Episode Summary
Executive Summary: Laura Shin interviews Chainalysis co-founder Jonathan Levin and head of research Kim Grauer about their 2020 Crypto Crime Report. They explain how crypto crime is mostly about money laundering, cash-out pathways, and increasingly sophisticated use of exchanges, OTC brokers, mixers, ransomware, and terrorist fundraising. The discussion emphasizes that illicit activity is concentrated, traceable on-chain, and best addressed through stronger exchange compliance and cross-border coordination.
Main Topics: Chainalysis and the purpose of the Crypto Crime Report (Priority: 5/5): The guests explain Chainalysis’ role in blockchain analytics, compliance, and investigations, and how the report maps illicit crypto activity such as laundering, hacks, scams, ransomware, and terrorist financing in context of the broader crypto economy. Money laundering infrastructure and OTC brokers (Priority: 5/5): A major focus is the report’s finding that illicit funds concentrate into a small set of deposit addresses and often flow through OTC brokers before reaching exchanges, suggesting a laundering infrastructure rather than isolated actors. How illicit funds cash out through exchanges (Priority: 5/5): The conversation covers why cash-out routes shifted after BTC-e shut down, with funds moving to major exchanges via OTC intermediaries. The guests stress that exchanges must monitor OTC customers and source of funds more closely. PlusToken scam and price impact (Priority: 4/5): The guests describe PlusToken as a massive Ponzi scheme, tracing billions in stolen funds through wallets, mixers, and Huobi. They explain their econometric analysis linking the scam’s cash-out activity to increased volatility and price decline. Exchange hacks and the Lazarus group (Priority: 4/5): They discuss 2019’s increase in the number of exchange hacks, but lower average losses, suggesting better security. They also describe North Korea-linked Lazarus operations as more sophisticated, using shell companies, malware, CoinJoin, and faster cash-outs. Ransomware and ransomware-as-a-service (Priority: 4/5): The guests note that ransomware remains heavily crypto-linked, with growing ransomware-as-a-service models that split proceeds between authors and perpetrators. They stress backups, patching, and underreporting as major issues. Terrorism financing and the need for expertise (Priority: 3/5): They say terrorism fundraising via crypto is small in dollar terms but important because attacks can be cheap to carry out. They caution against misinformation and emphasize expert-driven attribution and law enforcement coordination.
Key Arguments: Illicit crypto activity is often best understood as a money-laundering problem, with criminals using cryptocurrency as a step before converting to fiat. A small number of OTC brokers and deposit addresses appear repeatedly in investigations, indicating concentration in laundering infrastructure rather than fully decentralized criminal use. When BTC-e shut down, illicit cash-outs did not disappear; they migrated to other venues, especially Binance and Huobi via OTC intermediaries. Exchanges may be KYC-compliant on the surface, but the weak point is often their OTC customers’ counterparties and source-of-funds checks. Chainalysis can often trace funds even through mixers and CoinJoin because blockchain transactions are public, especially when sums are large and activity leaves patterns. PlusToken was so large that its liquidation may have affected Bitcoin volatility and price, showing that criminal cash-outs can move markets. 2019 saw more exchange hacks but lower average and median losses, suggesting improved exchange security or better fund management. Lazarus-linked attackers became more sophisticated by using shell companies, malware-laden demo products, and faster movement to off-ramps. Ransomware has become more industrialized through ransomware-as-a-service, making the threat broader and easier to deploy. Terrorism financing via crypto remains small in absolute dollars, but even tens of thousands can matter because attacks can be inexpensive to execute.
Data Points: Cryptocurrencies tracked: Around 50 - Chainalysis says it tracks roughly 50 cryptocurrencies in its background research and report analysis. Share of illicit funds routed to Binance and Huobi after BTC-e shutdown: About 52% - The guests say roughly 52% of funds formerly going to BTC-e were rerouted to Binance and Huobi. Rogue OTC broker list size: 100 - Chainalysis says its curated ‘Rogue 100’ list contains about 100 OTC brokers tied to repeated investigations. Rogue OTC brokers using Huobi: 70 out of 100 - The guests say 70 of the Rogue 100 were associated with Huobi. PLUS Token public estimate: Around $3 billion - Laura and the guests cite a public legal estimate of about $3 billion raised by the PlusToken scheme. PLUS Token traced amount: $2 billion - Chainalysis says it traced about $2 billion to PlusToken wallets. Exchange hacks in 2019: 11 - They say 2019 saw 11 exchange hacks in the report’s dataset. Exchange hacks in 2018: About 8 - Jonathan notes 2019 was up from roughly 8 hacks in 2018. Largest value stolen from exchange hacks in 2019: Third highest historically - The report found 2019 had the most hacks but not the highest total value stolen. Terrorism financing campaign size: Tens of thousands of dollars - They describe crypto-based terrorism fundraising as small in dollar terms, but still meaningful. Ransomware history: 1989 - Jonathan notes the first known ransomware predates crypto and appeared on a floppy disk in 1989.
Pivotal Quotes: "The 2020 Crypto Crime Report is really about mapping out how different actors are abusing cryptocurrencies to further their aims." — Jonathan Levin: He defines the report’s core purpose and scope. "There was a really high concentration of illicit funds going to a small number of deposit addresses." — Jonathan Levin: He describes the key finding behind the laundering infrastructure analysis. "Even a small amount of money like this is something that you really need to pay attention to." — Kim Grauer: She explains why terrorism financing in crypto matters despite modest sums.
Implications: Crypto crime is increasingly about identifiable laundering pathways, not anonymous chaos. Exchanges, OTC brokers, and regulators need stronger source-of-funds controls, faster information sharing, and better incident reporting to reduce cash-out risk and improve enforcement.