Bitcoins: BTC-e, the Russian exchange you know? Digital currencies (Bitcoin, etc.) are a favorite tool of cybercriminals, as transactions with the digital currency are almost anonymous. This allows cybercriminals to use it in underground markets for illegal transactions and collect thousands of dollars from ransomware attacks (WannaCry, Petya, LeakerLocker and Locky to name a few).
Every now and then we hear about incidents of hacking of cryptocurrency exchanges or digital currencies. What happens to the digital currencies that are stolen by fraudsters?
The most recent theft involved Ethereum, one of the most popular and increasingly valuable cryptocurrencies. Approximately half a billion dollars were stolen in this online heist.
It's obvious that such digital currency movements are leading somewhere. If cybercriminals don't want to keep them in digital form, they'll have to cash them out so they can use them in the real world.
But how can they cash them in without being noticed by the authorities?
If you don't know, there are crypto exchanges involved in money laundering, which operate illegally to help cybercriminals easily cash out their digital currencies. The cashing out is done completely anonymously.
According to a recent study presented by three Google researchers at Black Hat, over 95% of all Bitcoin payments collected from ransomware victims have been cashed out through a Russian cryptocurrency exchange called BTC-e since 2014.
Interestingly, just two days before Google's presentation, one of the founders of the BTC-e exchange, Alexander Vinnik, was arrested by the Greek Police on charges of money laundering amounting to $4 billion.
“We are discovering the cash-out points, tracing how the money exits the Bitcoin network, allowing authorities to retrieve the money using conventional financial detection tools,” said the three researchers, Luca Invernizzi, Kylie McRoberts, and Elie Bursztein.
Bitcoins: The Research Tracking desktop ransomware payments
________________________
Ransomware Payment Tracking
Researchers have been following the money from various ransomware attacks, which have netted cybercriminals at least $25 million in the past two years.
The worst Ransomware:
According to the research, two ransomware helped the scammers earn the most money: Locky and Cerber.
Performance:
Locky alone earned $7.8 million and was the first ransomware infection to earn over $1 million per month. Cerber has yielded $6.9 million to date at $200,000 per month.
Where do victims buy Bitcoins from?
Victims' favorite places to buy Bitcoins? Obviously, victims need the BTC to pay the criminals and most victims choose LocalBitcoins, Bithumb and CoinBase to buy BTC, where 90% of victims pay in one transaction.
How criminals are paid:
According to the research, over 95% of all Bitcoin payments from ransomware were cashed out through BTC-e, a service that has been operating since 2011.
Google conducted the research in collaboration with researchers from New York University, the University of California, San Diego, and blockchain analytics firm Chainalysis.
As for BTC-e, many believe that the cryptocurrency exchange has also been involved in the exchange of stolen Bitcoins from the Mt. Gox, which closed in 2014 after several mysterious robberies.
