An independent investigation carried out by global news agency Reuters, is alleging that the world’s largest cryptocurrency exchange Binance served as a conduit for the laundering of at least $2.35 billion in illicit funds.
According to it’s findings, in September 2020, a North Korean hacking group known as Lazarus broke into a small Slovakian crypto exchange and stole virtual currency worth some $5.4 million. It was one of a string of cyber heists by Lazarus that Washington said were aimed at funding North Korea’s nuclear weapons programme.
Several hours later, the hackers opened at least two dozen anonymous accounts on Binance, the world’s largest cryptocurrency exchange, enabling them to convert the stolen funds and obscure the money trail, correspondence between Slovakia’s national police and Binance reveals.
In as little as nine minutes, using only encrypted email addresses as identification, the Lazarus hackers created Binance accounts and traded crypto stolen from Eterbase, the Slovakian exchange, according to account records that Binance shared with the police and that are reported here for the first time.
“Binance had no idea who was moving money through their exchange” because of the anonymous nature of the accounts, said Eterbase co-founder Robert Auxt, whose firm has been unable to locate or recover the funds.
Eterbase’s lost money is part of a torrent of illicit funds that flowed through Binance from 2017 to 2021, a Reuters investigation has found.
During this period, Binance processed transactions totalling at least $2.35 billion stemming from hacks, investment frauds and illegal drug sales, Reuters calculated from an examination of court records, statements by law enforcement and blockchain data, compiled for the news agency by two blockchain analysis firms. Two industry experts reviewed the calculation and agreed with the estimate.
Separately, crypto researcher Chainalysis, hired by U.S. government agencies to track illegal flows, concluded in a 2020 report that Binance received criminal funds totalling $770 million in 2019 alone, more than any other crypto exchange. Binance CEO Changpeng Zhao accused Chainalysis on Twitter of “bad business etiquette.”
Binance declined to make Zhao available for an interview. Responding to written questions, Chief Communications Officer Patrick Hillmann said Binance did not consider Reuters’ calculation to be accurate. He did not respond to requests to provide Binance’s own figures for the cases identified in this article. He said Binance was building “the most sophisticated cyber forensics team on the planet” and was seeking to “further improve our ability to detect illegal crypto activity on our platform.”
As Reuters reported in January, Binance kept weak money-laundering checks on its users until mid-2021, despite concerns raised by senior company figures starting at least three years earlier. In response to that article, Binance said it was helping drive higher industry standards and the reporting was “wildly outdated.” In August 2021, Binance compelled new and existing users to submit identification.
With around 120 million users worldwide, Binance processes crypto trades worth hundreds of billions of dollars a month. The sector was hit by a sharp correction in May, its overall value slumping by a quarter to $1.3 trillion. Zhao said he saw “new found resiliency” in the market.
Meanwhile, his company is extending its reach into traditional business, announcing a $200 million investment in media group Forbes this year and committing $500 million to Tesla boss Elon Musk’s bid to take over Twitter. Forbes abandoned its plans to list publicly last week and a Forbes spokesperson said Binance’s investment would not take place. Musk didn’t respond to requests for comment.
The flow of illicit crypto through Binance, identified by Reuters, represents a small portion of the exchange’s overall trading volumes. Yet as policymakers and regulators, including U.S. Treasury Secretary Janet Yellen and European Central Bank President Christine Lagarde, voice concern over the illegal use of cryptocurrencies, the trade demonstrates how criminals have turned to the technology to launder dirty money.
Reuters reviewed detailed data about Binance client transactions on “darknet” sites – marketplaces for narcotics, weapons and other illegal items. Most of the data was provided by Crystal Blockchain, an Amsterdam-based analysis firm that helps companies and governments trace crypto funds. The data showed that from 2017 to 2022, buyers and sellers on the world’s largest darknet drugs market, a Russian-language site called Hydra, used Binance to make and receive crypto payments worth $780 million. Reuters cross-checked these figures with another analysis firm, which agreed with the findings.
In April, the U.S. Justice Department announced that U.S. and German law enforcement had seized Hydra’s servers. The U.S. indicted the servers’ alleged administrator for conspiring to commit money laundering and distribute illicit drugs. The site was closed down and the alleged administrator arrested by Russian authorities.
The data compiled for Reuters included crypto that passed through multiple digital wallets before reaching Binance. For crypto firms, such “indirect” flows with links to known suspicious sources are red flags for money laundering, according to the Financial Action Task Force, a global watchdog that sets standards for authorities combating financial crime. Money launderers often use sophisticated techniques to create complex chains of crypto transfers that cover their tracks, the FATF and the International Monetary Fund have said.
Hillmann, the Binance spokesperson, said the Hydra figure was “inaccurate and overblown” and that Reuters was wrongly including indirect flows in its calculation.
Reuters then asked how Binance views its responsibility to monitor its indirect exposure to dirty money. Hillmann replied that “what’s important to note is not where the funds come from – as crypto deposits cannot be blocked – but what we do after the funds are deposited.” He said Binance uses transaction monitoring and risk assessments to “ensure that any illegal funds are tracked, frozen, recovered and/or returned to their rightful owner.” Binance is working closely with law enforcement to dismantle criminal networks using cryptocurrencies, including in Russia, he said.
After another heist in March this year, when Lazarus stole over $600 million from an online game involving cryptocurrencies, Zhao said North Korean hackers had transferred an unspecified amount of the funds to Binance. Hillmann told Reuters that Binance has identified and frozen more than $5 million and is assisting law enforcement with its investigation. He didn’t provide further details.
The United States sanctioned Lazarus in 2019 over cyber attacks designed to support North Korea’s weapons programmes, calling it an instrument of the country’s intelligence service – an accusation Pyongyang called “vicious slander.” North Korea’s mission to the United Nations did not respond to emailed questions. Blockchain researcher Chainalysis estimates that Lazarus stole crypto worth $1.75 billion by 2020 that mostly flowed through unidentified exchanges.
Reuters’ new reporting follow up investigation shows that many people who signed up to Binance in Russia weren’t using it for trading. Instead, Binance became a key payment provider for Hydra, the giant darknet marketplace, according to the blockchain data compiled for Reuters, a review of Hydra user forums, and interviews with illegal drug users and researchers.
After it was set up in 2015, Hydra distributed narcotics on behalf of drug dealers, all priced in bitcoin, to millions of buyers, mostly in Russia.
German police, in coordination with U.S. authorities, seized Hydra’s servers in Germany in April, closing the site down. The U.S. indicted a Russian resident, Dmitry Pavlov, for administering the servers. A week later, Russian authorities arrested Pavlov for allegedly dealing in drugs, a Moscow court said, adding he had filed an appeal. Before his arrest, Pavlov told the BBC he ran a licensed server company and was not aware it was hosting Hydra. Pavlov didn’t respond to messages from Reuters sent via his company.
The Justice Department, describing Hydra as “the world’s largest and longest-running darknet market,” said the site had received in total around $5.2 billion in cryptocurrency. Neither Binance nor any other payment provider linked to Hydra was named by the Justice Department, which declined to comment on Binance.
Hillmann told Reuters that Binance “works closely with law enforcement to target the illicit drug trade daily.”
Sites like Hydra are only accessible on a clandestine part of the internet, known as the dark web, that requires a browser that hides a user’s identity.
As early as March 2018, Hydra users recommended on the site’s Russian-language forums that buyers use Binance to make purchases, citing the anonymity Binance afforded its clients at the time by allowing them to register with just an email address. “This is the fastest and cheapest way I’ve tried,” a user wrote.
Cryptocurrency traders exchanged dozens of messages in 2021 and early 2022 about using Hydra on Binance’s own Russian community Telegram chat. “The Hydra is thriving,” wrote one last year.
Hydra transformed the narcotics market in Russia, researchers said. Previously, drug users tended to buy from street dealers with cash. With Hydra, users selected substances on the site, paid the seller in bitcoin, and received coordinates to pick up the “treasure” at a discreet location. Buyers, known as “treasure hunters,” found their purchases buried in forests at the edge of town, hidden in garbage dumps, or stuffed behind loose bricks in abandoned buildings.
According to a report by the United Nations Office on Drugs and Crime, Hydra increased the availability of drugs in Russia and drove a surge in demand for stimulants, such as methamphetamine and mephedrone. Drug-related deaths rose by two-thirds between 2018 and 2020, figures from Russia’s state anti-drug committee show.
At the time of the U.S. and German operation to seize Hydra’s servers, the Drug Enforcement Administration, which supported the investigation, said the marketplace’s services “threaten the safety and health of communities far and wide.” The DEA referred Reuters to the Justice Department for further comment.
Aleksey Lakhov, a director at Russian charity foundation Humanitarian Action, which researches drug use, said he was “horrified” by how Hydra fuelled addiction. “During the days I used drugs, you had to know someone at least” in order to obtain narcotics, Lakhov, a recovered addict, added.
Alexandra, a 24-year-old office manager in Moscow, started buying mephedrone and ketamine on Hydra in 2019 to help cope with her bipolar disorder. Several friends who used Hydra told her Binance was the safest way to pay dealers, Alexandra told Reuters, speaking on condition she be identified only with her first name. Some of them used fake personal information to open Binance accounts, she said, but she uploaded a copy of her passport. Binance never blocked or queried any of her payments. Asked about her account, Binance said it was continually strengthening its know-your-customer capabilities.
The system’s anonymity made it easy to buy drugs on the darknet, Alexandra said. “It was like buying chocolate in the store.”
As her drug use became an everyday habit, she went days without sleep, wracked by hallucinations and depression. “I felt like I was dying, and I liked that feeling,” she said. Eventually, she sought psychiatric help and received therapy. Since then, she just used Hydra to buy cannabis.
State Department reports from 2019 and 2020, without mentioning Hydra or Binance, warned that drug traffickers in Russia were using virtual currencies to launder proceeds. A State Department spokesman declined to comment on Hydra and Binance.
As reported by Reuters in its January investigation, an internal document shows that Binance was aware of the risk of illegal finance in Russia. Binance’s compliance department assigned Russia an “extreme” risk rating in 2020 in an assessment that was reviewed by Reuters. It cited money-laundering reports by the U.S. State Department. Hillmann told Reuters Binance had taken more action against Russian money launderers than any other crypto exchange, citing a ban it imposed on three Russian digital currency platforms that were sanctioned by the United States.
Crypto flows between Binance and Hydra dropped sharply after the exchange tightened its customer checks in August 2021, the data from Crystal Blockchain shows.
For the past five years, Binance has allowed traders on its platform to buy and sell a coin called Monero, a cryptocurrency that offers users anonymity. While bitcoin transactions are recorded on a public blockchain, Monero obscures the digital addresses of senders and receivers. A Beginner’s Guide to Monero by Binance, available on its website, said such coins were “desirable for those seeking true financial confidentiality.”
Zhao has spoken in favour of “privacy coins,” of which Monero is the most traded. During a 2020 video call with staff, a recording of which Reuters reviewed, Zhao said privacy was part of people’s “financial freedom.” He didn’t mention Monero, but said Binance had funded other privacy coin projects.
Monero proved to be popular among Binance users. As of late May, Binance was processing Monero trades worth around $50 million a day, far more than other exchanges, according to data from the CoinMarketCap website.
Law enforcement agencies in Europe and the United States have warned that Monero’s anonymity makes it a potential tool for money launderers. The U.S. Department of Justice, in a 2020 report, said it considered the use of “anonymity enhanced cryptocurrencies” like Monero “a high-risk activity that is indicative of possible criminal conduct.”
On several darknet forums that Reuters reviewed, over 20 users wrote about buying Monero on Binance to purchase illegal drugs. They shared how-to guides with names like DNM Bible, a reference to darknet markets.
“XMR is essential to anyone buying drugs on the Dark web,” wrote one user on the forum Dread, referring to Monero’s ticker symbol. It isn’t possible to contact users through the forum so Reuters was unable to reach these people for comment.
Hillmann told Reuters there were “many legitimate reasons why users require privacy,” such as when opposition groups in authoritarian regimes are denied safe access to funds. Binance opposed anyone using crypto to buy or sell illegal drugs, he said.
Hackers have used Binance to convert stolen funds into Monero.
August 2020, hackers hijacked a cryptocurrency wallet belonging to an Australian man named Steve Kowalski by tricking him into downloading malware, Kowalski said in a witness statement to Australian police. They withdrew the 1,400 bitcoin he held in the wallet, worth some $16 million at the time. Kowalski told police he had bought the bitcoin for $500,000 six years earlier and they were a significant portion of his assets.
Investigators hired by Kowalski traced most of his bitcoin through a series of wallets to six Binance accounts, where the coins were exchanged for Monero, according to testimony and blockchain analysis reports filed as part of an ongoing civil complaint Kowalski submitted last year against Binance in Miami-Dade County, Florida. Kowalski declined to comment.
Kowalski’s investigation showed that a U.S. software consultant called Brandon Ng, then living in Florida, controlled most of the Binance accounts. Ng testified to the court that a crypto trading partner, who he knew online only by the username MoneyTree, deposited the bitcoin in his Binance accounts. MoneyTree, Ng said, paid him a 1% commission to convert the bitcoin into Monero on Binance and then transfer it back. A lawyer for Ng, Spencer Silverglate, said MoneyTree likely traded through Ng to shield his identity from Binance. Ng testified that he was not aware he was laundering stolen bitcoin.
MoneyTree did not respond to emails sent by Reuters to an address that Ng provided to the court. Silverglate, the lawyer, said Ng did not steal or launder Kowalski’s bitcoin and was an “innocent downstream trader.”
Ng’s Monero trading had earlier raised alarms at another crypto exchange called Poloniex, based in the United States, where he also had an account. In mid-2019, his Poloniex account was frozen after it was flagged for “high risk exposure” to money laundering due to Monero withdrawals totalling over $1 million, according to a summary filed with the court. Poloniex didn’t respond to a request for comment.
Binance dealt with Ng differently. Kowalski’s private investigators and lawyers contacted Binance soon after the theft, before Ng converted all the funds, and repeatedly asked Binance to permanently freeze Ng’s accounts, their written communications show. The letters, filed with the court, also accuse Binance of not responding to police requests to secure the assets for the duration of their investigation.
Binance imposed a seven-day freeze on the accounts, but then lifted it, allowing Ng to exchange the stolen bitcoin for Monero over several months. In his response to Reuters, Hillmann said law enforcement failed to request a permanent freeze via Binance’s web portal within the seven-day period and then didn’t answer the exchange’s follow-up questions.
A Binance investigation team member told one of the private investigators in a message that “while it is highly likely the paths leading to this account are malicious,” Binance could not prove the accounts were “created to facilitate laundering.” When the investigator persisted, the team member scolded him for “several issues with your tone.”
In a submission last December to the court in Florida, Binance said the case should be dismissed as the court did not have jurisdiction over the company. To determine the matter, the judge has granted discovery, a process where parties request documents from each other.
Discover more from DiutoCoinNews
Subscribe to get the latest posts sent to your email.
