TBJ May 2023

Digital Asset Crime

Are we still early?

Written by Carlo D’Angelo and Carlos Garcia

“A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution.” —Satoshi Nakamoto¹

It’s likely no coincidence that the pseudonymous person, or group of persons, known as Satoshi Nakamoto unveiled the plan for bitcoin—a purely decentralized peer-to-peer electronic cash system—just as the world plunged into the depths of the 2008 global financial crisis. But despite all the financial carnage that resulted from the 2008 collapse, crypto has been slow to gain mass-adoption.

Although Web3 and decentralized blockchains offer seemingly limitless opportunities for consumers and businesses, critics continue to push the narrative that crypto is only good for facilitating Ponzi schemes and fueling Dark Web marketplaces. But recent reports of rising inflation, bank failures, and currency debasement—ironically similar to the headlines we saw back in 2008—may well draw new users to crypto who see it as a hedge against these institutional risks. And this potential increase in crypto adoption will inevitably draw the continued attention of criminal enterprises and other bad actors who seek to capitalize on unsuspecting new users of this technology.

There is no denying that blockchain technology is rapidly disrupting many sectors of the world economy. However, with new technological advancements, come new risks. And the blockchain is no exception. In particular, cryptocurrencies and non-fungible tokens, or NFTs, have been mainstays as newsworthy headlines with opposing opinions that are as divided as partisan politics during an election cycle.
This article is intended to hit the critical points of digital asset crime while providing fellow attorneys with a more cogent idea of what to look for as the need for knowledgeable defense attorneys and prosecutors increases.²

Blockchain crimes are primarily observed in three categories: (1) the use of digital assets to pay for illicit goods, (2) financial crimes including money laundering and tax evasion, and (3) consumer-focused scams colloquially referred to as “rug pulls.” Common in nearly every criminal situation is the anonymous nature of digital wallets, identities, and transactions, which can make it difficult to hold the correct bad actors accountable. Although the vast majority of peer-to-peer digital asset transactions facilitate the lawful and efficient transfer of funds without the need for slow and costly intermediaries, bad actors have seized upon this technological revolution to come up with new and creative ways to defraud consumers.

For a thief to steal one’s digital assets, they must first gain access to a user’s wallet. Digital assets are generally either stored on a decentralized or a centralized exchange wallet. A decentralized exchange, or DEX, is a type of cryptocurrency exchange wallet that operates on a peer-to-peer network, rather than relying on a centralized authority to manage and execute trades. A DEX can offer greater privacy and security, since users retain control of their private keys and funds, rather than entrusting them to a centralized intermediary. However, DEXs can also be more complex to use than centralized exchanges and generally have no identity verification protocol, such as Know Your Customer, or KYC, or Anti-Money Laundering, or AML, standards. On the other hand, major centralized crypto exchanges that do business in the United States are required to comply with some measures of KYC and AML standards under the federal Bank Secrecy Act and applicable state money transmitter licensing laws. Although crypto advocates believe that it is essential to preserve the decentralized and pseudonymous nature of digital asset transactions, these aspects of blockchain technology can also be abused by bad actors because they frustrate a government’s ability to investigate and prosecute fraud and tax evasion schemes.

Different from a DEX, platforms like Coinbase and Kraken provide investors with a centralized exchange, or CEX, that holds custody of their digital assets and allows users to access those assets via the platform’s hosted wallet accounts. Decentralization advocates warn that the use of “hosted” wallets via a CEX, of course, runs afoul of crypto rule number one—namely “not your keys, not your crypto.” A person who holds their digital assets in a CEX wallet sacrifices self-custody benefits that come with a DEX because the exchange maintains control over the private user key to that wallet. Consumers therefore entrust the CEX to custody their digital assets rather than being themselves responsible for holding the private key to the account. The benefit of holding your crypto on a CEX is it presumably provides a more robust layer of institutional security to protect against hackers and fraudulent schemes. The downside is that if the CEX is hacked, collapses, or is mismanaged, then investor assets are at risk of being stolen, lost, or mishandled. Conversely, the downside to self-custody on a DEX is that you, as the wallet holder, are responsible to secure your own private key to your account as opposed to letting the CEX secure the assets for you. If, for example, a DEX user falls prey to a phishing scam or clicks on a bad link, then they are at risk of losing all the digital assets in their wallet.

Blockchain crime scams target both cryptocurrency and NFT holders³ with equal impunity and have recently drawn increased attention from law enforcement and prosecuting entities across the globe. In 2020, for example, the U.S. Department of Justice published the first-ever Crypto Currency Enforcement Framework. The DOJ noted that although “cryptocurrency represents a transformative way to store and exchange value” this technology also plays a “role in many of the most significant criminal and national security threats our nation faces.”⁴

Generally, blockchain crime schemes follow a very simple roadmap. Bad actors first steal the digital assets through some form of a wire fraud scheme. Bad actors then attempt to conceal those digital assets through software protocols that enable them to “tornado” the crypto assets across multiple wallets. The process of “tumbling” or “mixing” the crypto assets across these multiple wallets is done to cover the bad actor’s tracks and frustrate law enforcement’s ability to trace victim funds. Once the crypto assets have been scattered across these multiple wallets, thieves must then try to off-ramp the crypto on a CEX and convert it to fiat currency. This phase of the blockchain crime scheme generally involves the recruitment of unlicensed or illicit money changing services to assist in laundering the crypto funds so they can be converted to a fiat currency that the bad actors can then spend on goods and services.

According to Chainalysis, in 2021, there was an estimated $15.8 trillion in reported cryptocurrency transactions.5 This volume represents a 567% increase in transactions over the previous year.⁶ And with this increase in transaction volume, we have seen a significant uptick in digital asset related crimes.⁷ Chainalysis also noted that in 2021, blockchain criminal activity reached an estimated all-time high of $18 billion.⁸ This figure represents a significant rise from the $7.8 billion estimate reported for the previous year.9 Chainalysis further noted in its recently published 2023 Crypto Crime Report that despite a market downturn in 2022, “illicit transactions rose for the second consecutive year, hitting an all-time high of $20.6 billion.”¹⁰ In response to this alarming trend, the White House recently released an executive order directing the DOJ to prepare a report on recommendations for combating digital asset crimes.¹¹ The DOJ’s report confirms that blockchain crime presents a significant threat to the United States and offers a comprehensive outline of the role law enforcement should play “in detecting, investigating and prosecuting criminal activity related to digital assets.”¹² Although we are still at the very early stages of this enforcement initiative, there have been several recent noteworthy criminal prosecutions by the DOJ, including the $4.5 billion Bitfinex bitcoin hack and money laundering case,¹³ the FTX collapse and indictment of its founder Sam Bankman-Fried,¹⁴ the OpenSea NFT¹⁵ and Coinbase¹⁶ “insider trading” fraud schemes, and the Frosties NFT “rug-pull” prosecution.¹⁷

If you spend enough time around digital asset and Web3 enthusiasts, you will no doubt hear the phrase “we are still early.” And although we are indeed still very early to the party when it comes to the innovative and transformative possibilities of digital assets, its continued growth and mass adoption is very much dependent on consumers being able to securely and safely conduct blockchain transactions. ^TBJ

CARLO D’ANGELO is a criminal defense lawyer, former law professor, and crypto and nFt enthusiast with 25-plus years of experience defending individuals charged with state and federal crimes. in 2022, D’Angelo was a featured speaker at nFt.nyC, where he spoke on the subject of “the Growing threat that Crypto Criminal enterprises Pose to nFts.” in a poll conducted by nFt.nyC in 2022, he was nominated as one of the top five lawyers in the category of “Most expert Handling of the Law and nFts.” D’Angelo is also the co-host of Lex Line, a crypto and blockchain legal podcast available on Apple and Spotify. For more information about D’Angelo, go to www.DAngeloLegal.com.

CARLOS GARCIA is a criminal defense lawyer and technology enthusiast. He is the former American bar Association subcommittee chair for nFts and intellectual property and has been featured as a speaker at numerous conferences including the 2022 AbA intellectual Property Symposium. Garcia is currently a managing partner for the texas office of the Defense Firm (GG Law Group) and focuses on the company’s federal criminal defense portfolio. He has represented several nFt and crypto projects in complex regulatory and iP issues. Prior to entering private practice, Garcia spent over 16 years in the Army JAG Corps. For more information, go to www.DefenseFirm.Law.

{Back to top}