Partnered With:

Reveal the process behind 3800 BTC trading, Japan and Korea trading platform theft why the us sanctions China's OTC exchanges

Read this article in 11 Minutes

Japan and South Korea trading platform stolen, why the United States sanctions China's OTC exchanges? What do we see when we trace the wallet's location?

Beijing lianan

The us Treasury's office of foreign assets control (OFAC) recently announced that two Chinese citizens had been sanctioned for helping north Korea's Lazarus hacking team to launder $91m through its over-the-counter (OTC) bitcoin exchange business. One of the Chinese citizens sanctioned said he was not aware of this, and that he was also a victim when his assets were frozen in late 2018 after he bought bitcoin from another Chinese citizen accused of doing so on the over-the-counter trading platform Coca-Cola.

According to public information, the case involves the theft of $250 million worth of digital assets by Lazarus. The hackers transferred the bitcoin assets to four exchanges where the two Chinese citizens were involved in the money-laundering process through OTC services.

Naturally, people guess which is the digital asset theft cases involved, in to the media disclosure, OFAC though didn't mention the specific name of exchange, but referring to the related process, in April 2018, an exchange of staff downloaded E-mail Lazarus distribute malicious programs, so that the hacker intrusion system, and steal the key. The exchange's $250m-worth of digital assets were then stolen, half of the total that Lazarus expected to steal that year, and 2018 is thought to have been the hacking group's most active year.

According to public disclosures, major exchanges that acknowledged the theft of large amounts of digital assets after April 2018 include Coinrail, Bithumb and ZAIF, all of which were suspected to be related to Lazarus. Of course, we do not rule out that some exchanges may have been stolen but did not disclose it, instead reporting it directly to law enforcement.

According to the relevant information, Beijing chainan tried to restore the relevant process to a certain extent by using the tracing system on chainchainsmap, and revealed the challenges faced by the current industry in the anti-money laundering of illegal digital currency activities.

OFAC published on its official website 20 addresses of two Chinese citizens involved in the case, among which LI, Jiadong (hereinafter referred to as LI) involved 12 addresses, TIAN, Yinyin (hereinafter referred to as TIAN) involved 8 addresses. Through our address label library, we can find that they belong to at least four exchanges such as coincola and LocalBitcoins. The first transactions took place as early as July 2017 and as late as October 2018, and the addresses are no longer active.

We further calculated the amount of bitcoin flowing into the relevant address. It is important to note that this is only a one-way transaction concept and does not rule out repeated back and forth. Although LocalBitcoins accounted for at least 9 of the 20 addresses involved, most of these addresses were only used once or twice, and only 67 pieces of historical money were involved. Coincola became involved two main OTC exchange, LI, in an address on the exchange history into the currency amount reached 1449 BTC, and TIAN in the history of coincola five addresses concerns into the currency amount more than 8000 BTC, here we mention again here BTC inflow is a historical transaction records the concept of cumulative. The bitcoin amounts are also the total after the first transaction at the address in question, and the alleged money laundering by OFAC is only part of that.

So what is the character of the Lazarus deal? We have discovered a number of related transactions based on the historical transactions of these addresses through backtracking and association.

On December 12, 2018, a 3800BTC bitcoin UTXO began to transfer and transfer some bitcoin into the exchange. In the figure, we can see that OFAC's public address is included, and 30BTC is transferred each time.

From the source of the 3,800 BTC, the vast majority of the transfers from HitBTC between June 25 and July 5, 2018 were mostly in dozens of bitcoins. So was HitBTC attacked by hackers? This possibility can be ruled out from these transactions, because they are all large amount difference transactions initiated by hot wallet to multiple unrelated addresses at the same time, that is, the typical exchange to meet the user's demand for COINS. In the LocalBitcoins address involved in the case, most of the bitcoin received was directly from some exchanges.

Since the digital assets stolen by the exchanges Lazarus attacked were not only bitcoins, but also involved multiple currencies, we can speculate that there was a process of entering some exchanges to convert other currencies into bitcoins for exchange trading, and then transferring them to other exchanges for otc transactions. At the same time, according to the disclosed information, after the relevant bitcoin is realized, it not only enters the bank account, but even flows 1.4 million dollars into the gift card of apple iTunes, which makes the digital money laundering closely combined with the traditional money laundering methods.

Taken together, although OFAC's information relates to a specific exchange theft case, the actual digital assets involved are likely to have originated from a number of incidents in which money was stolen by hackers, passed through exchanges and flowed to more financial channels of industries and services. Beijing lianan believes that the current digital asset laundering has been a complex process of cross-exchange, cross-currency and cross-industry, and professional technical means, laws and regulations, as well as industry consensus and cooperation are urgently needed from the perspective of industry or government supervision.