Follow the Money: Cryptocurrency Fraud

Ask a room of investment professionals to define cryptocurrency fraud and at least one will tell you the term is redundant. The total amount of stolen cryptocurrency sits at over $46 billion in today’s value. But if you ask a room of forensics professionals to define cryptocurrency fraud, you’ll likely get a more serious and nuanced answer.

Sitting at the intersection of cybersecurity, cryptography, and fintech, cryptocurrency is a complex field for investigators. But it’s also an increasingly important one. Decentralized finance (DeFi) applications on the Ethereum protocol alone total over $25 billion, down from a peak of over $100 billion in late 2021. More privacy-minded protocols don’t make it easy to count, let alone track, transactions. Following digital money that doesn’t want to be found is an extremely challenging pursuit.

The 2022 ACFE Report to the Nations found that approximately 8 percent of occupational fraud cases involved cryptocurrency; of those cases, it was most commonly used for either bribery and kickback payments or for converting misappropriated assets. That percentage will increase. To learn more about the landscape of cryptocurrency fraud today and where it’s going read on.

Meet the Expert: Mason Wilder

Mason Wilder, CFE, is a research manager for the Association of Certified Fraud Examiners (ACFE). In this role, he manages the creation and updates of ACFE materials for continuing professional education, works on research initiatives such as the Report to the Nations and benchmarking reports, conducts trainings, writes for all ACFE publications, and responds to member and media requests.

The Landscape of Cryptocurrency Fraud

The landscape of cryptocurrency fraud is both vast and diverse. It includes investment schemes, market manipulation, money laundering, bribery, smart contract hacks, and old-fashioned confidence scams. Part of the reason for its versatility in committing fraud is that cryptocurrency can often function similarly to fiat currency, but its innate complexity is an important factor, too.

“Fraudsters love complexity,” Wilder says. “It gives them an opportunity to embellish and mislead people and hide in confusion and uncertainty. Combine that with a fear of missing out, and it’s very fertile ground for fraud.”

Cryptocurrency has the peculiar property of being both extremely transparent and extremely opaque. Broadly speaking, blockchains are immutable public ledgers with records of their transactions publicly available to whoever chooses to access them. However, nothing in cryptocurrency is quite that simple, and sophisticated fraudsters are adept at masking the path of illicit funds between different wallets, protocols, tokens, and exchanges.

“It’s a game of cat and mouse,” Wilder says. “For a long time, sophisticated criminals who knew their way around crypto were many steps ahead. But I would say that’s not the case anymore. Law enforcement is catching up.”

Case Study: The Collapse of FTX

The fall of FTX, a major cryptocurrency exchange, made the front page of most mainstream news outlets. While the event is still under investigation, certain facts are not in dispute: individuals at or associated with FTX gambled with the money and assets of FTX customers. Approximately $8 billion was lost, stolen, or remains otherwise unaccounted for.

The head of FTX, Sam Bankman-Fried, was charged with fraud by the SEC, but was this cryptocurrency fraud, technically speaking? Customers willingly trusted FTX with their money and cryptocurrency rather than guiding it themselves. Ironically, the first debts FTX repaid during the collapse were to lenders who had used cryptocurrency’s system of trustless smart contracts.

“As far as we can tell at this point, none of the initial fraud at FTX had anything to do with cryptocurrency other than the fact that that’s the industry in which the company operated,” Wilder says. “There was commingling of investor funds, a lack of internal controls, and a violation of trust, but nothing specific to the technology of cryptocurrency.”

The FTX case still offers important lessons for new and aspiring investigators. Indeed, when FTX’s new management team came in after the collapse, they hired forensic investigators to track down missing funds, much of which was stored or moved via blockchain. Liquidators were tasked with consolidating some of FTX’s remaining cryptocurrency assets, including those of FTX’s investment arm, Alameda Research. Crypto analysts watched as those liquidators accidentally gave away $72,000 worth of bitcoin with the click of a button.

“The irreversible nature of cryptocurrency transactions is a significant factor in investigations,” Wilder says. “Whether it’s a fraudster taking someone’s money or an investigator attempting to recover those funds after they’ve been discovered, the stakes are higher in the cryptocurrency world.”

How Investigators Fight Cryptocurrency Fraud

At the least, today’s investigators and fraud examiners need to understand the basics of cryptocurrency. That means knowing the names of top exchanges, understanding the difference between major blockchain protocols, and recognizing the operational pieces of a decentralized system.

Simple steps like buying a small amount of cryptocurrency, sending and receiving it, and following along on a block explorer can give new investigators a starting idea of the landscape in which cryptocurrency fraud operates. Even limited practical experience can help them know what to look for and recognize clues as to whether cryptocurrency is involved in a case they’re investigating. But it won’t be enough to catch a sophisticated fraudster.

“I strongly recommend that people understand where their limitations are with cryptocurrency investigation,” Wilder says. “Most criminals that use cryptocurrency know what they’re doing, and they’re not going to make things simple. They’re going to use many different wallets and exchanges. They’re going to use tumblers and mixers and privacy coins. You can’t cut through all that without some sophisticated tools and an understanding of how to use them.”

Cryptocurrency is a sector ideally suited to open-source intelligence (OSINT): blockchains are, a vast majority of the time, focused on the power of their own transparency. Building off this, investigators can turn to tools like Breadcrumbs and Nansen, and organizations like Chainalysis and CypherTrace, for assistance. And the anonymous world of on-chain sleuths can offer some of the best investigative finds in the industry, even tracking down the convoluted steps of nation-state cybercriminals.

“Over the last few years, law enforcement and private sector investigators have really started to catch up,” Wilder says. “Many tools are in continuous stages of evolution and development to help cut through some of the obfuscation and trace transactions.”

Tracking cryptocurrency is one thing, but recovery is quite another. Unlike in traditional finance, there is often no third party custodying those funds, and thus no one to compel to release them. If a suspect is unwilling or unable to provide the private cryptographic keys to those funds, then they may remain inaccessible in perpetuity, or at least until a future development provides another option.

The Future of Cryptocurrency Fraud

Cryptocurrency will continue to endure large fluctuations in its financial value, but the sector is here to stay. In the last few years, institutional investment has increased significantly. Traditional banks allow customers to hold assets like Bitcoin as part of their retirement portfolio. Regular consumers can purchase shares in a Bitcoin ETF. As the language and technology around cryptocurrency continue to insinuate themselves into the mainstream, investigators and fraud specialists must be prepared.

“In the future, more organizations are going to be accepting cryptocurrency payments and transacting in cryptocurrencies,” Wilder says. “More organizations are going to be holding digital assets as part of their overall asset portfolio. Anti-fraud programs have to take that into consideration and make sure anti-fraud controls and programs are updated to account for and mitigate specific cryptocurrency risks alongside traditional fraud risks.”

When cryptocurrency is involved in a case of fraud, it immediately changes the parameters of the investigation. Following the money often becomes more difficult, but that doesn’t mean it’s impossible. What was once the Wild West is rapidly becoming a well-trafficked part of the broader fraud landscape.

“If you’re in some kind of anti-fraud role, you are going to encounter some cryptocurrency or digital assets in the next couple of years,” Wilder says. “It’s not going away. The more familiar you are with it now, the better prepared you’ll be.”