Unchained - How Widespread Is Money Laundering in Crypto? - Ep.72

Episode Date: July 17, 2018

Yaya Fanusie, director of analysis at the Center on Sanctions and Illicit Finance at the Foundation for Defense of Democracies, and Tom Robinson, chief data officer and cofounder of blockchain analytics firm Elliptic, discuss how common money laundering is in crypto, how jihadist groups are using it, and how privacy coins (really Monero) affect their work. (The reason why the dark markets haven't much used Zcash surprised me.) We also discuss bad state actors using cryptocurrency, such as Venezuela's efforts with the metro and North Korea's alleged Bitcoin ransomware attacks, and how, leaving aside bad state actors, central bank cryptocurrencies would compete with decentralized ones. Plus, we discuss what impact OFAC blocked addresses list will have. Thank you to our sponsors! Preciate: https://preciate.org Quantstamp: https://quantstamp.com Yaya Fanusie: https://twitter.com/SignCurve Center on Sanctions and Illicit Finance at the Foundation for Defense of Democracies: http://www.defenddemocracy.org/csif Tom Robinson: https://twitter.com/tomrobin    Elliptic: http://www.elliptic.co Yaya and Tom's report on Bitcoin laundering: http://www.defenddemocracy.org/content/uploads/documents/MEMO_Bitcoin_Laundering.pdf New AML regulations on cryptocurrencies in Europe: https://www.elliptic.co/our-thinking/5th-aml-directive-eu-regulation-cryptocurrency Money laundering in ICOs: https://www.elliptic.co/our-thinking/ico-risk-why-aml-compliance-matters Yaya's op-ed on the Venezuelan metro in CoinDesk: https://www.coindesk.com/crypto-investors-stay-away-venezuelas-petro/ Russia's blockchain plans: http://thehill.com/blogs/pundits-blog/technology/346476-blockchain-technology-may-give-russia-its-next-sputnik-moment What jihadists are doing with crypto assets: https://www.thecipherbrief.com/article/exclusive/international/terrorist-networks-eye-bitcoin-cryptocurrencys-price-rises https://www.thecipherbrief.com/column/private-sector/the-new-frontier-in-terror-fundraising-bitcoin Yaya's essay on self-policing in CoinDesk: https://www.coindesk.com/crypto-community-must-use-blockchain-self-police/ Learn more about your ad choices. Visit megaphone.fm/adchoices

Hi, everyone. Welcome to Unchanged. You're no-hype resource for all things crypto. I'm your host, Laura Shin. If you've been enjoying Unchained, pop into iTunes to give us a top rating or review. That helps other listeners find the show. It's your career. Own it with Appreciate. Build the real-time story of your most valuable accomplishments as told by those who know you best. Download Appreciate Now in the iTunes app store. contracts are on the rise, and that trend will only continue. Security has become an absolute necessity, and Quant Stamp is the standard for smart contract security for the blockchain. With a team of security experts dedicated to defeating the bad actors, Quant Stamp is the gold standard for safer, more reliable smart contracts. Find out more at Quant Stamp.com. My guests today are Yaya Fanusi, Director of Analysis at the Center on Sanctions and Illicit Finance at the Foundation for Defensive Democracies, and Tom Robinson, Chief Data Officer and co-founder of blockchain analytics firm, Elliptic. Welcome, Yaya and Tom. Thank you. Great to be here. Hi, Laura. Yaya, let's start with you. What's your background and how did you get into crypto?

So I have a background as a counterterrorism analyst. I actually started several years ago at the Central Intelligence Agency. I was hired as an economic analyst and then got into counterterrorism. And when I left the agency, I worked in financial asset recovery, basically working with a team to identify assets that were kleptocratic assets that were hidden around the globe. And while I was doing that, I got connected to FDD, the Foundation for Defense of Democracies, which is a national security nonpartisan think tank here in Washington, D.C. and became the director of analysis for this new center, which focuses on looking at economic security and U.S. national security issues. And so since I got involved with FDD back in 2015, I started researching, developing, and new emerging illicit finance threats and risks. And that sort of led me to crypto, just sort of being very curious about how crypto was being used by illicit actors. And for the past couple of years, I've been doing some deep dives and helping to engage policymakers on the risks and the benefits of the technology.

And Tom, what is your background and how did you get into crypto? So originally I was a physicist. So I did a PhD in physics. So I was specializing in atomic and laser physics. I was trying to build an x-ray laser. So I did that for about four years, eventually sold out and went to work in finance. And then in about 2011, I heard about Bitcoin from an economist friend, became fascinated in the technology, and eventually persuaded a couple of friends to co-found Eliptic with me. And so we're really passionate about helping cryptocurrencies to go mainstream. And the key issue that we saw was holding that back was the criminal use of cryptocurrencies.

So our mission as a company is to work to detect and prevent the criminal use of cryptocurrencies, which we do in two main ways. So first of all, we work with law enforcement agencies to help them to trace cryptocurrency transactions that originate in criminal activity. And we also work with financial institutions to prevent proceeds of crime in crypto from being laundered through their platforms. So when we say a financial institution, that can mean everything from a small crypto. currency exchange to a multinational bank.

So I've been doing that for about five years now, working some of the largest law enforcement agencies and cryptocurrency exchanges in the world. I love it. I feel like you two would make great characters for some future movie about crypto. It's like X-CIA, ex-physicist working on lasers. So you two co-authored a study on Bitcoin laundering

that came out earlier this year. And before we actually dive into the details of that study, how big of a problem is laundering with crypto? So I think it's becoming an increasingly important problem. So in our study, we were looking at funds originating from cybercriminal activity, such as dark marketplaces, ransomware attacks, thefts from Bitcoin exchanges, which in itself is a big problem. I think what we're starting to see in addition to this is proceeds of crime

from non-cybercriminal activity to start being laundered through cryptocurrencies and other crypto assets. So I think it's starting, as liquidity increases in these assets, then the scale of the problem is really increasing. Do you have any numbers that you can offer? I'll jump in here. I mean, Tom may want to add to this, but actually, this was an issue that we dealt with when we started looking at the data because there's always this desire to list. a number, how much is being laundered through crypto or through Bitcoin. We only looked at Bitcoin. We looked at transactions from 2013 and 2016. And it was interesting because we set up front that our study was looking at data, but we were not assessing the total or estimating the total amount of laundering

that is occurring because that's really a very, it's very difficult, just a complicated thing to try to actually pin down. I think sometimes when you hear people talking about actual numbers, they're pretty much guesstimates. We took the tack of looking at actual transactions coming emanating from specific illicit markets, dark nets, dark net markets, and similar illicit sources. And then just identifying how much of that or out of the amounts going into conversion services, like exchanges, how much of that specifically was elicit. So we're not saying that there is X amount of laundering happening in crypto, but we're providing with the study and assessment of trends that have happened emanating

from dark markets, patterns, geographical changes, the U.S. versus Europe versus Asia. And that's what we were really trying to do because so much of the conversation in this space lacks data and people don't actually point to transactional data, and that's what we were trying to do with the study. I did see a number that I think a director of Europol gave, but it sounds like you're saying that that is probably some sort of estimate that maybe isn't based in really, I guess, detailed research. So one figure we did provide was that less than 1% of the funds going in, to these services, these exchange services, originated directly from these identifiable criminal entities. And I think that's an important figure because these are funds that the exchange in theory could identify as being illicit through software like ours. And so it shows you the level

of criminal funds going into those exchanges, which could be avoided. Okay. So maybe we can, I guess, hang on to that a little bit, although I do wonder if in the year 2017, if that changed because since the years of your study covered 2013 to 2016, I feel like that was a much different time in crypto. Because everything changed last year. But why don't we dive into the details of your study? So, you know, obviously you mentioned that you were looking at very specific transactions that are going from these notes. addresses to other services, but is that how you would define money laundering in crypto generally? Or was that just for research purposes? Yeah, I actually would say that it's interesting. You pointed to the shift, you know, money laundering generally is a multi-layered process, right? That involves, you know, taking illicit proceeds, putting them in the, you know, either the banking

system or putting them in another business. moving them, layering them. And, you know, it's a very, you know, a process where you're going in between different ecosystems. Whereas with Bitcoin, as we looked at it, you know, we're really talking about just one ecosystem. So I think we have to think about laundering a little bit differently. It's sort of a different framework. The interesting thing is, you know, maybe last year, for example, the question might have come

up, well, will different elicit actors use? And this is actually shifting a bit from our study, but I hope you don't mind me just sort of going on a bit of a tangent. You know, people would ask, you know, are, let's say, drug cartels using, are they money laundering through Bitcoin, right? And, you know, we may assess that, you know, a lot of drug cartels aren't necessarily going to be exchanging. They're not going to be shifting to Bitcoin when they have all these other methods of doing laundering. But I think something that I've noticed the past six to seven months, there have just been more reports of maybe not shifting to crypto to launder illicit proceeds, right? If you're from the fiat world, but actually experimenting using accessing crypto as part of the process of shifting funds, moving funds. So I think we have to look at crypto as being another toolkit for laundering from the perspective of illicit access.

who are looking for different ways to mix and move funds around. So in a way, the way we should maybe think of your study is that you are looking at a subset of the type of money laundering activities that could be done in crypto. And so your findings are sort of focused around that one subset. Yeah. So I think we're focusing here on what we call Bitcoin laundering. And this is where the illicit proceeds have originated in Bitcoin. So, for example, ransomware or a dark marketplace, the actual activity has been in Bitcoin, as opposed to generic money laundering.

So, for example, if an organized crime gang in Europe is selling drugs for cash and then it's trying to transfer that cash back to Colombia, they might use Bitcoin as a means to transfer that value. But the funds didn't originate in cryptocurrency originally. Okay. So what were the biggest takeaways from your study? Well, there were a few. I mean, again, looking at the 2013 to 2016 timeline, some not surprising, like as Tom mentioned, that, you know, dark net markets being the main origin of most of these illicit funds. But what was really interesting from a policy perspective was, one, the big difference between laundering that we saw on, European exchanges versus North American exchanges. There was a significant gap. And I think that was one, that was probably one of the biggest

takeaways. I mean, evidence, very clear by looking at the data that there was just much more illicit activity happening on European platforms. And why do you think that was the case? Because I also noticed that and thought that was super interesting, but I'm not sure of why.

Was it really kind of, well, I had one theory, but I'm interested to hear your take? I think we concluded that one possible reason for this was the difference in regulatory responses to cryptocurrencies. So in the US, FinCEN, back in 2013, issued guidance that virtual currency exchanges, as they called them, were money transmitters and were therefore subject to anti-money laundering and CFT requirements. So, for example, exchanges had to identify who their customers were through KYC processes, had to submit suspicious transaction reports to regulators.

And I think that probably did have a huge impact and prevented criminals from cashing out to some extent through exchanges based in the US. There was no such move in Europe. So exchanges were free to operate without identifying any of their clients. And that's only changed very recently. So the fifth anti-money laundering directive has now been finalized in the EU, which means that virtual currency exchanges and custodial wallet services now will have to identify their customers, will have to submit suspicious transaction reports.

And so I would hopefully see that making a big difference to these figures. But those controls still won't come into force until probably the end of next year. One other theory that I had was that I wondered what percentage of those transactions were going through BTCE, which came down last summer, because they were such a sketchy exchange. So was that kind of a huge worth it? Or was that one exchange accounting for a huge percentage of these transactions? Yeah, I think so, Tom, I don't know if you want a lot. So yes, there were a few big players who contributed a lot of that. Yeah, so there were a few bad actors who were disproportionately affected that figure. Oh, interesting.

Something else that surprised me when I was looking at your study is that a huge percentage of these money launders were directly moving their dirty coins to an exchange rather than using a mixer or Tumblr first. Why do you think they would do that just because they knew that these exchanges didn't care? I think back in 2013, which is when the period of this study started, people just weren't aware of how transparent Bitcoin is. There weren't the same tools available to exchanges of law enforcement that are now available, and therefore the risk of sending your dirty funds straight to an exchange was much lower. And we should also note, though, I mean, so that's true. And also, we did find that gambling sites and mixers, as you might expect, did have a high

proportion of illicit funds going through them. So it was sort of evidence that, you know, people do use these tools to launder to launder funds before they send them elsewhere. Yeah, I guess I would have thought it would be a much higher percentage than it was. But something I was curious about is, have you guys looked into whether or not any ICOs have been used for money laundering? Yes, so that's something we have looked into. We have seen evidence that the proceeds of some criminal activity have been fed into ICOs, yes, not on a large scale at the moment. but we have seen it happen, which makes sense. What does that mean, meaning that the people who are trying to invest to get new tokens,

to buy into the sale that they're using? Yeah, so for example, somebody has hacked an exchange, stolen some ether. We've seen, in some cases, that ether being transferred to an ICO, crowd sale address. And so they would have received tokens in exchange for that stolen ether. And that's useful for them because if no records are being kept, if no KYC is being done by the issuer, then that helps break that link to the illicit source of funds. And how widespread of a problem do you think that is? So we haven't seen it a great deal, but it's a risk that ICA issuers and bank,

are actually quite sensitive to. So a problem that a lot of ICO issues are having at the moment is that they raise these huge amounts through ICOs converted into fiat currency, but are then unable to find a bank that will accept those funds. And so a lot of them are turning to us to do an analysis on the source of funds and just verify that it hasn't come from criminal activity. Interesting. Well, as we mentioned before, you kept this study, the focus of the study sort of narrow. So what other questions would you like to answer next time around if you, you know, look more into money laundering and cryptocurrencies? Betmoot activated. The ScoreBet app here with trusted stats and real-time sports news.

Yeah, hey, who should I take in the Boston game? Well, statistically speaking. Nah, no more statistically speaking. I want hot takes. I want knee-jerk reactions. That's not really what I do. Is that because you don't have any knees? Or... The score bet. Trusted sports. content, seamless sports betting. Download today. 19 plus, Ontario only. If you have questions or concerns about your gambling or the gambling of someone close to you, please go to conicsonterio.ca.

Local news is in decline across Canada, and this is bad news for all of us. With less local news, noise, rumors, and misinformation fill the void. And it gets harder to separate truth from fiction. That's why CBC News is putting more journalists in more places across Canada, reporting on the ground from where you live, telling the story. Stories that matter to all of us because local news is big news. Choose news, not noise. CBC News.

I think actually you hit on one, which is on our mind right now, which is what does the landscape look like now that BTCE is gone. I mean, you're very right. You know, back in 2016 and even early part of 2017, you know, BTCE was so prominent. I mean, there were just, you know, just many examples of illicit activity going through there. And so with that being shut down and also the shift in different darknet markets going down, Alpha Bay being shut down. A big question is, and I hate to say it like this, but who is or what is the next BTCE? That's, I think, the biggest question and something that we want to look at the data and see what the answer is. Something else I'm curious about is I've heard this stat, tell me if I'm wrong, but I heard that regulators catch less than 1% of all money laundering that uses fiat. So if that is true, why would a criminal be motivated to use cryptocurrencies for money laundering? Oh, I guess, well, in this case of this study, it's because that's the crime that they, like, they were earning this money already in crypto.

Yeah, I mean, I think, you know, they're different. So think of crypto as, I mean, as we know, right, this is money native to the internet. So although this is changing, I think in the earlier days, you're pretty much, you were pretty much talking about folks who are involved in cybercrime, involved in crimes that are purely on the internet and it would just make sense. And, you know, if you're dealing with the dark net market, you know, it just makes sense to use crypto. It's perfect for that.

But I think what's shifting, and it's funny, it's sort of a double-edged sword because adoption has been the biggest hurdle, but as adoption increases, it only makes sense that more people who maybe aren't just operating in cyber will eventually start using crypto. Now, there's one example, which is, you know, it's not an outright sort of money laundering case, but late last year, there was a woman, you know, or late 2017, there was a woman who, the Department of Justice indicted for sending money to ISIS. And she did so really through the banks. She used wire transfers and she was trying to get money to Syria, basically. But one of the things that she did was she used her credit cards. And she used her credit cards to purchase crypto. Think Bitcoin and maybe

some other cryptocurrencies. So why would she do that? What was the benefit? Well, if you think about one thing, if you are, let's say, you don't care about your credit and you're just trying to send money to ISIS, right? And you get your, a credit card. Now, if you want to, let's say, get a cash advance, you know, max out your credit cards, you can't do that. You can't use a credit card and then just get cash, you know, max out $10,000, $20,000. But what you could do, at least I know at the time you could, you could purchase $10,000 or $20,000 or $50,000 worth of crypto. And, you know, maybe if you had multiple credit cards. So that's one. way to quickly get value and then use it for an illicit purpose to send to send overseas.

Now, she didn't send crypto overseas. She then went into the banking system. But it just shows that this is just one additional tool, one way of circumventing barriers and legal hurdles, to try to transact illicitly. Interesting. All right. We're going to talk about privacy coins, bad state actors using crypto and more. But first, I'd like to take a quick break. to tell you about our fabulous sponsors. Imagine this. You dedicate countless hours of hard work to creating a smart contract

only to be hacked in mere minutes. If you think that can't happen, think again. We hear that $10 billion has been raised through smart contracts, but over $300 million of that has already been compromised. Hackers are hungry for more, so security is not just critical

to your success. It's an absolute necessity. And that is where Quant Stamp, the standard for smart contract security comes in. With a team of security audit experts, dedicating to defeating the bad guys, the quant stamp of approval, is your solution for safer smart contracts. Find out how we can be the gold standard for security at quantstamp.com. Why is it that when you change jobs, you lose all that hard-earned credit for all the good things you accomplished? Does it make sense that your performance

review is forever stuck at your old company? No. And that's why Appreciate is live on the iTunes app store. Build the real-time story of your most valuable accomplishments as recognized by those who know you best. Appreciate is the truest story of you, forever yours to showcase. Big or small, earn credit for all the good you do. It's your career. Own it. Appreciate Simple give get-grow model makes it easy to strengthen relationships by giving recognition while building your own portfolio of accomplishments. Download Appreciate Now in the iTunes App Store. Appreciate is powered by the GC Protocol. I'm speaking with Yaya Fanusi and Tom Robinson. How are privacy coins like Monaro and Zcash affecting your ability to do this type of work?

So we are starting to see increased usage of Monaro by some criminal actors. So for example, a number, in fact, most new dark net marketplaces now offer Manero as a payment option, although they are also branching out into Bitcoin Cash, Lightcoin and a few others. We're also starting to see Minero start to be used during the laundering process. So, for example, a ransomware operator might have managed to extract some Bitcoins out of their victims. In order to prevent people like as being able to trace those funds, they might swap into Minero at some point through an exchange. and that means that it's then very difficult to continue following the trail. We don't see much or in fact any illicit use of Zcash, perhaps surprisingly,

other than the shadow brokers offering some of their dumps in return for Zcash payments, we haven't really seen any dark net adoption of Zcash. And what is a shadowbroker? So the shadow brokers were a hacker group who were able to, steal some exploits and hacking tools from the NSA and I think some other groups and offer those for sale for cryptocurrency. So for example, the exploit that led to the Wanna Cry ransomware outbreak that came from that group. And for Manero, when you said that a lot of them are maybe performing ransomware and earning Bitcoin and then exchanging it to Manero so you can't follow the trail,

can't you find out from the exchange who did that? You can as long as the exchange is doing KYC, i.e. they know who their clients are, and that's simply not the case for some exchanges. So, for example, ShapeShift, don't do KYC. And for that reason, for example, the funds from the Wanna Cry Ransomware, we're in Bitcoin, we're sent to ShapeShift, and we're then converted to Manaro.

There's not much in that situation you can do, to continue tracing the funds. Interesting. And yeah, I mean, we've seen this, we've seen examples of this hurdle from, from Benaro, for example, since 2016, one of the things we've been doing at our center is tracking some jihadist fundraising campaigns that have been, you know, openly running on social media and on telegram channels that haven't raised a whole lot of money. But the thing is, we've, because some of these groups have been very open,

and have posted their Bitcoin address, we've been able to do analysis, you know, look at the transactions, go to, you know, let's say even a blockchain, a Bitcoin blockchain browser and just, you know, see what they have, how much money they've raised. And so there was this one jihadist group that apparently is based in Syria, operates on Telegram and Twitter. And late 2017, we were really just tracking them because they were saying, hey, send us money. We'll use it for weapons. supplies. And so we were tracking them for several months, just seeing what they were doing, how much they were raising. And at one point, I remember they posted a new graphic, which said, you know, now you can pay us in Monero. Actually, it wasn't just Minero. They said they had a

couple of other cryptocurrencies, but they listed their Minero address. And so I hadn't personally, I hadn't really been looking at Monero before. I just hadn't had a case with Monero. So I, you know, thought, I said, okay, wow, this is great. Now we've got the Monero address they're using. So I went to the Monero browser that you can look at and you, you know, can put in the address. I put the wallet address in there. And as opposed to the typical Bitcoin browser where you can see all the transactions, see how much is there. The Monero browser gives you a prompt once you try to, you know, look at that address.

And it literally says something like, are you trying to look at this guy's Minero address? Menero says no. So there's absolutely no access, even though it's clear that that is an address, but we couldn't see what was in it, how much it had transacted. So that's just a very real example of the difference between some of the privacy coins and Bitcoin and more other public blockchains. And do you have a theory as to why Zcash is not being taken up? The creator of Zcash, by the way, Zucco Wilcox, he was on Unchained. And that's a great episode of, If people haven't listened to it, you should go back and check it out. But he did say that. But I wasn't sure if he was being totally honest. But it's interesting that you're confirming that.

Yeah, I think it's true. And I think one of the reasons for that is in the criminal community, there is a huge amount of distrust about Zcash. It's seen as being part of the establishment. You know, it's backed by venture capital money. It works with the big banks. the whole ethos behind it is something that they distrust, as opposed to Monaro, which is very much more just an open source project and which they are therefore more willing to put their trust behind. Oh my God. I can't believe it's ideological. I don't know why I didn't think of that.

My theory was that I guess it's more expensive to use the privacy side of it and just more computationally intensive and whatever. So maybe I just thought it's like a little bit more of a pain to use it in the private format or something. I was thinking just a long purely practical. Yeah. I mean, I would personally use the technology that I thought was the most anonymous, but I think ideology in some cases can trump that. That's interesting.

And so just to draw out the thread there, so if I am a hacker that obtains Monero, Monero is not easily convertible to Fiat, I imagine. And so what I would do is maybe then use shape shift again to turn it into Bitcoin and then cash out or something. Is that what you think is going on there? Yes. Yeah, I think that does happen a lot. There are exchanges, though, that accept Minero deposits and where you can cash out into Fiat.

So it is possible in some places to do that directly. Interesting. Let's also talk about what the kind of governmental response has been. like if you were to describe the spectrum of responses we're seeing from different countries, what are you noticing there? And has there been an evolution in the state response? Yeah. I mean, well, it definitely depends on which country, which jurisdiction you're talking about. I mean, you know, here in the U.S., as Tom mentioned, there was a pretty, you know, early, early on there was guidance that was put out. And I think that, you know, our study shows that that that actually impact

the amount of illicit activity. You know, I think some of the other states, so for example, one of the things that we've been looking at here has been Russia. You know, what has Russia's reaction been? And actually, there's a really interesting pattern that we see with some particularly authoritarian governments. I mean, you can draw this parallel across jurisdictions, which is people using crypto and then a lot of state, some influential folks in states saying,

you know, this should be banned or we need to really restrict this because, you know, one, we can't control it, whether it's concerns about capital flight or concerns about illicit risks. And, you know, back in 20, I think it was 2014, 2015. In Russia, there was talk about, you know, making it illegal to have a Bitcoin business. And then we saw in 2016, 2017, there was a shift where, instead of talk about banning Bitcoin, the Russian government actually started talking about, maybe we could use this technology, maybe this blockchain technology and cryptocurrencies, they said sometimes could be used to evade sanctions.

You see something similar in Venezuela, where, you know, you might have talked before about how Venezuela has, because of the cheap electricity, Bitcoin and Bitcoin mining became very popular. the government was trying to ban that. And then what did it do in early 2018? It unveiled its own cryptocurrency based on the NEM blockchain. And there's even talk now about Iran. Iran, you know, recently has started to crack down on Bitcoin and Bitcoin exchanging within the country as its currency has really gone down and is facing more financial pressure because of U.S. So there is this pattern of some governments being afraid of crypto, then seeing the technology maybe could be used to advance its aims, and then they start embarking on projects or even investing in the technology. And I think Russia is probably the biggest example of that right now. Yeah, I actually just want to flag for listeners who maybe don't listen to my other podcast

Unconfirmed. You should definitely check out the episode I did with Alex Gladstein of the Human of the Human Rights Foundation. Oh my God, it was such an interesting conversation, but he talked about how Venezuela was what he considered the site of the first crypto war. And he described, you know, what you just mentioned, Yaya, which is people there, obviously, as the boulevard has crashed, they've been turning to cryptocurrencies and trying to mine them in different things. And the government has been trying to confiscate their equipment. And then, of course, now has tried to launch their own cryptocurrency. But it was a really fascinating conversation and he goes into that a little bit. And I do

think that is what's going on there, which is interesting. Yaya, you also mentioned Russia. What do you think because they are being maybe more proactive and open toward this technology than a government like the U.S., at least for now, what significance do you think that could have for, I guess, our relations with that country? Well, it's a huge geopolitical shift. I won't say shift, but I think it may have geopolitical implications, depending on how things turn out. So Russia, just to sort of give more of a backdrop, you know, why is Russia doing what it's doing? You know, Russian banks, several huge Russian banks are under U.S. and EU sanctions for, you know, for annexation of Crimea. And so Russia has sort of felt that its banking sector is being hindered by these sanctions. And so one of the things that they started doing is, you know, like they're doing, like other countries are doing,

investing in pilot projects, blockchain projects, getting the banking sector to consider using blockchain technology, which is, again, that's sort of par for the course. I think we see that elsewhere. And even in the U.S., I think it's a little bit different. I don't think the U.S., it's that Russia is a better environment for blockchain or for crypto, just that there is a much stronger strategic intent by the leadership of the country to say, okay, we're really going to ramp up and do this so that we don't have to deal with sanctions. So the implications are, you know, if Russia were to develop and create,

an alternative system. So like an alternative system to the swift banking system, which is how, you know, banks transfer money around the globe through the regular banking system. You know, if they were able to create a blockchain-based system where financial institutions and businesses could transfer value around the globe without going through the traditional banking system, theoretically, it would make them maybe more, more impervious to U.S. sanctions to EU sanctions, which means that, you know, maybe Russia can do what it wants without less fear of international repercussions and financial repercussions. Now, I don't think that that's necessarily, even though Russia has pretty much said that

it wants to do that. I don't think that that necessarily means that it's going to occur because it's much more difficult. I mean, it's easier said than done. And also, in order for that to work, you know, it couldn't just be something that Russia does. Russia can't just build a alternative blockchain. a financial network and then, you know, transac with the rest of the world. Other countries

would have to buy in. But that's what we're looking at. There's even been, I think, some signaling that Russia is talking to Iran now that, you know, that the U.S. has removed the nuclear sanctions. I'm sorry, it's put back the JCPOA, the nuclear sanctions. There's an environment where it might be in the interest of a country like Iran to actually cooperate with Russia. But again, All of these things right now are still in play. It's not clear how it's all going to fall out. Yeah, it's kind of interesting because it does make me think, I totally agree with your point, that Russia could develop that kind of a system, but it wouldn't be useful unless they had buy-in from other players,

because obviously these are networks, and so you need other people on the network to make it useful. but it just put in my mind the idea of potentially someday some sort of like crypto network that is just moving money between all the bad state actors. I actually, though, wanted to circle back to this conversation around Venezuela as well. I wanted to get your take. Have you looked into this sort of like crypto war as Alex Gladstein had described it that's going on there? And do you have a sense of a kind of which side is sort of winning out? Because I think my main thing about the Petro is apparently you can't see the transactions there. So do we have any visibility to how well that's doing?

We've been looking into the Petro because a lot of our US-based exchange clients are very concerned that they might have some exposure to funds originating from the Petro. And so we've looked at the small contracts involved. So originally the Petro was going to be based on Ethereum. It's going to be an ERC20 token. But then they switched over to NAM. So there is a NAM contract, which is called the Petro, which people have referred to. There have been some transactions on it, but nothing on the scale that you'd expect from a public crowd sale of tokens on the scale that's been reported.

We also have seen no evidence that anybody has actually successfully been able to pay for any tokens in the public crowd sale. So it's overall very unclear what's actually going on here, if anything, at all. Yeah. And I agree. And, you know, the way I'd also, you know, characterize it is, you know, the Petro right now appears to be a failed experiment, but I don't think that it is an insignificant one. I actually think it's pretty significant because it's actually a test case. It's the case of a government, which is, you know,

involved in human rights abuses, massive corruption, under sanctions by the U.S., trying to figure out a way to use this technology to undermine those sanctions and to bring value to the regime. And I actually think that the way Venezuela has done it, it shows it's just very, you know, poorly done and just it's been a disaster in terms of their execution. But it actually provides, I think, lessons learned for, unfortunately, for other actors who may be in a similar situation in the future, you know, there have been some reports that Russia has been very supportive of this campaign, of the Petro and maybe even be involved or pulling the strings. It's a little bit unclear. But I'd say that this is something that other countries and even other non-state actors could learn from, you know, the mistakes. at all. And what would be some lessons that you think they might learn? Well, you know, you exactly, you know, which type of blockchain is is more advantageous. And, you know, one, one thing is just how they, how they have structured it. So looking at the NEM blockchain, you know,

I think what it looks like from our standpoint is they created the tokens, you know, something called the Petro on the blockchain, and then they said that they would be available for pre-sale. We don't really see that. It looks like they've deployed, they've separated the tokens into wallets where, from my standpoint, it seems like maybe these are the, you know, they've set up wallets, which would be used for people to purchase through exchanges or what have you. But when you look at Venezuela's infrastructure, they don't really, they don't really, they don't, they don't really have in a thriving or robust exchange industry. You know, so it just really seems like a very, like a fumble, they sort of put the cart before the horse. I mean, I think like with any

ICO, in order for people to have confidence in your token and the value of it, you need to show some basic level of technical aptitude, otherwise people are going to lose faith. And with a petro, it's, yeah, just very unclear what's going on. Yeah. And I think another lesson, to learn would be if they couldn't manage the Bolivar well, then it shouldn't give you a lot of faith in Petro. Exactly. And they also didn't, they didn't get any public, you know, buy-in. There was not, there was no one country that said, all right, we'll support this, you know, maybe behind closed doors, but nothing, nothing publicly.

So without that, I mean, yeah, it's really, it really has no value. Yeah. It's sort of like someone just going on the street and saying like this is valuable, but, you know, if other people don't back you, then nobody's going to believe you. One other, and actually the last lesson that I would hope that people would take away and or you tell me if this should be a lesson, but I would hope that people would also say that for a project that is centralized, that creates a point of failure if there's kind of like this one organization that's, controlling it, but maybe that a decentralized crypto asset would be more successful? Do you think that could be another lesson people might learn? I think so. I mean, I think this sort of, the Petro hit people out of nowhere and, you know, people were sort of unsure what to think about it. But it's, I mean, the way it's played out actually kind of proves the point that, you know,

all tokens are not created equal. And just because someone, you know, some, some, some entity says, it's creating a token doesn't mean that, you know, one, it should be supported, that you should try to, you know, that you should try to invest in it. And so hopefully this sort of raised that issue because I think mostly in the crypto space, there's been this idea of, okay, you know, for the folks who love crypto and right are trying to build this ecosystem, it's almost like, okay, we want to support this. We want to support, you know, innovation. And I think this sort of, it brings home the point that just because a token is created doesn't mean that it should be supported. And also I think the idea behind the Petro, the thing that was going to give it its

value was the fact that each token was backed by Venezuelan state assets. I think each one was backed by a barrel of oil. And so if you're going to have that kind of backing, I think it's difficult to do that in a decentralized way. There needs to be this central party that you can go back to and redeem the token if you want to. Yeah, and trust that they actually will give you an oil or a barrel of oil worth the same value. So speaking of bad state actors, what about North Korea? They were most likely behind the WannaCry attack, which we mentioned earlier. And some people say they may have been behind some of the hacks of South Korean exchanges.

What do you think that they're doing with cryptocurrencies and why? What's their motivation? Tom, do you want to touch on this first? So I think the primary motivation is just to raise hard currency. I think they are looking at ways that they can easily steal money and probably have identified things like ransomware and the hacking of exchanges being low-hanging through. And so that's what they've targeted.

I think that probably also has implications for sanctions, YOL. Yes, it does. But I often sort of temper people's, expectations with the idea of major, or at least I think the scope and scale is important to note because, you know, North Korea has a very robust sanctions evasion operation, you know, and it involves using, actually using the banking system, using, you know, partnering with certain Chinese banks that allow it to operate. Shipping, like so many other very real world ways, front companies, right, to,

to launder funds and also to evade sanctions. And like with many things with crypto, this is an experimentation period. So I think the implications are, okay, so North Korea is stealing crypto. They're doing ransomware. They're stocking up probably. So that does mean that there's going to be, that they're going to use it, right? That's a way for them to gain capital. But it doesn't compare to the scope of what they're doing elsewhere. I think it just, it does mean that we have to those that are concerned about proliferation and what North Korea is doing, you know, have to be mindful that it is trying to learn. It is trying to get involved in this technology. And so that the implications may be stronger in the horizon, but limited now.

I think one other interesting thing here is there are some indications that the people who perpetrated these attacks weren't necessarily in North Korea and that perhaps these attacks have been outsourced. hacker groups. And I think that's a trend we're starting to see, which has been enabled by cryptocurrencies, this idea as cybercrime as a service. So previously we would have had the people who are willing to commit the criminal activity and the people who have the technical aptitude to actually do it. And with cryptocurrencies and dot-bett marketplaces, we now have, well, there's now the potential for these people to come together and pay each other to do part of the job for them. So for example, you can buy ransomware kits on dark marketplaces, or you can commission somebody to build some custom ransomware for you. And that's being

enabled through the semi-alonymous cryptocurrency payments. Oh, wow. And when you say kit, it's like a software program. Is that what you mean? Exactly. Yeah. So you can specify, for example, what Bitcoin address the victim's fund should be sent to. I would imagine that that kind of cybercrime as a service would be especially important for a country like North Korea where they're essentially imprisoning all the citizens, you know, like blocking them off from the outside world, not letting them travel outside the country, brainwashing them, like all those things. Because if any of their citizens were trained in how to obtain cryptocurrencies on their own, then they could very easily be like, oh, this is like my way out of the country. I can raise enough money to pay my way out to South Korea or whatever it might be. So I could see them hiring that out. Out of curiosity, though, so let's say that I am a North Korean, or I'm North Korea and I've hacked people for or perform ransomware to obtain Bitcoin. Then maybe I convert that to Manero to kind of launder the money and then convert it back to Bitcoin in some

fashion. How do I cash out? You know, is it just a matter of finding an exchange that doesn't do KYC or what? Yeah, you probably have. So because they are, you really just need to plug into the money laundering apparatus that they already have. So they already have individuals, companies that serve as fronts in the shipping industry. One of the things that, you know, North Korea uses or one of the things that they do is, you know, they will get luxury goods. So, you know, while the country, the regular people are starving, you know, the regime has, you know, luxury goods that it purchases. And, you know, you could use, you could easily find ways to, you know, integrate your funds within the regular banking system and make those purchases. So, I mean, using cutouts is what most illicit actors do. So cutouts being, you know, someone who's, someone who is quote unquote clean, who is going to open up. the bank account or open up the exchange account or run the business and that person, because

they don't have, you know, ostensibly any connections to the illicit actor, that person is your face. That's your proxy. But that happens in the money laundering world in general. And there's no reason why people can't do that in crypto. And in fact, they do. And in fact, most of the exchange, well, in fact, all the exchanges in China have now been closed down.

But I understand there is a thriving peer-to-peer. and network of cryptocurrency brokers there, I would imagine it would be fairly easy for North Korea to use one of those brokers in order to get into cash. Oh, interesting. So it's sort of like local bitcoins, but in China. Right. And probably, I guess, for much bigger amounts of money. So moving on from just bad state actors, in general, how much interest is there in state

sponsored cryptocurrencies? I mean, I think that's, I think there is a lot of interest. I think there is a spectrum where some states are saying, you know, let's say we don't want to do anything. We don't want to do central bank cryptocurrencies or digital currencies. But there's huge interest. And in particular, I think some of the countries that are becoming more cashless, like some of the Scandinavian countries where there's not a lot of cash, there's a lot of talk about, you know, or at least there's discussion about using or creating central banked, central bank. sorry, central bank digital currencies as sort of an, you know, as something to just add on to the Fiat world. So there's actually, even the Fed has, you know, the Fed is looking at it. You know, there's several

different folks in the Fed have talked about this. I think most are skeptical about, you know, independent cryptocurrencies. But it actually makes sense. I mean, the argument of, you know, not Bitcoin, but blockchain sort of resonates with those because there are a lot of risk. I mean, and central banks, it's their mission to sort of maintain the monetary system. They're not going to just open up and just latch on to a totally permissionless system. But the idea of a permission system, yes, a lot of the advanced economies are at least looking at it. So I think it's fascinating. I think it would have some massive implications. So if everybody could effectively hold central bank money,

directly, then you have to ask, what is the point of traditional banks? I wouldn't need to have an account at my local bank. I could have a central bank digital currency wallet on my phone. And so if that happens, what is the process of credit creation who lends the businesses and individuals? Perhaps that is, well, it already is becoming more the case that peer-to-peer lending is taking over that role from banks. So I think it's a fascinating topic. I'm not sure what's going to happen now. Yeah. One thing if I can add just to think about is a lot of times I think even the governments, you know, think that this would be a way to go. Even, let's say, in Russia and China and trying to create their own digital currency, they're thinking that,

hey, this is a way to displace the, you know, Bitcoin and the regular cryptocurrencies. But you have to think about it. If there is a central bank digital currency, it also means you're going to sort of have to build an infrastructure, right, where people are using this centralized crypto. And I wonder if that would actually make demand for the regular cryptocurrencies, the permissionless ones, to actually increase, right? If you sort of enable people to get used to this method of transacting, of having, you know, wallets on their phone, you're not going to be able to, unless you're in a purely authoritarian country, keep people from, from, you know,

using the regular cryptocurrencies. So you may actually increase the competition, you know, depending on how you do it. Yeah. And something else that I wonder is for, you know, I sort of feel like this competition would play out. It would be like maybe bad state actors with cryptocurrencies, people may not trust those cryptocurrencies. And so in those markets, you might see an increase in trust in these decentralized ones. And then I just wonder how that competition would play out if you had cryptocurrencies that were state-sponsored that were maybe non-bad state actors, you know, would the decentralized ones still went out anyway? That is kind of an interesting question to me. And then the other thing that actually I'd been thinking about recently was about how people

in Venezuela and Zimbabwe and in Argentina and places like that have been driven because of hyperinflation to turn to cryptocurrencies like Bitcoin and others. And it just got me thinking that it sort of pushes adoption in these developing countries primarily. And maybe not Argentina, but I think Venezuela and Zimbabwe, whereas in a place like the U.S. or, you know, Sweden or Norway or something where the money is good and you trust it and you don't feel any need, that you would see sort of this reverse adoption where the technology takes off in a place where technology traditionally hasn't taken off first. And then the citizens in those countries are sort of like one step behind, which is kind of interesting. People often point out to the adoption of Bitcoin and

cryptocurrencies in these environments where, you know, the monetary system is sort of, you know, collapsed. But I, again, I would sort of, people's enthusiasm needs to be tempered because, or curbed, because, you know, this is sort of a coping mechanism. It's, you know, crypto, people, just need to keep in mind that crypto is not necessarily solving the problem. You know, these countries are facing like economic crises and political crises that, you know, even if, you know, the population, you know, need some sort of help and crypto can help, it, you know, it's not fixing, you know, the crisis. It's not solving the crisis. So there, you know, none of this can be seen in isolation. A couple last questions. Earlier,

in the spring, OFAC said it was going to begin putting individual digital currency addresses on its blocked persons list. Why is this significant? And what could such a designation mean for any coins that are associated with those addresses? I mean, I'll say something here in terms of it's really unclear how this is going to play out. I mean, I think this was a signal from Treasury, from, you know, OFAC, the office that deals with sanctions and designates people, and entities that they had to say that, you know, they're aware that there is a new method of transacting that may not fall within the framework or people might have thought might not fall within the sanctions framework. And the signal was, well, no, it does. And we're not going to be

held back in terms of listing. But so if Treasury does start designating, I think, I think, think, I don't think it'll have, it'll make a huge difference for, let's say, just the everyday person trading crypto. But then I do think it does have implications for, for institutions, for exchanges, because now you've, the bar will be raised in terms of allowing what you allow and your sort of levels of compliance to ensure that no one on your platform is transacting, one with a blocked address or an address which is transacting with. an address. There's going to be more scrutiny there. So I think it could have implications to that. Maybe it's also the fungibility of tokens. That's something that people have talked about.

But it really depends on how this is going to play out because I'm not sure that Treasury designating an address is going to stop that actor from operating in crypto. Yeah. So we will be adding the sanctioned cryptocurrency addresses to our database. And the implication of that is that if an exchange is using our AML software and one of their users receives funds from a sanction address or tries to send funds to one, then that will be flagged up to them and so that we'll be able to use that software to avoid transacting with sanction densities. So in addition to lost coins, we will see coins that are just sort of locked in these blocked addresses that stop being circulated. So, Yaya, you advocated for a sell.

self-policing AML platform to prevent the tainting of coins associated with the OFAC list, how would such a platform work? You know, this is where, you know, I put this suggestion out as a way to sort of provoke discussion as to how it should work because, you know, at the end of the day, my sense is that folks in crypto are sort of waiting for, you know, for someone else, for the government, for some other sort of regulatory entity to, you know, to sort of be the policeman, right? Or the police officer. What I'm trying to point out is that in other realms, like let's say in the cyber realm, you actually have a vibrant community of folks that try to, that use their cyber skills to, you know, to try to find hackers and find vulnerabilities, right? You have the white hat, white hat, black hat thing.

And I think there should be something similar in crypto. I think that in order, because this technology allows for such transparency, it just seems that there should be cooperation amongst folks that love the technology that are building the technology to try to ensure that there are, you know, that there are flags on on illicit activity. Yeah. I don't know. Yeah. Go ahead. to become that intermediary. So our customers, be the exchanges, law enforcement agencies, regulators are starting to feed to us addresses that they know through their own research or

associated with criminal activity. And then we will put all those addresses together in our system. So everybody has access to that information. We also work with a number of threat intelligence companies to get that same kind of data. So the private sector is, I think, stepping into that role at the moment. Great. Well, this has been such a fascinating discussion. Thank you both so much. Where can people learn more about your work? Well, you can find me at, or on Twitter, at Sign Curve, S-I-G-N-Cerve. And also you could look at defenddemocracy.org. That's FDD's website. And you can find out more about Elliptic, including our research at elliptic.co. It's E-W-L-L-I-P-T-I-E-E-E-E-W. dot CA. Great. Well, thank you both so much for coming on Unchained. Thank you very much. It's been

great. Thanks so much for joining us today. To learn more about Yaya and Tom, check out the show notes inside your podcast episode. New episodes have Unchained come out every Tuesday. If you haven't already, rate review and subscribe on Apple Podcasts. If you like this episode, share it with your friends on Facebook, Twitter, or LinkedIn. And if you're not yet subscribed to my other podcast, Unconfirmed, I highly recommend you check it out and subscribe now. Unchained is produced by me, Laura Shin, help from Elaine Zelvi, fractal recording, Jenny Soussin, Rahul Siki Reddy, and Daniel Nuss. Thanks for listening.