Preventing Financial Crime in Cryptoassets

Identifying Evolving Criminal Behavior Introduction7 Part I: Money Laundering10 1. Cryptoasset Exchanges 1.1.Use of Non-compliant or Unlicensed Exchanges1.2.Use of Exchanges in High-risk Jurisdictions1.3.Use of Money Mules or Fraudulent Documents at Legitimate Exchanges111724 2. Mixers and Privacy Wallets30 3. Decentralized Finance (DeFi) and Cross-chain Crime 43 3.1. Money Laundering Through DEXs3.2. Money Laundering Through DeFi Mixers3.3. Money Laundering Through Cross-chain Bridges444751 4. Tokens and Stablecoins55 4.1. Tokens & Stablecoins Used to Clean Illicit-origin Funds4.2. Laundering of Proceeds From Scams4.3. Laundering of Hacked Tokens and Stablecoins565861 5. Privacy Coins & Chain Hopping64 5.1. Use of Privacy Coins to Layer Illicit Proceeds64 5.2. Laundering Illicit-origin Privacy Coins66 6. Wallet-specific Behaviors70 6.1.Chain Peeling6.2.Multi-customer Cross-wallet Activity7073 7. Cryptoasset ATMs 75 7.1.Facilitation of Illicit Transfers7.2.Money Mule Activity7.3.Victims of Scams Send Funds via Cryptoasset ATMs758082 8. Card 86 8689928.1.Use of Cryptoasset Prepaid Cards to Layer Criminal Proceeds8.2.Dirty Cryptoassets Used to Purchase Fiat Cards For Laundering8.3.Fiat Cards Used to Purchase Cryptoassets For Illicit Purposes 949. Banks and Indirect Exposure to Cryptoasset Risks 94969.1. Indirect Exposure Through Processing VASP Transactions9.2. Indirect Exposure Through Correspondent Relationships 98 9810010310.1. NFTs and Money Laundering10.2. NFTs and Fraud10.3. NFTs and Theft 10711. Metaverse-related Laundering 10710811.1. Use of Metaverse Services to Launder Illicit-origin Cryptoassets11.2. Laundering the Proceeds of Metaverse Crimes 110 11111212.1.Laundering the proceeds of AI-Enhanced, Crypto-Enabled Illicit Activity12.2.Laundering of Funds from “AI-Related” Scam Tokens and Rug-Pulls 11513. Multi-technique and Multi-service Typologies 11511811812112212313.1.The Bitfinex Hack13.2. Operation Argenti13.3. Russia Hacking13.4. Dark Web Laundering13.5. Ransomware: the Colonial Pipeline Attack13.6. Other Examples Part II: Terrorist Financing 124 12614. TF Involving Crowdfunding Through Charities andOther Organizations 131 133Part III: Key Trends: Criminal and Threat Actors 135 13617. Dark Web Vendors 137 141 141 143 144 146 155 156Index Executive Summary to the 2024 Edition It’s been exactly one year since we published the 2023 version of Elliptic’s Typologies Report, andin that short time we’ve seen important and rapid developments impacting the nexus betweencryptoassets and financial crime. In January 2024, the US Treasury’s Financial Crimes Enforcement Network (FinCEN) kicked offthe year by issuing a finding that cryptoasset mixers are a primary money laundering concernowing to their frequent use in money laundering, and issued a proposed rule that would requirestringent reporting requirements for US crypto businesses and financial institutions where theyidentify transactions involving mixers. Additionally, across the first half of 2024, the Treasury’sOffice of Foreign Assets Control (OFAC) continued its intensive use of financial sanctions totarget cryptoasset activity involving a range of threat actors, from cybercriminals, to Russian-affiliated entities involved in sanctions evasion, to the financial support networks of designatedterrorist organizations such as Hamas and Hezbollah. These developments were accompanied by other important developments in the financialcrime risk landscape impacting the cryptoasset space. For example: •Stablecoins, and in particular Tether (USDT) on the TRON network, have featuredincreasingly in financial crime typologies, including in so-called “pig-butchering”scams, and in sanctions evasion activity involving jurisdictions such as Russia, Iran,and North Korea. •Professional money launderers associated with Chinese organized crime groups havelooked to cryptoassets as a method for moving illicit funds across borders. •Cryptoasset exchanges located in high risk jurisdictions, such as Russia, continue tooffer an important lifeline to criminal actors seeking to convert funds from crypto intofiat currencies. •Illicit actors such as ransomware attackers and North Korean cybercriminals continueto utilize complex money laundering schemes, relying on numerous methods ofobfuscation, such as mixers, cross-chain services, and “peeling-chain” techniques -often in tandem. •Criminals are leveraging developments in artificial intelligence (AI) when perpetratingcrimes involving cryptoassets, enabling them to scale their illicit operations,particularly related to crimes such as fraud and ransomware. These ongoing trends require that analysts and investigators not only understand underlyingtypologies of financial crime, but that they have access to solutions that can enable themto identify associated behaviors and red flags. To that end, at Elliptic, we’ve been working to ensure that our best-in-class blockchain analytic