“This group leaves cash in specific places – behind a bush or under a bus seat – for criminals to get. They send specific location instructions. This is a whole new profession.” Financial Times quoted Dr. Tom Robinson, founder of Elliptic organization specializing in analyzing cryptocurrency transactions. The dark web site Hydra (Russian) offers a variety of methods for criminals to exchange cryptocurrency for cash, for example exchanging Bitcoins for gift certificates, debit cards or iTunes vouchers. Special software is required to access the Hydra dark web. Photo: ZDNet. Anonymous but still leaving traces According to experts, the ability to store cryptocurrency without providing an identity makes this currency especially attractive to many criminal gangs, especially hackers specializing in breaking into networks of businesses. and demand ransom. Statistics from research firm Chainalysis show that in 2020, businesses and organizations paid at least $350 million in cryptocurrency ransoms to a number of hacker groups, including DarkSide, the group that attacked the pipeline system. Colonial Pipeline earlier this month. But while anonymous, cryptocurrency transactions are recorded on an immutable blockchain system, leaving a clear trail for anyone with any knowledge of the technology. A number of investigative firms have been established to assist national authorities in tracking various criminal gangs by analyzing the flow of cryptocurrency transactions. Chainalysis (headquartered in New York, USA) is one such company. Binance cryptocurrency exchange. In 2011-2019, cryptocurrency exchanges supported the conversion to cash of about 60-80% of Bitcoin transactions by criminal groups. Photo: Binance. Chainalysis raised $100 million in its initial public offering, reaching a valuation of over $2 billion. There are also Elliptic (headquartered in London, UK) and CipherTrace, a company supported by the US government. Chainalysis said that in 2020, some illegal organizations receive about 5 billion USD and transfer 5 billion USD to other organizations. This represents almost 1% of all global crypto flows. Initially, the criminals only withdrew funds through major cryptocurrency exchanges. Elliptic estimates that between 2011 and 2019, cryptocurrency exchanges supported the conversion of about 60-80% of Bitcoin transactions by illegal organizations into cash. Take advantage of crypto ATMs Since last year, exchanges have been concerned about the tightening of regulations by many governments, so they have begun to apply anti-money laundering (AML) and customer identity verification (KYC) processes. This change pushes criminals to unlicensed exchanges. Still, expert Michael Phillips of online insurance company Resilience said that unlicensed exchanges have low liquidity, making it difficult for criminals to convert crypto to fiat. “The goal is to make it more expensive for criminals to convert money,” he explained. However, criminals still have a way around. Research by Chainalysis shows that some intermediaries are quietly assisting gangs in conducting many illegal money conversion transactions. Meanwhile, small-scale transactions still flow through more than 11,600 crypto ATMs worldwide without any control, or through gambling sites that accept crypto payments. Criminals can use crypto ATMs to get cash. Photo: EPA. Faced with that situation, crypto security companies use the technology of analyzing blockchain transactions and intelligence to determine which crypto wallets belong to criminal gangs. At the same time, they provide an overview of the global crypto crime ecosystem. As a result, companies discovered that many hacker groups lease ransomware to criminal networks. Kimberly Grauer, director of research at Chainalysis, said hackers also pay support services to other criminal groups in cryptocurrency. Thus, a criminal cryptocurrency ecosystem has been formed on a global scale. “We were able to see the ransom transactions, how the gangs split the money and how that money went to groups in the system,” Grauer said. The tricks are getting more and more sophisticated However, cybercriminals are increasingly using a variety of high-tech tools to obscure the traces of cryptocurrency transactions. Some criminals use “chain-hopping” – repeatedly switching between different cryptocurrencies – to avoid the eyes of security companies. In addition, they use a “privacy cryptocurrency” like Monero, which has a high degree of anonymity. Another tool commonly used by criminals is a “mixer,” a third-party service that mixes illegal cryptocurrencies with clean money, before pushing them back onto the market. In April, the US Department of Justice arrested a Swedish citizen of Russian origin, who specialized in operating a “mixing” service called Bitcoin Fog. During the past 10 years, this guy has transferred a total of 335 million USD in Bitcoin. Governments need to modernize confiscation and asset freezing processes to make it easier to confiscate cryptocurrencies from exchanges. Tom Kellerman, director of cybersecurity strategy at VMware V “It is possible to untangle mixed cryptocurrencies. However, that requires high technology and a lot of processing and data power,” said Katherine Kirkpatrick, director of law firm King & Spalding. According to Elliptic, the popular 2020 coin mixers are highly anonymous “personal wallets”. They supported 12% of Bitcoin wash transactions last year. Tom Kellerman, director of cybersecurity strategy at VMware and a member of the US Secret Service’s advisory board, said that governments need to modernize the process of confiscating and freezing assets for law enforcement. easily confiscate cryptocurrencies from exchanges. In the past, blockchain security experts have floated the idea of ​​sharing a “blacklist” of crypto wallets used by criminals with exchanges, analytics firms, and governments. “Now is the right time to consider that initiative.” he Kemba Walden of Microsoft’s Digital Crimes Unit.

This hacker organization has received ransom from many victims. This shows that data ransom attacks have become a lucrative business for cybercriminals. Bitcoin is increasingly preferred by criminal organizations Earlier this month, Colonial Pipeline suffered a severe attack that forced the company to shut down nearly all of its fuel system supplying the southeastern states of the United States. The FBI confirmed the crime was DarkSide, a cybercrime organization believed to be located in Eastern Europe. Last week, it was reported that Colonial had agreed to pay $ 5 million to DarkSide (in bitcoin) for the data recovery password. Recently, the CEO of the company confirmed this information. DarkSide operates like a business. This group develops malicious code to crack and steal the target’s data, then trains partners, the partners continue to train the hackers. When hackers use this malicious code to carry out successful missions, DarkSide will receive a percentage of those successful attacks. In March 2021, when it announced a new software that can crack data faster than before, DarkSide even released a press release and invited reporters to interview. Hackers often demand ransom in virtual currency. London-based blockchain analytics firm Elliptic has identified a bitcoin wallet that DarkSide uses to receive ransoms from victims. On May 14, London-based blockchain analytics firm Elliptic said it had identified a bitcoin wallet used by DarkSide to collect ransoms from victims. That same day, Intel 471 security researchers said DarkSide closed after losing access to its servers and when the organization’s virtual currency wallets were empty. According to Elliptic, DarkSide and other affiliates of this organization have collected at least $90 million in bitcoin ransoms, and they receive funds through 47 different digital wallets. “To our knowledge, this analysis includes all payments to DarkSide,” said Tom Robinson, Elliptic co-founder and chief scientist. However, there may be other undetected transactions, so this $90 million figure should be considered the lowest limit.” Also according to Elliptic’s research, DarkSide’s bitcoin wallet was holding $5.3 million in cryptocurrency before it was all withdrawn last week. There are some rumors that these bitcoins have been seized by the US government. Of the $90 million ransom, $15.5 million went to the developers of DarkSide and $74.7 million to affiliates. Much of that is being sent to cryptocurrency exchanges and thereby converted into fiat. Bitcoin is increasingly preferred by criminal organizations as crypto traders do not reveal their identities. However, because the digital ledger that underpins bitcoin is public, researchers can keep track of where these funds are going.