At the time of writing, Binance, the world’s largest cryptocurrency exchange, suffered a hack that plundered assets worth $6.3bn. Reports linked the enormous breach to North Korean hacking outfit TraderTraitor.

As well as highlighting the ongoing threat posed by state-backed cybercrime, the hack vividly illustrates bad actors’ determination to overcome the inbuilt checks and balances that many of us assume make blockchain-based finance more secure.

How cyber criminals are breaking the chain

According to Grant Thornton Associate Director, Digital Asset Recovery, Adrian N Morris, cyber criminals’ crypto activities take three main forms.

1. Counterfeiting 

Not a means for criminals to extract money directly, but to make payments with money that isn’t actually real. “We’re seeing people create tokens that look, for all intents and purposes, like stablecoins and other well-known assets, but aren’t,” Morris says. “When they hit certain crypto wallets, they appear to have a USD value and can even bear some recognised assets’ official logos. But when you look at their codes and underlying smart contracts, they’re completely fake.”

2. Layering and obfuscation

This is typically achieved via one or more of the following means, which are increasingly assisted by AI:

• Chain hopping: A money laundering technique whereby criminals move funds across different blockchain networks to conceal their chain of origin, making them harder to trace.
• Mixing: This is where funds are placed into so-called mixer platforms, such as Tornado Cash. “It’s a bit like putting assets into a giant blender and spinning them off in a host of different directions,” Morris explains. “Again, it’s a way of breaking the chain to hinder direct claims and investigations.”
• Privacy coins: Converting stolen funds into this asset type makes them particularly challenging to recover, Morris notes. “We don’t see privacy coins very often in our civil recovery work,” he says, “but they are used heavily in the context of state actors or large-scale hacks. Their appeal is that they’re really difficult to trace, but bad actors would usually have to change them back into more traditional tokens to liquidate their funds.”

3. Off-ramping

For Morris, this is the most frustrating route for crypto crime. “You can play around with obfuscation techniques,” he says. “But if you take stolen funds to an exchange in a noncompliant territory, or to one that simply doesn’t comply with law enforcement or court orders, the victim is highly unlikely to see their money again.”

Act fast, and avoid AI

In Morris’s assessment, the majority of crypto exchanges cooperate with investigators. Indeed, he credits Binance for being cooperative, despite throwing up “occasional roadblocks and hoops to jump through.” Conversely, HTX is a pre-eminent example of an uncooperative exchange. “The entity behind HTX was sanctioned by the UK government,” he says, “so it has less motivation to engage with UK investigative efforts and any recovery would need legal input first.”

Similarly, Morris notes, the more you have to chase stolen funds into exchanges hosted by countries such as Russia and Iran, the more complex and frustrating the process becomes.

Turning to other challenges that investigators face in their pursuit of digital assets, he immediately highlights one key hurdle: time. “If a victim turns up and says, ‘I had these tokens stolen two years ago,’ the message is often that the assets are long gone,” he says.

If you think you’ve been hit, act as quickly as possible, Morris advises. Save all your communications with suspected scammers, and beware cold approaches for asset recovery. In the vast majority of cases, they’re gateways to other scams and often look to impersonate legitimate people in the industry. “Do all you can to ensure you’re working with legitimate recovery specialists. Look at companies’ websites, research their form and find out if they’re named in any court orders. And always make sure you’re contacting them, not vice-versa.”

Another challenge stems from what Morris considers a major bugbear. “If you’re a victim, please don’t use artificial intelligence (AI) to do your own investigation and think you’ve done all the tracing yourself,” he says. “I understand that you’re motivated to help. But a report produced by, say, ChatGPT is unlikely to be correct and definitely won’t come up to the evidential standard required to survive cross-examination in court.”

Blockchain can be used to tackle financial crime

That said, cutting-edge technology in the hands of experienced investigators is proving to be a formidable means of accelerating recovery workflows.

“Tools such as Chainalysis and TRM Labs provide facilities for tracing assets as well as compliance monitoring of customer wallets,” Morris says. “Meanwhile, companies like Addressable link wallet data to devices, enabling investigators to triangulate the location of wrongdoers.”

In addition, Morris highlights:

The Illicit Virtual Asset Notification (IVAN) system

Launched as a public-private partnership, IVAN is an information-sharing initiative designed to improve the timely detection and disruption of illicit virtual asset payment flows, including ransomware payments.

Kodex

Trusted by a number of leading crypto exchanges and tech giants, Kodex is a verification tool that smooths out communications between financial institutions and investigators. Morris explains: “Financial institutions can be confident that any contact made through Kodex comes from genuine law enforcement or trusted parties.”

One potentially significant red flag that Morris urges accountants to keep track of is counterparty exposure. “This is really about understanding nuances,” he says. “Lots of players in the digital assets arena, including crypto wallets and financial institutions, have exposure to darknet markets – but it’s often indirect. So, it’s a case of being able to see when your own exposure through other entities becomes direct and threatening.”

The importance of nuance and discernment brings us to another of Morris’s bugbears: that digital assets investigation is not currently a standardised, regulated profession. “There is an urgent need for that to change,” he says. “Right now, you can do a cheap certificate with a blockchain analytics company and say, ‘I’m a certified blockchain investigator.’ That does not mean you’re any good.”