Dirty cryptocurrency is closer than you think

Let's imagine the situation... Through a friend, you were offered a profitable deal to buy cryptocurrency in the amount of 10 thousand USDT. You paid only 7,000 US dollars. At the current exchange rate this is a very good deal. You are looking forward to making money, deposit cryptocurrency on the exchange for subsequent sale, but your account turns out to be blocked. The exchange requires information from you about the origin of these funds.

Crypto exchanges look not just at the balance of your crypto address, but also at the history of funds generated by you and your counterparties. For example, you received funds from a childhood friend who has never done anything wrong in his life. But there is a nuance, before this he made a lot of fund transfers. One of the transfers was with a crypto address, which receives funds from the darknet website. As a result, the tag of dirty money has reached you.

Let's consider the data as of 10/05/2023. The market capitalization of cryptocurrencies has exceeded $1 trillion, according to Coinmarketcap, and according to Triple-A, there are more than 420 million registered owners of crypto addresses worldwide.

However, cryptocurrencies attract not only law-abiding users. They become a tool for laundering criminal proceeds. Over the past 6 years, $59.6 billion has passed through cybercriminal wallets, according to data from AML crypto. The real number is probably even higher.

In this case, regulatory policy measures are being strengthened. In different countries, different approaches are taken to cryptocurrencies: in some places it is considered a means of payment (for example, in El Salvador and Malta), in others it is considered property (in Russia, Singapore), and in some countries it is generally prohibited (in Moldova, China).

At the international level, it is worth highlighting the activities of the Intergovernmental Commission on Financial Monitoring (FATF). The FATF is developing recommendations for VASPs (virtual asset service providers), such as CEXes and crypto exchangers, regarding the implementation of KYC (Know Your Customer) and KYT (Know Your Transaction) procedures.

Exchanges that ignore FATF guidelines risk being unable to obtain a license. If AML (anti-money laundering) standards are violated, the regulatory authorities of the country of registration can not only revoke the license, but also hold VASP management accountable for assisting in the legalization of criminal proceeds. In this regard, most significant exchanges verify their clients and carefully check the origin of funds on client crypto addresses, blocking accounts if suspicious activity is detected until an explanation is received or an investigation is carried out by the relevant authorities.

The source of funds for a specific cryptocurrency address is not always the addresses that sent funds to it, which may seem somewhat unexpected to the average user.

When assets are located at addresses of a certain type, such as Merchant services, Cex Licensed, Cex without KYC, ATM, Mixing service, SCAM and others, they acquire a certain “color”. These tokens can then move through many unknown and intermediate addresses, but retain their original color.

Thus, when analyzing the composition of your funds, the exchange considers the transaction history up to the first known node of the specified type, which allows you to determine the nature of the origin of the assets.

Using cryptocurrencies obtained from high-risk sources may cause the following problems:

There is a common myth about the complete anonymity of cryptocurrencies, which quite a lot of people believe. They believe that if a dirty cryptocurrency is present at levels two, five, or ten deep relative to their blockchain address, it will not affect them. However, in practice, the situation is different.

Recently, our company is increasingly faced with requests from users who ask for assistance in unlocking their funds on various exchanges.

Exchanges, unfortunately, rarely provide detailed explanations regarding the connections leading to blocking. In this situation, we conduct a detailed blockchain analysis of the client’s transaction history.

And then the client, “armed” with this blockchain analysis in company with lawyers, demands to unblock his funds.

And as practice has shown, exchanges can see the connection that is hidden at the 5th, 6th and even 10th level of addresses from yours. It all depends on the source of the funds and how the transactions were carried out.

Cryptocurrency acquired through illicit transactions is often routed to fiat conversion tools.

There are several ways to transfer cryptocurrency to fiat: using centralized exchanges (CEX), crypto automated teller machines (ATM), and also performing P2P transactions, that is, direct transactions between users. Now we will talk about P2P transactions, that is, transactions between users.

Attackers see you only as a means of LEGALIZATION of criminal proceeds, or a direct SOURCE OF INCOME if they manage to deceive you. So it turns out that selling you dirty cryptocurrency and getting clean funds from you is an ideal option for criminals.

Many users claim: “The attackers are far from me” or “This does not concern me, I have already interacted a hundred times and there have been no problems.”

First of all, it is worth remembering that past experience is not a guarantee of the future.
Secondly, regulatory pressure on VASPs (virtual asset service providers) is constantly increasing.
Thirdly, technologies for identifying “dirty” cryptocurrency are increasingly being improved.
Let's look at an interesting concept called the six handshakes theory. According to it, every person on Earth can be connected to any other through no more than six intermediaries. That is, knowing someone, through six people, you can establish a connection with any other person on the planet.

Now let's apply this theory to cryptocurrency. Suppose there is a scam address where “dirty” cryptocurrency is stored. We can assume that this address is connected to you through no more than six intermediate counterparties.
Thus, the nearest scam address with dirty cryptocurrency may be much closer than you think. As a result, you could end up owning a dirty cryptocurrency if you are not careful when buying or selling it.

Applying this theory, we can assume that even a trusted counterparty can transfer “dirty” funds to you. By “trusted counterparty” we mean a business partner or even your relative, emphasizing that caution is important even in trusted relationships.

The main tool for assessing the risk of blocking is the Risk-score indicator. It is formed based on the sources of funds of the cryptocurrency address, behavioral patterns, as well as user data. The value is assessed on a scale of 100 and is usually divided into three categories:

Green Zone
Addresses in the green zone are at minimal risk of being blocked by VASPs. They are not mentioned in official lists or scam databases, and the sources of their funds are not suspicious. Such addresses were not observed in suspicious activity.

Yellow Zone
For addresses in the yellow zone, a risk score of 40-69 is critical: the higher the score, the more detailed the exchange’s compliance manager will analyze your address. Much here depends on the AML policy of a particular exchange. The reasons for entering this zone may be partial receipt of “dirty” funds, interaction with unreliable counterparties (for example, funds mixing services or deployment of scam smart contracts), or mention in certain databases.

Red Zone
Addresses that fall into the red zone are highly likely to be blocked because they or their sources of funds show signs of being associated with dirty funds.
To check and analyze your crypto address, you can use our solution - Btrace, or turn to the solutions of our competitors, for example, Getblock or AML bot.