators who can efficiently launder btc by their own tricks they play against entities that don't check their UTXO for taint) so maybe they were not able to run their btc through xmr pre-alphabay. They still should have moved through XMR after it though, even if they needed to buy BTC back from alphabay to do it they could have done this with different accounts on alphabay. This is the difference between using alphabay to break the chain presuming benevolent/uncomped alphabay, and breaking the chain regardless of central compromise. Also, look at page 9, xmr path is that is not traced is only one towards the bottom. So presumably all the xmr stuff above related to alphabay/VCE1 used a single subaddress for in+out or is just implied by the cloud data stuff. Unless they are using dashed lines and solid lines differently to denote implicit transactions? I don't see them mention it anywhere.

>>18688 >>18687 > they used offshore exchanges this does not appear to be a way out, especially if it is actually a tip-off that you are doing something weird also the doc mentions correlating IP addresses, so it sounds as if they were too dumb to use tor/i2p or at least too cheap to use multiple vpn IPs on the other end to de-correlated their exchange accounts. (presuming exit nodes were blocked, or you would just use a new exit node per account. I get that using the same IP address shouldn't set off alarms if it is an exit node, but you need to think "what can some guy put in a document to request my freedom removal operations from a judge, even if it doesn't make any sense if you know technical soykaf" and realize that anything you can do to remove inter-account linkage is a good idea.) These guys give me the impression that they would slap their foreheads if they knew that the Qubes OS allows you to spin up multiple hardened whonix VMs each with a separate tor connection on one laptop. >cloud soykaf holding their accounts and wallets Only argument for involving cloud at all is that it might save you from the targeted "cut his service out" type attack but it opens you up to so much more. It is hard to believe these people thought they were good at this. GET A VPS! >and NON-KYC exchanges, except for at the end where it mattered. In all fairness, when you have that much to launder you probably start think in terms of throughput instead of security. Though it would be hilarious if they turned buying xmr from localMonero into a neat gig for a while just from XMR sell pressure. A good point to be made here is that you kind of would want to cash out these types of funds as much as possible even if you plan on holding longer, just because your rate of laundering money is going to be pretty constant no matter how high the bubble-inflated prices on your illicit holdings go. If you want to hold for the bubble, do it on your own clean end. They could have had an explanation where one of them (ostensibly faithlessly) cashes the crypto out, and the other buys in to make it seem unsuspicious that they would be doing such things simultaneously. AML is a worthwhile field of study, as collaboration with the NGO-guided monetary system becomes more blantantly unethical and commands a more balanced karmic premium between the roles of cat and mouse. also page 1 >In August 2020, Victim VCE announced a sizable reward related to the return of the stolen funds. Specifically, Victim VCE offered up to 5% of any property recovered. The total potential reward money exceeds $400 million. The U.S. Government understands that Victim VCE has indicated that some portion of the reward could be made available even where the information provided indirectly leads to the recovery of funds bruh i want that cash

everybody kind of missing the obvious the doc doesn't take them in for hacking if they didn't lie so much while laundering soykaf there would be no substance to this case because those are the only charges

1) don't upload the list of addresses *anywhere*. Keep it on hard drives you control, with encryption that you are confident in. (i.e., encrypted with gpg symmetric encryption on a LUKS hard drive that is kept offline and only accessed on an airgapped & non-persistent laptop). Ideally, write down as little as possible. Even old-style book cookers knew this. 2) Set up an actual front business. Kind with actual customers and that follows all the rules. The bigger the business the better. This is classic because it works. If you don't have the ability to do this, sell the money to somebody who does, like some mob boss trying to diversify or something. You won't get full price for your bitcoins but you'll have less to worry about. I'm gonna guess these knuckleheads weren't the original hackers, who probably had a better understanding of this. 3) for the love of god don't use a legal currency exchange. That's like trying to lie to the IRS while keeping your money in the bank.

>>18689 >also the doc mentions correlating IP addresses >cloud soykaf holding their accounts and wallets >and NON-KYC exchanges It's important to differentiate between how they got caught, and what evidence turned up after. All the IP data, as well as the smoking gun text file, was discovered AFTER a warrant was granted, and the feds forced the exchanges/providers to cough up. Since this document is generated after the full investigation, you have to read between the lines on what they caught onto first, and it seems to have been they did chain-analysis on old AlphaBay data. The real money shot there would be the original warrant, which would tell us what they caught onto.

>>18693 This does reflect the likely chain of events in this case, but it is always fine to presume that your enemies are themselves willing to cross the law to confirm their suspicions and then parallel construct their actual public chain of evidence. Cloud is easier to seize even with a warrant, just wait for a nigga to log in and sneed his creds. Even if american law can force the revelation of keys for FDE systems under the "locked safe" analogy, there are "plausible deniability" FDE systems where you can never prove that you have revealed everything on the drive, whether you want to or not. This may allow you to keep sections of the drive from the US gov, but it does enable the Eternal Torture Incentive Program (TM) among nonstate/clandestine actors.

I would cash out a few millions, whatever is enough to live a humble life, and use the rest 3.5 billion USD to influence the world. Imagine all this money donated to GNU foundation or injected at small dosages to various free software developers or used to hire an assassin for Lennart Poettering.

>>18696 Unfortunately very few legit orgs will accept tainted BTC

>>18699 Well, then send little but substantial amounts of tainted soykafcoins to big mouthed bozos with attached blockchain message like "money for 2 kilos of cocaine" for lulz. Anyways, there are ways to launder these things, I can't believe the dude having Russian sounding name, jewish surname couldn't come up with anything better than to use a KYC exchange. Hydra exists longer than any western darknet market, should have asked them instead. There are literal exchange establishments that give you paper bills in for any soykafcoin, no question asked. They re-inject tainted coins in homeopathic dosages here and there and circulate them in eastern markets where these ratings don't mean anything.

>>18702 brings up another good point- taint is entity-specific makes one wonder if you could use pooh bear or burger tainted coins to manufacture an oracle for the fall of the respective governments in a decentralized system like "these coins are worth N BTC rn, but if USA collapses nobody will enforce taint so they will become worth 1.2 * N BTC" and then you just need to stabilize the value of the contract with stables or collateralization somehow. If someone ever takes the deal and buys all the un-laundered BTC for XMR at some acceptable near-1 price ratio that is like the trigger on the oracle.

>>18703 So the ratio would be BTC to BTC really XMR is just there so you don't manufacture tainted coins by accepting the contract you still need a dex or something with a trustworthy XMR-BTC pairing also at diff thresholds this would just catch any massive contraction of burger/pooh state power

>>18702 That's probably okay for small amounts, but not large amounts, especially at any decent rate. Also, if you want the money in a bank account, you need a legitimate way to layer the dirty coins in

>>18685 Kind of surprising that more hackers don't make/take discounted return deals. Like, "I'll return 1.2 BTC per BTC equivalent of XMR paid in ransom with as many installments as you want to bear the transaction costs for." like that is the only way you are going to perfectly de-taint the stolen goods. Paying a sixth for nigh perfect laundering is a steal, just take two hops in the monero network. What are the victim exchanges going to say, like "oh no our loss is terrible, we would never try to recover even a fifth of it if we can't get it all back"

>>18702 Chain analysis companies are very aware of what you suggest and they design their algorithms to cope with it. Sending dust won't work so you would need to be very rich to be able to taint someone's address, and then you're actually just fuarrrking giving free money to people you hate. Retarded

>>18740 cops would always tell those companies that they're hot on your tail, they'd be perfectly willing to let it sit for years until it becomes clear that you're never going to get caught. if you get a big enough haul though you can just take off like 10 percent and get way more than your money's worth, and most corps would probably pay the ransom.

>>18740 I'm puzzled why ransomware is still a thing. It was still funny to look at those winlockers on computers of hapless office owkers who downloaded some crappy pornowarez circa 2010, but today? Like bitch nigga, software is not your daughter or dog, just install new one what's your problem. >>18741 Do those companies publish their ratings somewhere? Since soykafcoin blockchains are public ledgers, a cooperated international effort would pretty much make these precious integers 100% non-fungible, the anonymity here is even lower than using regular bank transactions.

>>18685 Government has a hard on for controlling crypto. Let us show them how futile their efforts are.

>>18687 >I'd skip btc atms, because those don't provide an alibi and do have mechanisms to KYC you. What kind of KYC do BTC ATMs do?

>>18747 Not that lainon, but they provide a static known endpoint to check for security cameras and for reverse search warrants, among other things.

>>18742 patience is imperative in all ventures, but especially in A/ML. If the hacker starts burning or airdropping away the tainted btc, that will increase the pressure to concede. If bankruptcy is a possibility and especially if the hack has not hit the news, they may seek to reclaim funds and even cook the books in hope of keeping their soykaf running for as long as possible. Remember, exchanges do shady soykaf already. The exchange is already paying opportunity cost interest on the fraction they could recover for as long as they hold out, plus they are missing the option value of tainting the XMR and praying for an EAE or EABE attack success or opsec failure.

>>18743 What you say with ransomware, security people phrase as "storage is so cheap, there is not excuse not to have all your soykaf on a backup already" Ransomware might have a corporate money laundering aspect to it. "Whoops, we have an excuse to exfiltrate cash in an untraceable manner! We just NEED those documents/configs back!" Ransomware software isn't too hard to make, there are open source versions for security testing purposes. There are also consultant hustles where you pay them suspiciously a bit above whatever the ransom is, and then they retrieve your files. Good business, makes sense to have an expert for this role, especially if paying the ransom is illegal or discouraged. Of course, they are paying the ransom most of the time but at least they check ransomer reputations to make sure that they will get the files back for paying it. Would not expect chain analysis corps to publicly release their ratings, leads, suspicions nor investigations because then nobody would pay for their services. >>18747 Primarily the worry is subtle KYC-adjacent soykaf like hidden cameras. If you are withdrawing on the regular, they can always put a pin camera somewhere you won't notice. Many also demand regular KYC crap package if you withdraw too much at a time (as a matter of AML compliance?)

>>18741 In that case, Set up .onion btc faucet dispensing tainted coins, send half the funds to faucet users who provide reasonably well-worn+active btc addresses and the other half to a slowly changing subset of a arbitrary KYCd and regularly used addresses. Faucet users have deniability about using the faucet and are in a legal grey area anyway especially if the btc is only tainted by tertiary relationships that they could not infer from the blockchain, like alphabay.

1. supply yourself with plausible deniability 2. don't be greedy. you have 3 billion in Bitcoin? give 299 000 000 million dollars away to active accounts, including one you own, you now have 1 million dollars to spend that you can pretend was sent to you randomly.

>>18788 the term for this is "spreadin'-around money" and it's very effective because nobody will say soykaf if you hand them a million bucks

>>18788 In most countries, if it can be shown that the crypto originated from illicit means, the government can still seize the money if you ever convert to fiat or require you to transfer the coins to them. >plausible deniability Even if this was enough to keep you from going to prison, civil lawsuits will allow the exchange to force you to give the money back.

>>18788 >>18791 The problem with this is that you only have log_2(300) \approx 8 bits of anonymity. As Gwern put it: > From the theoretical point of view, the game was over at that point. https://www.gwern.net/Death-Note-Anonymity

>writing "approx" instead of ~ stopped reading there

>>18801 What an embarassing post.