The Changing Nature of Cryptocrime - chainalysis.com Changing Nature of Cryptocrime ... but the Mt. Gox hack accounts for nearly 80% of Bitcoin ... the Chainalysis-developed software

© 2018 Chainalysis, Inc. All rights reserved. | www.chainalysis.com

The Changing Nature of Cryptocrime


REPORT

January 2018



The nature of crime in the Bitcoin ecosystem has evolved since it was popularized as a way to buy drugs on the internet via the first darknet market, the Silk Road. The share of Bitcoin transactions sent to darknet markets has declined from 30% in 2012 to less than 1% in 2017, although the absolute value has increased, with $660 million of Bitcoin sent to darknet markets in 2017. Meanwhile, the value of Bitcoin stolen through scams, ransomware, and hacking has increased at least 30-fold since 2013. Theft of Bitcoin has risen from at least $3 million in 2013, to a peak of $95 million in 2016. The surge in stolen funds is driven by a few large hacks, such as the $65 million hack of Bitfinex in 2016 or the $75 million hack of NiceHash in December 2017.

These trends illustrate that Bitcoin is no longer just about cryptocrime, and that cryptocrime is no longer just about illicit exchange on darknet markets, but is increasingly focused on the theft of Bitcoin as a highly valued financial asset.



Darknet Markets Are No Longer a Major Use of Bitcoin

Darknet markets now account for a fraction of Bitcoin transactions, although the absolute value of Bitcoin sent to them has increased over the years. In 2017, there was more than $660 million of Bitcoin sent to darknet markets. This is a more than 11-fold increase from the $57 million sent to darknet markets in 2012, when the Silk Road, the first darknet market, was becoming popular. However, the share of Bitcoin transactions going to darknet markets has declined from its peak in 2012. In March of 2012, nearly 30% of all Bitcoin transactions were being sent to darknet markets, but in 2017 this had declined to less than 1%.

What explains these changes? At Chainalysis, we believe these shifts are due to three factors:

• Law enforcement has closed the largest darknet markets; • The rise of other uses of Bitcoin, namely as a financial asset; and• The growing use of alternative cryptocurrencies on darknet markets.

Alphabay, Hansa, and RAMP closures


The Changing Nature of Cryptocrime 4

Law enforcement has closed the largest darknet markets

Bitcoin has become a financial asset, crowding out its use a means of illicit exchange

Law enforcement takedowns of the Silk Road, AlphaBay, Hansa Market, and Russian Anonymous Marketplace (RAMP), the largest markets at the time of their takedown, has added risk to the online trade of illicit goods and helped to bring Bitcoin into the mainstream.

The October 2013 takedown of the Silk Road illustrates how law enforcement action has helped bring Bitcoin into the mainstream. Immediately after the Silk Road was shut down, the dollar value of Bitcoin transactions spiked nearly 80% and the average price of Bitcoin in November reached $535 compared to $150 in the previous month. While this likely had to do with darknet market vendors liquidating their Bitcoin, the Silk Road closure helped bring Bitcoin to the mainstream by bringing in a new set of Bitcoin owners and reducing its association with illegal activity.

Law enforcement has systematically shut down the highest volume darknet markets. At the time of its takedown, the Silk Road accounted for 99% of all darknet market activity. Recently, AlphaBay, Hansa Market, and RAMP accounted for nearly 87% of all darknet market activity before they were taken down by the authorities in July 2017. As a result, the value of Bitcoin transactions to darknet markets fell by two thirds between May and July 2017.

Bitcoin is increasingly viewed as a financial asset, given its x14 price increase in 2017. As a consequence, it is likely to be less useful as a means of exchange for criminal activity. In 2012, when darknet market activity was 30% of all Bitcoin network transactions, Bitcoin was valued at less than $20 with a volatility of 1.3% in December 2012. Today, Bitcoin is valuable and volatile, with volatility exceeding 8.1% in December 2017. The growth of Bitcoin as a financial asset has been rapid when compared to its growth as an illicit means of exchange, with tens of billions of dollars worth of Bitcoin being sent to exchanges in 2017, compared to the $660 million sent to darknet markets.



Darknet markets are starting to accept cryptocurrencies other than Bitcoin

The share of Bitcoin used in darknet markets is also declining as other cryptocurrencies have arisen, such as Monero, Zcash and Dash, which offer greater anonymity and currently lower transaction fees than Bitcoin. These privacy-based cryptocurrencies have experienced large price increases in 2017, and it is hard to distinguish the extent to which this is due to speculation or greater use.

However, law enforcement expects greater use, with Rob Wainwright, Executive Director of Europol tweeting on 2 January: “We’ll see a progressive shift in 2018 towards criminal use of cryptocurrencies other than Bitcoin, making it generally more challenging for law enforcement to counter”. Furthermore, Chainalysis investigations can confirm there are indications of greater use of these alternative cryptocurrencies.

For example the number of transactions on the Monero network increased by 230% in 2017, and XMR.to, a service that makes Bitcoin payments on behalf of Monero users to maintain their anonymity, sent $52 million worth of BTC in December 2017, a x4.5 increase on the month before. In addition, a Chainalysis survey of darknet markets suggests that Monero acceptance is increasing. For example. AlphaBay accepted Monero prior to its closure, Tochka and Aero added Monero in 2017, and Libertas only accepts Monero.

These alternative currencies have recently become even more attractive means of illicit exchange as Bitcoin transaction fees have increased due to network congestion. Prior to 2012, average Bitcoin transaction fees were less than one dollar. By mid December 2017, the average transaction fee was nearly $60, according to bitinfocharts.com. Analysis of reddit forums shows that darknet market users are increasingly frustrated by these high fees, openly discussing Monero or Zcash as cheaper alternatives.



Theft of Bitcoin via Scams, Ransomware, and Hacks is on the Rise

As Bitcoin has become more valuable, Bitcoin-related crime increasingly includes theft of other individuals’ holdings. Between 2015 and 2016 alone, crypto-theft increased by at least 7-fold. Crypto-thieves tend to steal Bitcoins through scams, ransomware, and hacks. Chainalysis tracks major events in each of these categories, so the data below provides a snapshot of trends rather than a comprehensive coverage.

Hacks have been the main source of Bitcoin theft

Hacks have been responsible for at least $172 million worth of Bitcoin between 2013 and 2017, using prices at the date of the hack. Recent hacks, of NiceHash in December 2017 and Bitfinex in August 2017, have been the most valuable given high Bitcoin prices at the time of the hacks, accounting for over 80% of the USD value stolen. However, the Mt Gox hack is responsible for nearly 80% of the Bitcoin stolen. 660 thousand Bitcoin were stolen from Mt Gox over a two-year period, from October, 2011 to July, 2013. These were worth $7.5 million at the time the coins were stolen, but which were worth nearly $10 billion at January 2018 prices.



Two hacks are responsible for over 80% of the USD value stolen, given prices at the time of the hack...

...but the Mt. Gox hack accounts for nearly 80% of Bitcoin stolen via hacks



The scale of scams is hard to assess but is likely to have affected a large number of victims

Ransomware has earned criminals at least $31 million in Bitcoin

Bitcoin has been favored by many ransomware attackers. Without needing to reveal their identity or location, criminals can receive ransom payments to newly generated Bitcoin addresses. Chainalysis estimates that in the past 5 years, global ransom payments using Bitcoin totaled at least $31 million. 80% of the amount stolen via ransomware attacks went to the top five strains of ransomware, as shown below.

The total number of scams is hard to track given that scams target a large number of victims, each for a relatively small sum. We confirmed a sample of 23 scams using Chainalysis software. These 23 scams alone accounted for over $17 million in stolen funds from ponzi schemes, phishing email attacks, and other fraudulent activities. The scale could be much larger, for example the Bitcoin Bad List, a user-generated list of possible scams, identifies 5,033 frauds since 2014. Proving and prosecuting Bitcoin scams is extremely difficult for law enforcement, making it even more difficult to identify and track scams. While some scammers have been arrested, for the most part the dispersed nature of scams has made them hard to prosecute to date.



Bitcoin has matured significantly since 2012, when it made its name as an illicit means of exchange. Darknet markets are now a small corner of the Bitcoin network and are evolving under pressure. At the same time, as Bitcoin has gone mainstream and increased in value, it has rapidly become the target of theft. This changing nature of cryptocrime will require new approaches by law enforcement and increased vigilance against thefts and scams by Bitcoin users.

Chainalysis will continue to monitor and fight these types of cryptocrime, and others, such as money laundering, tax evasion, human trafficking, and terrorism financing, to promote the continued mainstream adoption of cryptocurrencies.

The Future of Cryptocrime



Cryptocrime data has been analyzed since the inception of Bitcoin in 2009 using the following tools and sources:

• Darknet Market activity data came from Reactor, the Chainalysis-developed software tool that tracks Bitcoin network activity. All transactions are traced by Chainalysis and then clustered into darknet market clusters based on data scraped from the internet.

• Ransomware activity came from classification in Reactor, open-source intelligence, lists provided by Chainalysis customers, and online resources such as bitcoinwhoswho. The transaction histories of these addresses were then verified in Reactor.

• Scams came from Reactor classification.

• Hacks came from Chainalysis investigations.

• Network Transaction Volume came from data collected on blockchain.info

Methodology

About ChainalysisChainalysis cryptocurrency analytics products have been deployed by over 100 customers in the world’s leading law enforcement agencies, financial institutions, and cryptocurrency exchanges. Chainalysis is backed by the top names in venture-financing, and has grown to over 50 employees internationally.

For more information visit: www.chainalysis.com

Documents

The Changing Nature of Cryptocrime - chainalysis.com Changing Nature of Cryptocrime ... but the Mt. Gox hack accounts for nearly 80% of Bitcoin ... the Chainalysis-developed software