Behind the 40 billion yuan "biggest case in the cryptocurrency circle", virtual currency has become a "new channel" for cross-border money laundering

Reporter of this magazine/Xu Tian

Published in the 993rd issue of China Newsweek on April 26, 2021

The situation of cross-border money laundering with virtual currency is serious

Suspected of fundraising fraud, Chen Li's husband fled to Australia and instructed Chen Li to transfer the proceeds of the fraud overseas. When Chen Li was arrested, the police did not know how she transferred large sums of money to her husband who had fled overseas. The police checked her bank statements and found that she had remitted hundreds of thousands of yuan to strangers in the previous few days. It is impossible for an important source of funds when fleeing to be remitted to irrelevant people for no reason. Chen Li later confessed that the money was transferred to two Bitcoin miners, exchanged for keys, and given to her husband.

This case occurred in 2018. The public security, procuratorial and judicial departments of Pudong New Area, Shanghai, which handled the case, encountered money laundering with virtual currency for the first time. On March 19, 2021, the Supreme People's Procuratorate and the People's Bank of China jointly released six typical cases of punishing money laundering crimes, and this case became one of them. Relevant officials pointed out that using virtual currency for cross-border exchange to convert criminal proceeds and profits into foreign legal currency or property is a new means of money laundering.

Yu Jianing, rotating chairman of the Blockchain Committee of the China Communications Industry Association and president of Huobi University, told China News Weekly that starting from 2020, a part of the black industries such as fraud, cyber attacks and extortion, gambling, money laundering, underground banks, and gray industries such as running points have begun to use virtual currencies with their anonymity, complexity and transnationality to commit crimes around the world. Internationally, terrorist organizations have also turned to the field of virtual currencies for financing to support their activities.

According to the "2020 Annual Virtual Currency Anti-Money Laundering Report" released by blockchain security company PeckShield, in 2020, the value of unregulated cross-border virtual currencies in China reached US$17.5 billion, an increase of 51% over 2019, and is still growing rapidly. The surge in money laundering "new channels" has brought huge challenges to China's anti-money laundering mechanism.

Black and gray industries are eyeing virtual currencies

At the end of November 2020, the Intermediate People's Court of Yancheng City, Jiangsu Province, issued a second-instance criminal ruling, rejecting the appeal and upholding the original verdict. The highly anticipated "largest case in the cryptocurrency world" with a total value of over 40 billion yuan has come to an end.

More than two years ago, the defendant planned to build the PlusToken platform based on the concept of blockchain, and claimed that the platform had the function of "smart dog moving bricks", that is, it could conduct arbitrage transactions and earn price differences on different digital currency exchanges at the same time, and promised investors a monthly interest rate of 10% to 30%. The platform will classify members according to the number of downlines developed and the amount of funds invested, and issue corresponding rewards and cashbacks according to the level. In June 2019, the PlusToken platform was exposed to have difficulty in withdrawing coins. After verification by the police, the platform did not have any business activities and did not have the function of "smart dog moving bricks". The police characterized the case as "a network pyramid scheme case using Bitcoin and other digital currencies as trading media." As of the time of the incident, the PlusToken platform had 2.693 million registered member accounts, the maximum level of members was 3,293 levels, and the total value of Bitcoin and other digital currencies involved in the case exceeded 40 billion yuan.

Using blockchain and digital currency to commit traditional crimes has become a trend in recent years. In an interview with China Newsweek, blockchain security company PeckShield pointed out that as the core technology of blockchain has been elevated to a national strategic level, the public has become more and more concerned about the blockchain field, and various scams have emerged, among which the Ponzi schemes and pig-killing schemes packaged with blockchain concepts are the most numerous.

PeckShield has counted major security incidents in the virtual currency industry from 2017 to 2020, and the number of fraud cases has changed significantly. In 2017 and 2018, there were 3 and 4 fraud cases in the virtual currency industry, respectively. In 2019, the number of fraud cases increased fourfold to 20. By 2020, the number of cases had surged to 151.

The surge in fraud cases is directly related to the surge in Bitcoin prices. Yu Zhixiang, technical director of OKLink Group, told China News Weekly that the bull market has a wealth-creating effect. The better the market is, the more people will want to rush in. Newcomers do not have enough channels to learn about virtual currencies and are easily deceived. PeckShield also pointed out that for ordinary users, the technology and participation threshold of virtual currencies are relatively high, giving speculators the possibility to concoct various scams.

At the beginning of 2020, a Wenzhou woman met a man named Yang who claimed to be an investment elite on a dating website. After Yang won the woman's favor, he began to ask him to help buy Bitcoin on an unknown trading platform. According to Yang's instructions, the woman also bought a batch of Bitcoin from the platform, but she needed to pay a deposit when withdrawing cash. After paying more than 407,000 yuan including deposits, activation funds, and Bitcoin to the platform, the woman realized that this was a typical pig-killing scam and chose to call the police. The police in Changzhou, Jiangsu Province have also cracked similar cases and arrested 17 criminal suspects in Guangdong, Fujian, Yunnan and other places. The gang has committed more than 370 crimes in nearly 300 cities and counties across the country, all of which were pig-killing scams, with a total amount of 120 million yuan involved.

PeckShield told China Newsweek that in 2020, the total losses caused by fraud cases amounted to 3.13 billion US dollars. Such cases often ask victims to first purchase virtual currency with cash on a regular trading platform in the name of investment, and then trick them into transferring the purchased virtual currency to a fake platform or address designated by the fraudsters. Once transferred, the virtual currency will be quickly processed by money laundering gangs or flow into overseas exchanges, making it extremely difficult to recover the funds. Fraudulent security incidents have become the biggest security threat in the blockchain world.

In addition to "pig killing", hacker attacks and ransomware attacks also account for a large share. In 2020, there were 170 hacker attacks in the virtual currency industry, an increase of 300% from 2019.

In addition, with the increasingly stringent anti-money laundering and anti-terrorist financing mechanisms of the banking system, international terrorist organizations have also begun to turn to the field of virtual currency for financing. In August 2020, the United States seized and announced a batch of virtual currency accounts owned and used by terrorist organizations such as al-Qaeda and the Islamic State (ISIS), with a value of over $2 million. PeckShield pointed out that the assets in the account address interact with dozens of mainstream virtual currency exchanges, and the channels for monetization are spread all over the world.

Yu Jianing pointed out that it is precisely because virtual currency has the characteristics of anonymity, complexity and transnationality that the black and gray industries have begun to turn to this field to commit crimes. As the "downstream chain" of these upstream crimes, laundering the black coins and black money obtained from crimes through virtual currency transactions has also become a trend.

More secretive funding flows

In a typical case of money laundering using virtual currency released by the Supreme People's Procuratorate and the People's Bank of China, Chen Li and her husband chose this method to launder money for a very realistic consideration: to bypass foreign exchange controls.

Zhu Qijia, the prosecutor of the Shanghai Pudong New Area People's Procuratorate, who handled the money laundering case, told China News Weekly that during Chen Li's husband's escape to Hong Kong and Australia, Chen Li transferred 3 million yuan to her husband's bank card several times, and her husband fled to Australia with the bank card. After he left the country, withdrawing cash involved foreign exchange control with a certain limit per person per year. Therefore, her husband took the initiative to exchange virtual currency.

Chen Li's husband was charged with fund-raising fraud, which was caused by issuing fixed financial management of virtual currency, building a self-built model, and controlling the rise and fall by himself. He already had acquaintances in the industry, so he found a "miner" and pulled his wife in, and set up a WeChat group. He was responsible for negotiating the price, and after the "miner" agreed, Chen Li remitted the money, and the "miner" gave the key to her husband. He was in Australia and could directly exchange virtual currency for Australian dollars.

Liu Juanjuan, the presiding judge of the case and a judge of the Shanghai Pudong New Area People's Court, told China News Weekly that although virtual currency money laundering is a new technical and professional method, its verification path is the same as traditional money laundering, with black money transferred out and laundered money transferred back. The difficulty in obtaining evidence is that the traces are more difficult to find and it is very likely to occur overseas.

Zhu Qijia revealed that in this case, the flow of funds was very hidden. When investigating money laundering cases, one usually has to follow the flow of funds. In this case, the apparent flow of funds was interrupted. Chen Li transferred the money from her bank account to the "miner", and the bank account of the "miner" had no connection with Chen Li's husband, so it was impossible to form a complete money laundering chain. If it were not for Chen Li's confession and WeChat chat records, the public security organs would not have known that the money had been converted into Bitcoin and transferred to her husband.

Peng Qijin is a fourth-level police sergeant of the Criminal Police Brigade of the Baiyun District Branch of the Guangzhou Public Security Bureau in Guangdong Province. He often comes into contact with fraud and money laundering cases. A case of money laundering using virtual currency that he encountered last year also gave him a new perspective on how to analyze capital flows.

The upstream crime of this case is also a case of fraud using virtual currency. At the end of February 2020, Xie reported to the police that he met a financial investment teacher online, who guided him to invest in Bitcoin on a website called "Biqi", and invested 3.1 million yuan in succession. Later, the teacher said that the investment platform went bankrupt and 3.1 million yuan was lost. Xie suspected that the other party was maliciously operating and deliberately made him lose money, so he reported the case and provided 11 first-level accounts operated by the suspect.

Baiyun police conducted a thorough investigation of the primary accounts and obtained 12 secondary accounts that had close dealings with the primary accounts. They selected 1 million yuan of the victim's investment funds to track and dig deeper into the whereabouts of the funds.

Peng Qijin told China News Weekly that the 1 million yuan was transferred from the first-level account to the second-level account, and from the second-level to the fifth-level account, the money was split, hidden, transferred, and aggregated. From the fifth-level to the sixth-level account, the amount of money transferred increased from 1 million yuan to 1.4 million yuan, and from the sixth-level to the seventh-level account, the amount of money increased to 9 million yuan, with a huge change in scale. The police found that the cardholders of the second-level to fifth-level accounts were related to each other, and they were basically from the same town in Guangdong Province. The police used this as a starting point for further investigation and found a family-style money laundering "water room" with as many as 20 people and more than 100 bank cards.

After the main culprit Zhang Xin was arrested, the police learned from his confession that the gang used virtual currency to launder money. Zhang Xin was a merchant on a digital trading platform. In February 2020, someone found Zhang Xin and bought his Tether at the market price and transferred 1 million yuan. This was the process of the defrauded money from the first-level account to the second-level account. The scammers had successfully converted 1 million yuan into Tether. The subsequent transfer of this money from the second-level account to the fifth-level account was because Zhang Xin believed that the money might be "black money" and might be frozen by the police, so he made an "anti-freeze" move.

Peng Qijin lamented that if the police only tracked the flow of funds in the bank account, they would not know that they actually used virtual currency to launder money, nor would they know that the money had already been converted into virtual currency and returned to the holder of the primary account when it was transferred from the primary account to the secondary account. The entire process from the owner's 1 million yuan being transferred to the primary account to the primary account holder receiving the virtual currency took only 6 minutes.

Yan Lixin, associate professor at the School of Economics of Fudan University and executive director of the China Anti-Money Laundering Research Center, told China News Weekly that this actually fully reflects that the operating mechanism of virtual currency has particularly distinctive characteristics such as decentralization, virtuality, anonymity, real-time, and difficulty in tampering, and transactions can be completed without the participation of financial institutions. Decentralization makes it much more difficult to track a virtual asset transaction than in a centralized state, because clues are not easy to obtain and a complete chain of evidence is extremely difficult to collect; real-time means that the steps of money laundering can be initiated and completed at a millisecond speed anywhere in the world, and regulatory authorities or law enforcement agencies have almost no sufficient response time to block it in time to prevent losses or negative impacts.

The police have arrested Zhang Xin, the main culprit in the money laundering "water room", but the investigation is not over yet. Is the holder of the first-level account the person who committed the fraud? Where did the Tether sold by Zhang Xin go? Many questions remain to be answered. After analyzing the behavioral habits of 11 first-level accounts, the police found that the first-level accounts were still not fraudsters, but another group of people engaged in money laundering, runners.

Running points is a new thing in recent years. Running points platforms refer to online platforms that illegally provide payment and settlement services (gambling, pornography, fraud, etc.) through third-party payment platform partner banks and other service providers. Running points customers are people who register accounts on these platforms, provide their own payment channel payment codes such as Alipay, WeChat, and banks, collect payments on behalf of others, transfer the money to designated accounts, and collect commissions from them.

In recent years, with the deepening of anti-money laundering operations, the running point platform has also begun to launder money through virtual currency. Peng Qijin introduced that in the aforementioned case, the victim invested in the website "Biqi". When recharging, the website automatically and secretly jumped to the running point platform. The 3.1 million yuan recharged by the victim did not go into the account of the scammer, but directly into the accounts of the running points of the running point platform. According to the instructions of the staff of the running point platform, this batch of funds was "laundered" through virtual currency.

Peng Qijin lamented that virtual currency is the carrier of black money, the running point platform is a fast channel, and the overseas chat software is a safety belt. Black money circulates at a high speed in this process. "We are driving a Jetta police car to chase behind, can we catch up? Even if we can catch up, they are some runners who have already run back and forth several times. Can we deal with these runners?" Peng Qijin pointed out that it is very necessary to spend time and energy to explore this new type of money laundering model and command model.

How to plug the loopholes in the technological “Skynet”?

As the nationwide "card-cutting" operation is launched, more and more illegal funds are being laundered through virtual currencies, and the transfer of domestic assets to overseas through virtual currencies is also on the rise. According to PeckShield's calculation of capital flows, from January to October 2020, the number of bitcoins flowing out of domestic exchanges to foreign countries ranged from 89,400 to 166,900 each month. After the "card-cutting" operation took effect, the number of bitcoins flowing out reached 231,700 and 254,100 in November and December last year, an increase of nearly 40% from the previous high.

More complex models of money laundering using virtual currencies have also emerged and are being used. Yu Jianing told China News Weekly that Western researchers have summarized three stages of typical virtual currency money laundering crimes: placement, cultivation, and integration. In the placement stage, criminals purchase virtual currencies and inject illegal funds into the channels to be "cleaned"; in the cultivation stage, money launderers use the anonymity of virtual currencies to conduct multi-level and complex transactions to conceal the nature and source of criminal proceeds, or use the "mixing" technology of virtual currencies to mix virtual currencies to be "laundered" into a "mixing pool" to obscure the original source; in the integration stage, after continuously transferring and laundering illegal proceeds, the virtual currencies held by criminals are basically unrestricted and relatively safe. At this time, they only need to withdraw virtual currencies to basically complete the money laundering operation.

As a virtual currency trading platform, how to prevent the platform from being exploited by criminals while protecting customer privacy is a challenge that all platforms have faced since their inception.

Yu Zhixiang told China Newsweek that initially, the trading platform, like various traditional financial institutions, launched a KYC policy, which stands for Know your customer, to strengthen the identity review of account holders. This means that individuals must provide identity documents when opening an account, such as ID cards, passports, etc., to ensure to the greatest extent possible that there are real, reachable people behind the accounts. This is the cornerstone of the anti-money laundering policies of various traditional financial institutions.

In recent years, more anti-fraud and anti-money laundering measures other than KYC have begun to emerge. The first is the risk isolation period policy. For some risky users identified by the platform, their withdrawals must go through a risk isolation period of T+1 days, that is, other users can withdraw cash on T day, while these risky users need to withdraw cash on T+1 day. This increases the difficulty of money laundering for money launderers who are eager to circulate funds, and they are even no longer willing to withdraw cash on the platform. In addition, the platform has set up a manual review mechanism for large transactions. Huobi Group told China News Weekly that they have implemented the technology to identify and intercept suspected victims of pig-killing schemes. In 2020, the platform has restricted 8,090 non-trading risk accounts in advance and cracked down on 186 platform fraud accounts. For users who are found to have directly participated in or assisted in criminal acts such as money laundering, Huobi will directly and permanently restrict all functions of the user's account and associated accounts.

In the past one or two years, more proactive on-chain asset tracking systems have also been launched by a number of virtual currency trading platforms and blockchain security companies, such as Huobi Group’s “Astrology System”, OKEx Group’s “On-chain Sky Eye”, and PeckShield’s Coinholmes system. These systems can obtain the flow of funds on the chain.

Taking "Eye on the Chain" as an example, Yu Zhixiang told China News Weekly that the monitoring functions on the chain are divided into "address monitoring" and "transaction monitoring". The former can monitor the dynamics of certain addresses, while the latter can be used to monitor the funds involved in a transaction. Address monitoring, through the mining and analysis of Internet data, detects a batch of virtual currency addresses related to crimes such as dark web, gangs and fraud. Once the virtual currency of such addresses is transferred, the system will sense it and track it on the chain. Tracking involves the function of transaction monitoring, and every address of the capital flow can be tracked and restored. For the monitoring system, the best result is that the assets eventually flow into the account address of a virtual currency trading platform. Generally speaking, as long as the platform has done strict KYC certification, the account and the person can be linked, and the police can immediately find the suspect. The worst result is that the assets flow into a newly opened address, which previously had only one or two transaction data, and it is extremely difficult to determine the nature of the account and who holds it behind it.

Yu Zhixiang told China Newsweek that the anonymity of blockchain technology makes it difficult to track people from addresses. In the future, as blockchain technology becomes more and more popular and payment scenarios become more and more abundant, it is possible to infer the person behind the address through payment habits. Currently, these on-chain asset tracking systems have helped public security organs in various places carry out a number of anti-fraud and anti-money laundering tasks and provided technical support for them.

Anti-money laundering mechanisms face huge challenges

Virtual currency transactions are transnational in nature, and it has always been a difficult problem to crack down on money laundering gangs and their upstream crimes. After arresting seven money launderers and "brick movers", the Baiyun police, where Peng Qijin works, could no longer continue to track down and arrest the management of the money laundering platform and the fraud company. The reason is that the money laundering platform and the fraud company are both in the Philippines.

Yu Jianing told China Newsweek that criminals can easily choose to rent servers, build virtual currency trading websites, or provide virtual currency storage services in jurisdictions with lax or no supervision, or carry out virtual currency criminal activities through the Internet, making a country's anti-money laundering and financial supervision ineffective, and international judicial assistance and extradition, which are mainly based on dual criminality, are also difficult to be effective.

Establishing an international cooperation mechanism is crucial for anti-money laundering cases. Shi Yan'an, director of the Criminal Law Science Research Center of Renmin University of China, told China News Weekly that the United Nations Convention against Transnational Organized Crime and the Convention against Corruption have both made provisions for international cooperation in anti-money laundering. The role of multilateral cooperation mechanisms should be fully utilized to strengthen the exchange of information and intelligence, especially with law enforcement and financial departments of other countries. In addition, it is also necessary to strengthen cooperation in recovering stolen money abroad on the premise of recognizing the interests that the requested party deserves.

Several experts interviewed pointed out that strengthening the supervision of virtual currency money laundering cannot be circumvented by the supervision of virtual currency and its trading platforms. Just as financial institutions have anti-money laundering mechanisms, virtual currency platforms should also establish anti-money laundering mechanisms and accept supervision by the competent authorities, which is currently lacking in China.

However, Shi Yanan pointed out that such platforms do not have the corresponding "payment business license" and are neither financial institutions nor specific non-financial institutions. There are no clear regulations on what anti-money laundering regulations they should comply with and what anti-money laundering obligations they should fulfill during their actual operations.

Digital currency trading platforms have, to a certain extent, been separated from the existing regulatory system. In 2017, the regulatory authorities ordered all domestic digital currency exchanges to close within a time limit and stop registering new users. However, as a number of virtual currency trading platforms with servers located overseas but accessible in China have become known, simply banning platform transactions in China is no longer enough to stop the operation of the virtual currency market. Zhao Binghao, associate professor at the School of Civil, Commercial and Economic Law of China University of Political Science and Law, told China News Weekly that a one-size-fits-all or ostrich policy is obviously not feasible. Virtual currency has only been around for a dozen years, and its development speed is much faster than that of the traditional financial industry. The regulatory authorities must change their mindset, face reality, and gradually explore and find a regulatory solution that suits my country's actual situation.

Zhao Binghao pointed out that at present, the supervision of virtual currency in my country is led by the People's Bank of China, but the traditional regulatory agencies and regulatory power system are sometimes out of reach for financial innovation under blockchain technology. Shi Yan'an also believes that the People's Bank of China has an Anti-Money Laundering Bureau, but the Anti-Money Laundering Bureau can only supervise institutions that have obtained licenses, and the problem of virtual currency money laundering cannot be solved by only supervising financial institutions or specific non-financial institutions. The Anti-Money Laundering Bureau is affiliated to the People's Bank of China and has a low level. It is difficult to communicate and coordinate with multiple ministries and commissions such as the Public Security Bureau, Customs, and the Cyberspace Administration of China, and money laundering is precisely a matter involving various industries. In addition, the Anti-Money Laundering Bureau "has no teeth". After discovering suspicious clues, it needs to rely on the public security organs to investigate and collect evidence. The work that the Anti-Money Laundering Bureau can do is very limited.

In Shi Yan'an's opinion, it is unlikely that virtual currency trading platforms will be included in my country's financial institutions or specific non-financial institutions. Therefore, it is possible to consider separating the Anti-Money Laundering Bureau from the People's Bank of China and making it a subordinate agency of the State Council, on the one hand to enhance its status, and on the other hand to give it greater powers to include virtual currency trading platforms in supervision.

"Whether it is early prevention, monitoring, or timely blocking, there are still deficiencies in terms of legal basis and means of implementation," Yan Lixin pointed out. Bigger challenges have also emerged. Zhao Binghao pointed out, "Last year, decentralized virtual currency exchanges began to become popular. There is no operator and no KYC certification. This is probably the inevitable path that virtual currencies will take. But for regulators around the world, everyone is far from ready."

(All criminals and suspects mentioned in this article are pseudonyms)