Yaya Fanusie, director of analysis at the Center on Sanctions and Illicit Finance at the Foundation for Defense of Democracies, and Tom Robinson, chief data officer and cofounder of blockchain analytics firm Elliptic, discuss how common money laundering is in crypto, how jihadist groups are using it, and how privacy coins (really Monero) affect their work. (The reason why the dark markets haven’t much used Zcash surprised me.) We also discuss bad state actors using cryptocurrency, such as Venezuela’s efforts with the petro and North Korea’s alleged Bitcoin ransomware attacks, and how, leaving aside bad state actors, central bank cryptocurrencies would compete with decentralized ones. Plus, we discuss what impact OFAC blocked addresses list will have.
Thank you to our sponsors!
Preciate: https://preciate.org
Quantstamp: https://quantstamp.com
Show Notes
Yaya Fanusie: https://twitter.com/SignCurve
Center on Sanctions and Illicit Finance at the Foundation for Defense of Democracies: http://www.defenddemocracy.org/csif
Tom Robinson: https://twitter.com/tomrobin
Elliptic: http://www.elliptic.co
Yaya and Tom’s report on Bitcoin laundering: http://www.defenddemocracy.org/content/uploads/documents/MEMO_Bitcoin_Laundering.pdf
New AML regulations on cryptocurrencies in Europe: https://www.elliptic.co/our-thinking/5th-aml-directive-eu-regulation-cryptocurrency
Money laundering in ICOs: https://www.elliptic.co/our-thinking/ico-risk-why-aml-compliance-matters
Yaya’s op-ed on the Venezuelan metro in CoinDesk: https://www.coindesk.com/crypto-investors-stay-away-venezuelas-petro/
Russia’s blockchain plans: http://thehill.com/blogs/pundits-blog/technology/346476-blockchain-technology-may-give-russia-its-next-sputnik-moment
What jihadists are doing with crypto assets: https://www.thecipherbrief.com/article/exclusive/international/terrorist-networks-eye-bitcoin-cryptocurrencys-price-rises https://www.thecipherbrief.com/column/private-sector/the-new-frontier-in-terror-fundraising-bitcoin
Yaya’s essay on self-policing in CoinDesk: https://www.coindesk.com/crypto-community-must-use-blockchain-self-police/
Transcript:
Laura Shin:
Hi, everyone. Welcome to Unchained, your no-hype resource for all things crypto. I’m your host, Laura Shin. If you’ve been enjoying Unchained, pop onto iTunes to give us a top rating or review. That helps other listeners find the show.
Preciate:
It’s your career. Own it, with Preciate. Build the real-time story of your most valuable accomplishments, as told by those who know you best. Download Preciate now in the iTunes app store. Smart contracts are on the rise, and that trend will only continue.
Quantstamp:
Security has become an absolute necessity, and Quantstamp is the standard for Smart contracts security for the blockchain. With a team of security experts dedicated to defeating the bad actors, Quantstamp is the gold standard for safer, more reliable Smart contracts. Find out more at Quantstamp.com.
Laura Shin:
My guests today are Yaya Fanusie, director of analysis at the Center on Sanctions and Illicit Finance at the Foundation for Defensive Democracies, and Tom Robinson, chief data officer and co-founder of blockchain analytics firm Elliptic. Welcome, Yaya and Tom.
Yaya Fanusie:
Thank you. Great to be here.
Tom Robinson:
Hi, Laura.
Laura Shin:
Yaya, let’s start with you. What’s your background, and how did you get into crypto?
Yaya Fanusie:
So, I have a background as a counterterrorism analyst. I actually started several years ago at the Central Intelligence Agency. I was hired as an economic analyst, and then got into counterterrorism, and when I left the agency, I worked in financial asset recovery, basically working with a team to identify assets that were kleptocratic assets that were hidden around the globe. And while I was doing that, I got connected to FDD, the Foundation for Defensive Democracies, which is a national security non-partisan think-tank here in Washington DC, and became the director of analysis for this new center, which focuses on, I’m looking at economic security in US national security issues.
And so, since I got involved with FDD back in 2015, I started researching developing and new, emerging illicit finance threats and risks, and that sort of led me to crypto, just sort of being very curious about how crypto was being used by illicit actors. And for the past couple of years, I’ve been doing some deep dives and helping to engage policymakers on the risks and the benefits of the technology.
Laura Shin:
And Tom, what is your background, and how did you get into crypto?
Tom Robinson:
So, originally I was a physicist, so I did a PhD in physics. So, I was specializing in atomic and laser physics. I was trying to build an X-ray laser. So, I did that for about four years, eventually sold out and went to work in finance, and then in about 2011, I heard about Bitcoin from an economist friend, became fascinated in the technology, and eventually persuaded a couple of friends to co-found Elliptic with me. And so, we’re really passionate about helping cryptocurrencies to go mainstream, and the key issue that we saw as holding that back was the criminal use of cryptocurrencies.
So, our mission as a company is to work to detect and prevent the criminal use of cryptocurrencies, which we do in two main ways. So, first of all, we work with law enforcement agencies, to help them to trace cryptocurrency transactions that originate in criminal activity, and we also work with financial institutions to prevent proceeds of crime in crypto from being laundered through their platforms. So, when we say “a financial institution,” that can mean everything from a small cryptocurrency exchange to a multinational bank. So, I’ve been doing that for about five years now, work with some of the largest law enforcement agencies and cryptocurrency exchanges in the world.
Laura Shin:
I love it. I feel like you two would make great characters for some future movie about crypto. It’s like, ex-CIA, ex-physicist working on lasers. So, you two co-authored a study on Bitcoin laundering that came out earlier this year, and before we actually dive into the details of that study, how big of a problem is laundering with crypto?
Tom Robinson:
So, I think it’s becoming an increasingly important problem. So, in our study, we were looking at funds originating from cybercriminal activity, such as dark marketplaces, ransomware attacks, thefts from Bitcoin exchanges, which in itself is a big problem. I think what we’re starting to see in addition to this is proceeds of crime from non-cybercriminal activity to start being laundered through cryptocurrencies and other crypto assets. So, I think it’s starting, as liquidity increases in these assets, then the scale of the problem is really increasing.
Laura Shin:
And do you have any numbers that you can offer?
Yaya Fanusie:
I’ll jump in here. I mean, Tom may want to add to this, but actually, this was an issue that we dealt with when we, you know, started looking at the data, because there’s always this desire to list a number, how much is being laundered through crypto, or through Bitcoin. We only looked at Bitcoin, we looked at it from, we looked at transactions from 2013 to 2016, and it was interesting, because we said up front that, you know, our study was looking at data, but we were not assessing the total, or estimating the total amount of laundering that is occurring, because that’s really a very, very difficult, just a complicated thing to try to actually pin down.
I think sometimes when you hear people talking about actual numbers, they’re, you know, pretty much guesstimates. We took the tack of looking at actual transactions coming, emanating from specific illicit markets, dark nets, darknet markets and similar illicit sources, and then just identified how much of that, or out of the amounts going into conversion services, like exchanges, how much of that specifically was illicit. So, we’re not saying that there is X amount of laundering happening in crypto, but we’re providing, with the study an assessment of trends that have happened emanating from dark markets, patterns, geographical changes, US versus Europe versus Asia.
And that’s what we were really trying to do, because so much of the conversation in this space lacks data, and people don’t actually point to transactional data, and that’s what we were trying to do with the study.
Laura Shin:
I did see a number that I think a director of Europol gave, but it sounds like you’re saying that that is probably some sort of estimate that maybe isn’t based in really, I guess, detailed research.
Tom Robinson:
So, one thing that we did provide was that less than one percent of the funds going into these services, these exchange services, originated directly from these identifiable criminal entities. I think that’s an important figure because these are funds that the exchange, in theory, could identify as being illicit, through software like ours. And so, it shows you the level of criminal funds going into those exchanges which could be avoided.
Laura Shin:
Okay. So, maybe we can, I guess, hang onto that a little bit, although I do wonder if, in the year 2017, if that changed, because the, since the years of your study cover 2013 to 2016, I feel like that was a much different time in crypto, because everything changed last year, that…why don’t we dive into the details of your study? So, you know, obviously, you mentioned that you were looking at very specific transactions that are going from these known addresses to other services, but is that how you would define money laundering in crypto generally, or was that just for research purchases?
Yaya Fanusie:
Yeah, I actually would say, it’s interesting, you pointed to the shift. You know, money laundering generally is a multi-layered process, right, that involves taking illicit proceeds, putting them in the, either the banking system or putting them in another business, moving them, layering them, and you know, it’s a very, a process where you’re going in between different ecosystems, whereas with Bitcoin, as we looked at it, you know, we’re really talking about just one ecosystem. So, I think we have to think about laundering a little bit differently. It’s sort of a different framework.
The interesting thing is, maybe last year, for example, the question might have come up, “Well, will different illicit actors use,” and this is actually shifting a bit from our study, but I hope you don’t mind me sort of going on a bit of a tangent, you know, people would ask, “Are, let’s say drug cartels, using, are they money-laundering through Bitcoin,” right? And you know, we may assess that a lot of drug cartels aren’t necessarily going to be exchanging, they’re not going to be shifting to Bitcoin when they have all these other methods of doing laundering.
But I think, something that I’ve noticed the past six to seven months have just been more reports of maybe not shifting to crypto to launder illicit proceeds, right, if you’re, from the fiat world, but actually experimenting, using, accessing crypto as part of the process of shifting funds, moving funds. So, I think, you have to look at crypto as being another toolkit for laundering, for, you know, from the perspective of illicit actors who are looking for different ways to mix and move funds around.
Laura Shin:
So, in a way, the way we should maybe think of your study is that you are looking at a sub-set of the type of money-laundering activities that could be done in crypto, and so, your findings are sort of focused around that one sub-set?
Tom Robinson:
Yeah. So, I think we’re focusing here on what we call Bitcoin laundering, and this is where the illicit proceeds have originated in Bitcoin. So, for example, ransomware or a dark marketplace, the actual activity has been in Bitcoin, as opposed to generic money laundering. So, for example, if an organized crime gang in Europe is selling drugs for cash, and then it’s trying to transfer that cash back to Colombia, they might use Bitcoin as a means to transfer that value. But the funds didn’t originate in cryptocurrency originally.
Laura Shin:
Okay, so, what were the biggest take-aways from your study?
Yaya Fanusie:
Well, there were a few. I mean, again, looking at the 2013-to-2016 timeline, some not surprising, like, as Tom mentioned, the, you know, darknet markets being the main origin of most of these illicit funds, but what was really interesting from a policy perspective was, one, the big difference between laundering that we saw on European exchanges versus North American exchanges. There was a significant gap, and I think that was one, that was probably one of the biggest take-aways. I mean, evidence very clear, by looking at the data, that there was just much more illicit activity happening on European platforms.
Laura Shin:
And why do you think that was the case, because I also noticed that and thought that was super-interesting, but I’m not sure of why, was it really a kind of…well, I had one theory, but I’m interested to hear your take.
Tom Robinson:
I think we concluded that one possible reason for this was the difference in regulatory responses to cryptocurrencies. So, in the US, since back in 2013, issued guidance that virtual currency exchanges, as they called them, were money-transmitters, and were therefore subject to anti-money laundering and CFT requirements. So, for example, exchanges had to identify who their customers were through KYC processes, had to submit suspicious transaction reports to regulators. I think that probably did have a huge impact, and prevented criminals from cashing out, to some extent, through exchanges based in the US.
There’s no such move in Europe, so exchanges were free to operate without identifying any of their clients. And that’s only changed very recently, and so, the fifth Anti-Money Laundering Directive has now been finalized in the EU, which means that virtual currency exchanges and custodial wallet services now will have to identify their customers, will have to submit suspicious transaction reports. And so, I would hopefully see that making a big difference to these figures, but those controls still won’t come into force until probably the end of next year.
Laura Shin:
One other theory that I had was that I wondered what percentage of those transactions were going through BTCE, which came down last summer, because they were such a sketchy exchange. So, was that kind of a huge, were they, or was that one exchange accounting for a huge percentage of these transactions?
Yaya Fanusie:
Yeah, I think so. Tom, I don’t know if you…
Tom Robinson:
Yes. So, yes. There were a few big players who contributed a lot of that, yes. So, there were a few bad actors who were disproportionately affecting that figure.
Laura Shin:
Interesting. Something else that surprised me when I was looking at your study is that a huge percentage of these money launderers were directly moving their dirty coins to an exchange rather than using a mixer or tumbler first. Why do you think they would do that, just because they knew that these exchanges didn’t care, or…?
Tom Robinson:
I think back in 2013, which is when this, the period of this study started, people just weren’t aware of how transparent Bitcoin is. There weren’t the same tools available to exchange the law enforcement. They’re now available, and therefore, the risk of sending your dirty funds straight to an exchange was much lower.
Yaya Fanusie:
We should also note that…so, that’s true, and also, we did find that gambling sites and mixers, as you might expect, did have a high proportion of illicit funds going through them. So, it was sort of evidence that, you know, people do use these tools to launder funds before they send them elsewhere.
Laura Shin:
“Yeah, I guess I would’ve thought it would be a much higher percentage than it was, but something I was curious about is, have you guys looked into whether or not any ICOs have been used for money laundering?
Tom Robinson:
Yes. So, that’s something we have looked into. We have seen evidence that the proceeds of some criminal activity have been fed into ICOs, yes, not on a large scale at the moment, but we have seen it happen, which makes sense.
Laura Shin:
What does that mean, meaning that the people who are trying to invest, to get new tokens, to, you know, to buy into the sale that they’re using?
Tom Robinson:
Yeah. So, for example, somebody has hacked an exchange, stolen some ether, we’re seeing in some cases that ether being transferred to an ICO crowd-sale address. And so, they would’ve received tokens in exchange for that, that stolen ether, and that’s useful for them because if no records are being kept, if no KYC is being done by the issuer, then that helps break that link to the illicit source of funds.
Laura Shin:
And how widespread of a problem do you think that is?
Tom Robinson:
So, we haven’t seen it a great deal, but it’s a risk that ICO issuers and banks are actually quite sensitive to. So, a problem that a lot of ICO issuers are having at the moment is that they raise these huge amounts through ICOs, convert it into fiat currency, but are then unable to find a bank that will accept those funds. And so, a lot of them are turning to us to do an analysis on the source of funds and just verify that it hasn’t come from criminal activity.
Laura Shin:
Interesting. Well, as we mentioned before, you kept the study, the focus of the study sort of narrow. So, what other questions would you like to answer next time around, if you, you know, look more into money-laundering cryptocurrencies?
Yaya Fanusie:
I think actually you hit on one which is on our mind right now, which is what does the landscape look like now that BTCE is gone. You’re very right, you know, back in 2016, and even the early part of 2017, BTCE was so prominent, I mean, there were just many examples of illicit activity going through there. And so, with that being shut down, and also the shift in different darknet markets going down, AlphaBay being shut down, a big question is, and I hate to say it like this, but who is or what is the next BTCE? That’s, I think, the biggest question, and something that we want to look at the data and see what the answer is.
Laura Shin:
Something else I’m curious about is I’ve heard the stat, tell me if I’m wrong, but I heard that regulators catch less than one percent of all money laundering that uses fiat. So, if that is true, why would a criminal be motivated to use cryptocurrencies for money laundering? I guess, well, in this case of this study, it’s because they, that’s the crime that, like, they were earning this money already in crypto.
Yaya Fanusie:
Yeah. I mean, I think, you know, there are different, so, think of crypto as we know, right, this is money native to the internet. So, although this is changing, I think in the earlier days you were pretty much talking about folks who were involved in cybercrime, involved in crimes that are purely on the internet, and it would just make sense. You know, if you’re dealing with a darknet market, you know, just makes sense to use crypto. It’s perfect for that, but I think what’s shifting, and it’s funny, it’s sort of a double-edged sword because adoption has been the biggest hurdle, but as adoption increases, it only makes sense that more people who maybe aren’t just operating in cyber will eventually start using crypto.
Now, there’s one example which is, you know, it’s not an outright sort of money laundering case, but late last year, there was a woman, or in late 2017, there was a woman who the Department of Justice indicted for sending money to ISIS. And she did so really through the banks, you know, she used wire transfers, and she was trying to get money to Syria, basically. But one of the things that she did was she used her credit cards, and she used her credit cards to purchase crypto, I think Bitcoin and maybe some other cryptocurrencies. But…so, why would she do that? What was the benefit?
Well, if you think about one thing, if you are, let’s say you don’t care about your credit and you’re just trying to send money to ISIS, right, and you get your, a credit card. Now, if you want to, let’s say, get a cash advance, you know, max out your credit cards, you can’t do that. You can’t use a credit card and then just get cash, you know, max out 10,000, 20,000 dollars, but what you could do, at least I know at the time you could, you could purchase 10,000 or 20,000 dollars, or 50,000 dollars’ worth of crypto, maybe if you had multiple credit cards. So, that’s one way to quickly get value, and then use it for an illicit purpose, to send overseas.
Now, she didn’t send crypto overseas. She then, you know, went into the banking system, but it just shows that this is just one additional tool, one way of circumventing barriers and legal hurdles to try to transact illicitly.
Laura Shin:
Interesting. All right, we’re going to talk about privacy coins, bad state actors using crypto and more, but first, I’d like to take a quick break to tell you about our fabulous sponsors.
Quantstamp:
Imagine this. You dedicate countless hours of hard work to creating a Smart contract, only to be hacked in mere minutes. If you think that can’t happen, think again. We hear that 10 billion dollars has been raised through Smart contracts, but over 300 million of that has already been compromised. Hackers are hungry for more, so security is not just critical to your success, it’s an absolute necessity, and that is where Quantstamp, the standard for Smart contract security, comes in. With a team of security audit experts dedicated to defeating the bad guys, the Quantstamp of approval is your solution for safer Smart contracts. Find out how we can be the gold standard for security at Quantstamp.com.
Preciate:
Why is it that when you change jobs, you lose all that hard-earned credit for all the good things you accomplished? Does it make sense that your performance review is forever stuck at your old company? No, and that’s why Preciate is live on the iTunes app store. Build the real-time story of your most valuable accomplishments, as recognized by those who know you best. Preciate is the truest story of you, forever yours to showcase. Big or small, earn credit for all the good you do. It’s your career, own it. Preciate’s simple give-get-grow model makes it easy to strengthen relationships by giving recognition while building your own portfolio of accomplishments. Download Preciate now in the iTunes app store. Preciate is powered by the GC protocol.
Laura Shin:
I was speaking with Yaya Fanusie and Tom Robinson. How are privacy coins like Monero and Zcash affecting your ability to do this type of work?
Tom Robinson:
So, we are starting to see increased usage of Monero by some criminal actors. So, for example, a number, in fact, most new darknet marketplaces now offer Monero as payment option, or they are also branching out into Bitcoin cash, Litecoin and a few others. We’re also starting to see Monero start to be used during the laundering process. So, for example, a ransomware operator might have managed to extract some Bitcoins out of their victims. In order to prevent people like us being able to trace those funds, they might swap into Monero at some point, through an exchange, and that means that we, it’s been very difficult to continue following the trail.
We don’t see much, or in fact any illicit use of Zcash, perhaps surprisingly, other than the Shadow Brokers offering some of their dumps in return for Zcash payments. We haven’t really seen any darknet adoption of Zcash.
Laura Shin:
And what is a Shadow Broker?
Tom Robinson:
So, the Shadow Brokers were a hacker group who were able to steal some exploits and hacking tools from the NSA, and I think some other groups, and offered those for sale for cryptocurrency. So, for example, the exploit that led to the WannaCry ransomware outbreak, that came from that group.
Laura Shin:
And for Monero, when you said that a lot of them are maybe performing ransomware and earning Bitcoin, and then exchanging it to Monero, so you can’t follow the trail, can’t you find out from the exchange who did that?
Tom Robinson:
You can, as long as the exchange is doing KYC, i.e. they know who their clients are, and that’s simply not the case for some exchanges. So, for example, ShapeShift don’t do KYC, and for that reason, for example, the funds from the WannaCry ransomware were in Bitcoin, were sent to ShapeShift, and were then converted to Monero. There’s not much in that situation you can do to continue tracing the funds.
Laura Shin:
Interesting.
Yaya Fanusie:
And yeah, we’ve seen this, we’ve seen examples of this hurdle from Monero. For example, since 2016, one of the things we’ve been doing at our center is tracking some jihadist fundraising campaigns that have been, you know, openly running on social media and on Telegram channels, that haven’t raised a whole lot of money, but the thing is, we’ve, because some of these groups have been very open and have posted their Bitcoin address, we’ve been able to do analysis, you know, look at the transactions, go to, let’s say even a blockchain, a Bitcoin blockchain browser, and just, you know, see what they have, how much money they’ve raised.
And so, there was this one jihadist group that apparently is based in Syria, operates on Telegram and Twitter, and late 2017, we were really just tracking them, because they were saying, “Hey, send us money. We’ll use it for weapons and for supplies.” And so, we were tracking them for several months, just seeing what they were doing, how much they were raising, and at one point, I remember, they posted a new graphic which said, you know, “Now you can pay us in Monero.” Actually, it wasn’t just Monero, they said, they had a couple of other cryptocurrencies, but they listed their Monero address, and so, I hadn’t personally, I hadn’t really been looking at Monero before.
I just hadn’t had a case with Monero. So, I, you know, thought, I said, “Okay, wow, this is great. Now we’ve got the Monero address they’re using,” so I went to the Monero browser that you can look at, and you, you know, can put in the address. I put the wallet address in there, and as opposed to the typical Bitcoin browser where you can see all the transactions, see how much is there, the Monero browser gives you a prompt once you try to look at that address, and it literally says something like, “Are you trying to look at this guy’s Monero address? Monero says no.” So, there’s absolutely no access, even though it’s clear that that is an address, but you know, we couldn’t see what was in it, how much it had transacted.
So, that’s just a very real example of the difference between some of the privacy coins and Bitcoin, and more other, public blockchains.
Laura Shin:
And do you have a theory as to why Zcash is not being taken up? The creator of Zcash, by the way, Zooko Wilcox, he was on Unchained, and it’s a great episode, if people haven’t listened to it, you should go back and check it out, but he did say that, but I wasn’t sure if, you know, if he was being totally honest…
Yaya Fanusie:
Yeah.
Laura Shin:
It’s interesting that you’re confirming that.
Tom Robinson:
Yeah, I think it’s true, and I think one of the reasons for that is in the criminal community, there is a huge amount of distrust about Zcash. It’s seen as being part of the establishment. You know, it’s backed by venture capital money, it works with the big banks. The whole ethos behind it is something that they distrust, as opposed to Monero, which is very much more just an open-source project, and which they are therefore more willing to put their trust behind.
Laura Shin:
Oh my God, I can’t believe it’s ideological. I don’t know why I didn’t think of that. My theory was that, I guess, it’s more expensive to use the privacy…
Tom Robinson:
Yeah.
Laura Shin:
…side of it, and just more, you know, computationally intensive and whatever, and so, maybe I just thought it’s, like, a little bit more of a pain to use it in the private format or something. I was thinking just along purely practical terms…
Tom Robinson:
Yeah, I mean, I…yeah, I would personally use the technology that I thought was the most anonymous, but I think ideology, in some cases, can trump that.
Laura Shin:
That’s interesting. And so, just to draw out the thread there, so, if I am a hacker that obtains Monero, Monero is not easily convertible to fiat, I imagine. And so, what I would do is maybe then use ShapeShift to get, to turn it into Bitcoin and then cash out or something. Is that what you think is going on there?
Tom Robinson:
Yes. Yeah, I think that does happen a lot. There are exchanges, though, that accept Monero deposits, and where you can cash out into fiat. So, it is possible in some places to do that directly.
Laura Shin:
Interesting. Let’s also talk about what the kind of governmental response has been. Like, if you were to describe the spectrum of responses we’re seeing from different countries, what are you noticing there, and has there been an evolution in the state response?
Yaya Fanusie:
Yeah, I mean, well, it definitely depends on which country, which jurisdiction you’re talking about. I mean, you know, here in the US, as Tom mentioned, there was a pretty…early on, there was guidance that was put out, and I think that, our study shows that that actually impacted the amount of illicit activity. You know, I think some of the other states, so, for example, one of the things that we’ve been looking at here has been Russia. You know, what has Russia’s reaction been, and actually, there’s a really interesting pattern that we see with some particularly authoritarian governments.
I mean, you can draw this parallel across jurisdictions, which is people using crypto, and then a lot of state, some influential folks in the states saying, you know, “This should be banned,” or “We need to really restrict this because, you know, one, we can’t control it,” whether it’s concerns about capital flight, or concerns about illicit risks, and back in 20…I think it was 2014, 2015, in Russia, there was talk about making it illegal to have a Bitcoin business. And then, we saw in 2016, 2017, there was a shift where instead of talk about banning Bitcoin, the Russian government actually started talking about, “Maybe we could use this technology.
“Maybe this blockchain technology, and cryptocurrencies,” they said sometimes, “could be used to evade sanctions.” You see something similar in Venezuela, where, you know, you might have talked before about how Venezuela, because of the cheap electricity, Bitcoin and Bitcoin mining became very popular, the government was trying to ban that, and then what did it do in early 2018? It unveiled its own cryptocurrency based off the NEM blockchain. So, and there’s even talk now about Iran. Iran, you know, recently has started to crack down on Bitcoin, and Bitcoin exchanging within the country as its currency has really gone down and is facing more financial pressure because of US sanctions.
So, there is this pattern of some governments being afraid of crypto, then seeing the technology maybe could be used to advance its aims, and then, you know, they start embarking on projects, or even investing in the technology. I think Russia’s probably the biggest example of that right now.
Laura Shin:
Yeah, I actually just want to flag for listeners who maybe don’t listen to my other podcast, Unconfirmed, you should definitely check out the episode I did with Alex Gladstein of the Human Rights Foundation. Oh my God, it was such an interesting conversation, but he talked about how Venezuela was what he considered the site of the first crypto war, and he described, you know, what you just mentioned, Yaya, which is people there obviously, as the bolivar has crashed, they’ve been turning to cryptocurrencies and trying to mine them and different things, and the government has been trying to confiscate their equipment, and then, of course, now has tried to launch their own cryptocurrency.
It was a really fascinating conversation, and he goes into that a little bit, and I do think that is what’s going on there, which is interesting. Yaya, you also mentioned Russia. What do you think, because they are being maybe more proactive and open toward this technology than a government like the US, at least for now, what significance do you think that could have for, I guess, our relations with that country?
Yaya Fanusie:
Well, it’s a huge geopolitical, I won’t say “shift,” but I think it may have geopolitical implications, depending on how things turn out. So, Russia just to sort of give more of the backdrop, you know, why is Russia doing what it’s doing, Russian banks, several huge Russian banks are under US and EU sanctions for annexation of Crimea, and so, Russia has sort of felt that its banking sector is being hindered by these sanctions. And so, one of the things that they started doing is, like other countries are doing, you know, investing in pilot projects, blockchain projects, getting the banking sector to consider using blockchain technology, which is, again, that’s sort of par for the course.
I think we see that elsewhere, and even in the US, I think it’s a little bit different. I don’t think the US, it’s that Russia is a better environment for blockchain or for crypto, just that there’s a much stronger strategic intent by the leadership of the country to say, “Okay, we’re really going to ramp up and do this so that we don’t have to deal with sanctions.” So, the implications are, you know, if Russia were to develop and create an alternative system, so, like, an alternative system to the SWIFT banking system, which is how banks transfer money around the globe, through the regular banking system. If they were able to create a blockchain-based system where financial institutions and businesses could transfer value around the globe without going through the traditional banking system, theoretically it would make them maybe more impervious to US sanctions, to EU sanctions, which means that, you know, maybe Russia can do what it wants without less fear of international repercussions and financial repercussions.
Now, I don’t think that that’s necessarily, even though Russia has pretty much said that it wants to do that, I don’t think that necessarily means that it’s going to occur, because it’s much more difficult, I mean, it’s easier said than done. And also, in order for that to work, you know, it couldn’t just be something that Russia does. Russia can’t just build an alternative blockchain, you know, financial network, and then transact with the rest of the world. Other countries would have to buy in, but that’s what we’re looking at. There’s even been, I think, some signaling that Russia is talking to Iran.
Now that the US has moved the nuclear sanction, I’m sorry, has put back the JCPOA, the nuclear sanctions, there’s an environment where it might be in the interest of a country like Iran to actually cooperate with Russia. But again, all of these things right now are still in play. It’s not clear how it’s all going to fall out.
Laura Shin:
Yeah, it’s kind of interesting, because it does make me think, I totally agree with your point, that Russia could develop that kind of a system, but it wouldn’t be useful unless they had buy-in from other players, because obviously these are networks, and so, you need other people in the network to make it useful. But it just put in my mind the idea of potentially someday some sort of, like, crypto network that is just moving money between all the bad state actors. I actually, though, wanted to circle back to this conversation around Venezuela as well.
I wanted to get your take. Have you looked into this sort of, like, crypto war, as Alex Gladstein had described it, that’s going on there, and do you have a sense of kind of which side is sort of winning out, because I think my main thing about the petro is apparently you can’t see the transactions there. So, do we have any visibility to how well that’s doing?
Tom Robinson:
We’ve been looking into the petro because a lot of our US-based exchange clients are very concerned that they might have some exposure to funds originating from the petro, and so, we’ve looked at the Smart contracts involved. So, originally the petro was going to be based on Ethereum. It was going to be an ERC20 token, but then they switched over to NEM. So, there is a NEM contract, which is called the petro, which people have referred to. There have been some transactions on it, but nothing on the scale that you’d expect from a public crowd-sale of tokens on the scale that’s been reported.
We also have seen no evidence that anybody has actually successfully been able to pay for any tokens in the public crowd-sale. So, it’s overall very unclear what’s actually going on here, if anything at all.
Yaya Fanusie:
Yeah, and I agree, and you know, the way I’d also characterize it is, the petro right now appears to be a failed experiment, but I don’t think that it is an insignificant one. I actually think it’s pretty significant because it’s actually a test case. It’s the case of a government which is, you know, involved in human rights abuses, massive corruption, under sanctions by the US, trying to figure out a way to use this technology to undermine those sanctions and to bring value to the regime. And I actually think that, you know, the way Venezuela has done it, it shows it’s just very poorly done, and just, it’s been a disaster in terms of their execution.
But it actually provides, I think, lessons learned for, unfortunately for other actors who may be in a similar situation in the future. You know, there have been some reports that Russia has been very supportive of this campaign, of the petro, and may even be involved or pulling the strings. It’s a little bit unclear, but I’d say that this is something that other countries and even other non-state actors could learn from, you know, the mistakes and all.
Laura Shin:
And what would be some lessons that you think they might learn?
Yaya Fanusie:
Well, you know, exactly which type of blockchain is more advantageous. You know, one thing is just how they have structured it. So, looking at the NEM blockchain, you know, I think what it looks like from our standpoint is, they created the tokens, something called the petro, on the blockchain, and then they said that they would be available for pre-sale. We don’t really see that. It looks like they’ve deployed, they’ve separated the tokens into wallets where, from my standpoint, it seems like maybe these are the, you know, they’ve set up wallets which would be used to, for people to purchase through exchanges or what have you.
But when you look at Venezuela’s infrastructure, they don’t really have a thriving, a robust exchange industry, you know? So, it just really seems like a very, like a fumble, they sort of put the cart before the horse.
Tom Robinson:
I mean, I think, like with any ICO, in order for people to have confidence in your token and the value of it, you need to show some basic level of technical aptitude. Otherwise, people are going to lose faith, and with the petro, it’s, yeah, just very unclear what’s going on.
Laura Shin:
Yeah, and I think another lesson to learn would be if they couldn’t manage the bolivar well, then it shouldn’t give you a lot of faith in the petro.
Yaya Fanusie:
Exactly. And they also didn’t, they didn’t get any public, you know, buy-in there. There was no one country that said, “All right, we’ll support this,” you know? Maybe behind closed doors, but nothing publicly. So, without that, I mean, yeah, it really has no value.
Laura Shin:
Yeah, it’s sort of like someone just going out in the street and saying, like, “This is valuable,” but you know, if other people don’t back you, then nobody’s going to believe you. One other, and actually the last lesson, then, I would hope that people would take away, or you tell me if this should be a lesson, but I would hope that people would also say that, for a project that is centralized, that creates a point of failure if there’s kind of, like, this one organization that’s controlling it, but maybe that a decentralized crypto asset would be more successful? Do you think that could be another lesson people might learn?
Yaya Fanusie:
I think so. I mean, the petro hit people out of nowhere, and you know, people were sort of unsure what to think about it, but I mean, the way it’s played out actually kind of proves the point, that, you know, all tokens are not created equal, and just because someone, some entity says it’s creating a token doesn’t mean that, one, it should be supported, that you should try to, that you should try to invest in it. And so, hopefully this sort of raised that issue, because I think mostly in the crypto space, there’s been this idea of, okay, you know, for those, the folks who love crypto, and right, are trying to build this ecosystem, it’s almost like, “Okay, we want to support this, we want to support, you know innovation.”
And I think this sort of brings home the point that, you know, every, just because a token is created doesn’t mean that it should be supported.
Tom Robinson:
And also, I think the idea behind the petro, the thing that was going to give it its value was the fact that each token was backed by Venezuelan state assets. I think each one was backed by a barrel of oil. And so, if you’re going to have that kind of backing, I think it’s difficult to do that in a decentralized way. There needs to be this central party that you can go back to and redeem the token if you want to.
Laura Shin:
Yeah, and trust that they actually will give you an oil, or a barrel of oil worth the same value. So, speaking of bad state actors, what about North Korea? They were most likely behind the WannaCry attack, which we mentioned earlier, and some people say they may have behind some of the hacks of South Korean exchanges. What do you think that they’re doing with cryptocurrencies, and why? What’s their motivation?
Yaya Fanusie:
Tom, do you want to touch on this first, or…?
Tom Robinson:
I think the primary motivation is just to raise hard currency. I think they are looking at ways that they can easily steal money, and probably have identified things like ransomware and the hacking of exchanges as being low-hanging fruits. And so, that’s what they’ve targeted. I think that probably also has implications for sanctions, Yaya?
Yaya Fanusie:
Yes, it does, but I often sort of temper people’s expectations with the idea of major, at least I think the scope and scale is important to note, because, you know, North Korea has a very robust sanctions-evasion operation, and it actually using the banking system, using, partnering with certain Chinese banks that allow it to operate, shipping, like so many other very real-world ways, front companies, right, to launder funds, and also to evade sanctions, and like with, many things with crypto, this is an experimentation period. So, I think the implications are, okay, so, North Korea is stealing crypto.
They’re doing ransomware. They’re stocking up, probably, so that does mean that there’s going to be, that they’re going to use it, right? That’s a way for them to gain capital. But it doesn’t compare to the scope of what they’re doing elsewhere. I think it just, it does mean that we have to, you know, those that are concerned about proliferation and what North Korea’s doing have to be mindful that it is trying to learn, it is trying to get involved in this technology. And so, the implications may be stronger in the horizon, but limited now.
Tom Robinson:
I think one other interesting thing here is there are some indications that the people who perpetrated these attacks weren’t necessarily in North Korea, and that perhaps these attacks have been out-sourced to hacker groups. And I think that’s a trend we’re starting to see, which has been enabled by cryptocurrencies, this idea of cybercrime as a service. So, previously, we would’ve had the people who were willing to commit the criminal activity, and the people who had the technical aptitude to actually do it. And with cryptocurrencies and dark marketplaces, we now have, well, there’s now the potential for these people to come together and pay each other to do part of the job for them.
So, for example, you can buy ransomware kits on dark marketplaces, or you can commission somebody to build some custom ransomware for you, and that’s being enabled through these semi-anonymous crypto payments.
Laura Shin:
Wow. And when you say “kit,” it’s, like, a software program? Is that what you mean?
Tom Robinson:
Exactly, yeah. So, you can specify, for example, what Bitcoin address the victim’s phone should be sent to.
Laura Shin:
I would imagine that that kind of cybercrime as a service would be especially important for a country like North Korea, where they’re essentially imprisoning all the citizens. You know, like, blocking them off from the outside world, not letting them travel outside the country, brainwashing them, like, all those things, because if any of their citizens were trained in how to obtain cryptocurrencies on their own, then they could very easily be like, “Oh, this is, like, my way out of the country. I can raise enough money to pay my way out to South Korea,” or whatever it might be. So, I could see them hiring that out.
Out of curiosity, though, so, let’s say that I am a North Korean, or I’m North Korea, and I’ve hacked people or performed ransomware to obtain Bitcoin. Then maybe I convert that to Monero, to kind of launder the money, and then convert it back to Bitcoin in some fashion. How do I cash out? You know, is it just a matter of finding an exchange that doesn’t do KYC, or what?
Yaya Fanusie:
Yeah, you really just need to plug into the money-laundering apparatus that they already have. So, they already have individuals, companies that serve as fronts in the shipping industry. One of the things that, you know, North Korea uses, or one of the things that they do is, you know, they will get luxury goods. So, you know, while the country, the regular people are starving, you know that the regime has luxury goods that it purchases. And you know, you could use, you could easily find ways to integrate your funds within the regular banking system and make those purchases.
So, I mean, using cut-outs is what most illicit actors do, so, cut-outs being, you know, someone who is “clean,” who is going to open up the bank account, or open up the exchange account, or run the business, and that person, because they don’t have ostensibly any connections to the illicit actor, that person is your face. That’s your proxy, but that happens in the money-laundering world in general, and there’s no reason why people can’t do that in crypto, and in fact, they do.
Tom Robinson:
And in fact, so, and most of the, well, in fact all the exchanges in China have now been closed down, but I understand there is a thriving peer-to-peer network of cryptocurrency brokers there. I would imagine it’d be fairly easy for North Korea to use one of those brokers in order to get into cash.
Laura Shin:
Interesting. So, it’s sort of like local Bitcoins, but in China.
Tom Robinson:
Right.
Laura Shin:
And probably, I guess for much bigger amounts of money. So, moving on from just bad state actors, in general, how much interest is there in state-sponsored cryptocurrencies?
Yaya Fanusie:
I think there is a lot of interest. I think there is a spectrum, where some states are saying, you know, “We don’t want to do anything, we don’t want to do central bank cryptocurrencies or digital currencies,” but there’s huge interest. In particular, I think some of the countries that are becoming more cashless, like some of the Scandinavian countries, where there’s not a lot of cash, there’s a lot of talk about, you know, or at least, there’s discussion about using or creating central banked, sorry, central bank digital currencies as sort of a, you know, as something to just add onto the fiat world.
So, there’s actually, and even the Fed has, you know, the Fed is looking at it. You know, several different folks in the Fed have talked about this. I think most are skeptical about, you know, independent cryptocurrencies, but it actually makes sense. I mean, the argument of, you know, not Bitcoin, but blockchain, sort of resonates with those, because there are a lot of risks. I mean, in central banks, it’s their mission to sort of maintain the monetary system. They’re not going to just open up and just latch onto a totally permission-less system, but the idea of a permission system, yes, a lot of the advanced economies are at least looking at it.
Tom Robinson:
I think it’s fascinating. I think it would have some massive implications. So, if everybody could effectively hold central bank money directly, then you have to ask, what is the point of traditional banks? I wouldn’t need to have an account at my local bank. I could have a central bank digital currency wallet on my phone. And so, if that happens, what is the process of credit creation? Who lends the businesses and individuals? Perhaps that is, well, it already is becoming more the case that peer-to-peer lending is taking over that role from banks. So, I think it’s a fascinating topic, and I’m not sure what’s going to happen there, though.
Laura Shin:
Yeah.
Yaya Fanusie:
One thing, if I can add, just to think about, is a lot of times I think, even the governments think that this would be a way to go, even, let’s say, in Russia and in China, and trying to create their own digital currency. They’re thinking that, “Hey, this is a way to displace the, you know, Bitcoin and the regular cryptocurrencies,” but you have to think about it. If there is a central bank digital currency, it also means you’re going to sort of have to build an infrastructure, right, where people are using this centralized crypto, and I wonder if that would actually make demand for the regular cryptocurrencies, the permission-less ones, to actually increase, right?
If you sort of enable people to get used to this method of transacting, of having, you know, wallets on their phone, you’re not going to be able to, unless you’re in a purely authoritarian country, keep people from using the regular cryptocurrencies. So, you may actually increase the competition, you know, depending on how you do it.
Laura Shin:
Yeah, and something else that I wonder is for, you know, I sort of feel like this competition would play out, it would be, like, maybe bad state actors with cryptocurrencies, people may not trust those cryptocurrencies. And so, in those markets, you might see an increase in trust in these decentralized ones, and then, I just wonder how that competition would play out if you had cryptocurrencies that were state-sponsored, that were maybe non-bad state actors, you know, would the decentralized ones still win out anyway? That is kind of an interesting question to me.
And then, the other thing that actually I’d been thinking about recently was about how people in Venezuela and Zimbabwe, and Argentina and places like that have been driven, because of hyper-inflation, to turn to cryptocurrencies like Bitcoin and others, and it just got me thinking that it sort of pushes adoption in these developing countries, primarily. And maybe not Argentina, but I think, you know, Venezuela and Zimbabwe, whereas, like, in a place like the US or, like, Sweden or Norway or something, where the money’s good and you trust it and you don’t feel any need, that you would see sort of this reverse adoption, where the technology takes off in a place where technology traditionally hasn’t taken off first, and then the citizens in those countries are sort of, like, one step behind, which is kind of interesting.
Yaya Fanusie:
People often point out to the adoption of Bitcoin and cryptocurrencies in these environments where, you know, the monetary system is sort of, you know, collapsed. But again, I would sort of, people’s enthusiasm needs to be tempered because, or curbed, because, you know, this is a sort of a coping mechanism. People just need to keep in mind that crypto is not necessarily solving the problem. You know, these countries are facing, like, economic crises and political crises that, you know, even if the population needs some sort of help, and crypto can help, it’s not fixing the crisis. It’s not solving the crisis. So, you know, none of this can be seen in isolation.
Laura Shin:
A couple last questions. Earlier in the spring, OFAC said it was going to begin putting individual digital currency addresses on its blocked-persons list. Why is this significant, and what could such a designation mean for any coins that are associated with those addresses?
Yaya Fanusie:
I mean, I’ll say, you know, something here, in terms of, it’s really unclear what, how this is going to play out. I mean, I think this was a signal from treasury, from, you know, OFAC, the office that deals with sanctions and designates people and entities, that they had to say that, you know, they’re aware that there is a new method of transacting that may not fall within the framework, or people might’ve thought might not fall within the sanctions framework, and the signal was, “Well, no, it does, and we’re not going to be held back, in terms of listening.”
But…so, if treasury does start designating, I think, I don’t think it’ll have, it’ll make a huge difference for, let’s say, just the everyday person trading crypto. But then, I do think it does have implications for institutions, for exchanges, because now the bar will be raised in terms of allowing, what you allow and your sort of levels of compliance to ensure that no one on your platform is transacting, one, with a blocked address, or an address which is transacting with an address. There’s going to be more scrutiny there, so I think it could have implications to that, maybe as also the fungibility of tokens.
That’s something that people have talked about, but it really depends on how this is going to play out, because I’m not sure that treasury, you know, designating an address is going to stop that actor from operating in crypto.
Tom Robinson:
Yeah, so, we will be adding the sanctioned cryptocurrency addresses to our database, and the implication of that is that if an exchange is using our AML software, and one of their users receives funds from a sanctioned address, or tries to send funds to one, then that will be flagged up to them, and so, they will be able to use that software to avoid transacting with sanctioned entities.
Laura Shin:
So, in addition to lost coins, we will see coins that are just sort of locked in these blocked addresses, that stop being circulated. So, Yaya, you advocated for a self-policing AML platform to prevent the tainting of coins associated with the OFAC list. How would such a platform work?
Yaya Fanusie:
You know, this is where, I put this suggestion out as a way to sort of provoke discussion as to how it should work, because, you know, at the end of the day, my sense is that folks in crypto are sort of waiting for, for someone else, for the government, for some other sort of regulatory entity to sort of be the policeman, right, or the police officer. What I’m trying to point out is that in other realms, like, let’s say in the cyber realm, you actually have a vibrant community of folks that try to, that use their cyber skills to, you know, to try to find hackers, and find vulnerabilities, right?
You have the white hat/black hat thing, and I think there should be something similar in crypto. I think that in order, because this technology allows for such transparency, it just seems that there should be cooperation amongst folks that love the technology, that are building the technology, to try to ensure that there are, you know, that there are flags on illicit activity. Yeah, go ahead, go ahead, Tom.
Tom Robinson:
So, Elliptic is kind of starting to become that intermediary. So, our customers, be they exchangers, law enforcement agencies, regulators, are starting to feed to us addresses that they know through their own research are associated with criminal activity, and then we will put all those addresses together in our system, so everybody has access to that, that information. We also work with a number of threat-intelligence companies to get that same kind of data. So, the private sector is, I think, stepping into that role at the moment.
Laura Shin:
Great, well, this has been such a fascinating discussion. Thank you both so much. Where can people learn more about your work?
Yaya Fanusie:
Well, you can find me at, or on Twitter, @SignCurve, and also, you can look at DefendDemocracy.org, that’s FDD’s web site.
Tom Robinson:
And you can find out more about Elliptic, including our research, at Elliptic.co, it’s Elliptic.co.
Laura Shin:
Great. Well, thank you both so much for coming on Unchained.
Yaya Fanusie:
Thank you…
Tom Robinson:
…very much.
Yaya Fanusie:
It’s been great.
Laura Shin:
Thanks so much for joining us today. To learn more about Yaya and Tom, check out the show notes inside your podcast episode. New episodes of Unchained come out every Tuesday. If you haven’t already, rate, review, and subscribe on Apple Podcasts. If you liked this episode, share it with your friends on Facebook, Twitter, or LinkedIn, and if you’re not yet subscribed to my other podcast, Unconfirmed, I highly recommend you check it out and subscribe now. Unchained is produced by me, Laura Shin, with help from Elaine Zelby, Fractal Recordings, Jennie Josephson, Rahul Singireddy and Daniel Nuss. Thanks for listening.
