#17 | Cryptocurrency Fraud

2023-06-13 · 7 min read

“Anybody, whether a high school kid or a criminal, can use cryptocurrency to transfer assets and value anywhere in the world.” - Kevin Yang, Nibiru

Get your free copy of the entire book here!

It may seem as though every month brings another high-profile “crypto fraud,” from malware attacks fueled by cryptocurrency to large-scale cryptocurrency exchanges getting shut down.

It’s estimated that $14 billion in value was lost to crypto scammers in 2021: a record-breaking number. As people become increasingly familiar with and adopt cryptocurrency, more fraudsters start to use it to their advantage.

In the first half of 2022, the Department of Justice charged a handful of cryptocurrency cases—valued at $2 billion. Cryptocurrency fraud isn’t just a matter of volume but raw scale: it’s not just that more fraud is occurring; it’s that very large volumes of currency can be stolen simultaneously.

In this chapter, we discuss cryptocurrency fraud, why it happens, and how to avoid it with our expert Kevin Yang, Contributor of Nibiru. Nibiru is an integrated ecosystem of products, including Nibiru: a new crypto derivatives protocol that makes it possible to stake, swap, provide liquidity, and trade futures on the blockchain.

Why Does Crypto Attract Fraudsters?

Cryptocurrency has many of the advantages of cash: it is difficult to trace and easy to distribute. Today’s fraudsters can commit digital crimes on a global scale, digitally launder their funds, and transfer them into a local currency—sometimes within mere minutes.

Crypto scam … or crypto fraud?

You’ll hear both—sometimes interchangeably. But they aren’t the same thing. A crypto scam commonly refers to an individual (or an organization) scamming another individual (or organization) in pursuit of crypto assets. Crypto fraud refers to a larger-scale intent to deceive the public, such as by getting them to invest in a faulty cryptocurrency or NFT scheme.

For individuals, the risk is simple: they can have their cryptocurrency stolen from them by a fraudster or be tricked into investing in a fraudulent cryptocurrency scheme. Two common types of cryptocurrency schemes are “pump and dumps” and Ponzi schemes.

Pump and dumps: Crypto creators boost their currency’s price artificially (often through raw marketing) and then cash out, causing the price to plummet on other investors.
Ponzi schemes: Crypto creators use new investments to pay out old investments, building the illusion of a stable cryptocurrency, but it is actually not profitable.

Organizations that manage cryptocurrency have a different set of risks. While they also could be taken in by pump and dumps or Ponzi schemes, their concerns primarily relate to the cryptocurrency they manage.

Money laundering: Fraudsters can use middlemen to launder their cryptocurrency; organizations must verify that the funds are legitimate.
Compromise: Fraudsters can steal money directly from an organization—and if the organization’s wallets are compromised, it may not be possible to get the cryptocurrency back.

In short, cryptocurrency doesn’t attract any new types of fraud—but it’s highly attractive because it has the benefits of cash (such as being difficult to trace) alongside the benefits of digital currency (such as being easy to transfer).

“The point of blockchains and cryptocurrency is to have an open, decentralized, no-nonsense network for transferring assets,” says Kevin. “Anybody, whether a high school kid or a criminal, can use cryptocurrency to transfer assets and value anywhere in the world.”

Money Mules of the Modern Age

Organizations must be particularly wary of money mules—individuals using a platform as a way to move funds. This cryptocurrency may be involved in large-scale crimes: ransomware attacks or even terrorism.

“I can send some money to somebody in Singapore right now,” says Kevin. “It’ll take a few minutes to receive. I would even argue that, in certain places, depending on the type, the nature of the criminal we’re dealing with, there’s no need for cash bills anymore.”

Crypto makes it easy for people to take money anywhere. It’s a digital currency, but it can live in a physical space; you can take a million dollars in Bitcoin onto a plane in a USB drive without alerting the authorities. And you don’t even need to do that: you can transfer millions across the internet in a single transaction (or millions of transactions).

Money related to crimes can be laundered through money mules. Not only does this make it particularly difficult to track, but it’s dangerous for any organization managing cryptocurrency—they could get involved with dirty money.

Web3, the Metaverse, and NFTs

As Web3, the metaverse, and NFTs grow in popularity, cryptocurrency fraud will only become more commonplace and complex. Web3 and the metaverse make it more likely that individuals will start to adopt cryptocurrencies—and as they live their lives online, they become more likely to invest in NFTs.

People are already living increasingly digital lives and purchasing digital assets, much like they might purchase downloadable content in a video game. Today, individuals can purchase digital real estate in the metaverse, tracked through NFTs.

Why NFTs?

NFTs (non-fungible tokens) are commonly used to track digital assets on the blockchain. NFTs ensure that a transaction is validated and logged, so only one individual can claim to “own” an asset. While some vulnerabilities exist within this space, NFTs have been bought and sold for millions. The most expensive NFT sold as of 2023 was “The Merge,” at $91.8 million.

As more value is held within these technologies, more fraudsters will also become interested in the market. Kevin envisions a world in which people are completely anonymous, presenting themselves with synthetic digital identities and conducting crimes with ease.

“There are tools in Web3 that make it so that your transactions are private,” says Kevin. “It doesn’t even show which address is sending transactions—or how much you’re sending.”

While these transactions are primarily relegated to early adopters today, they will likely become more mainstream with time.

Digital Assets—and How To Protect Them

Although there are few things as “digital” as cryptocurrency, the best way to protect cryptocurrencies (and other crypto assets, such as NFTs) is through physical security measures—cold storage. Other measures include real-time, on-chain monitoring and system redundancy.

Kevin tells a story: His friend had everything secured through an encrypted key, but the encrypted key was connected to his email address. His email address was compromised; he lost a lot of money. He had done everything else right, but his email address proved to be the weakest link.

Cold storage: Digital information may be attacked from anywhere because the attack surface is broad. Cold storage (physical storage disconnected from the internet) limits this attack surface. Physical wallets and USB keys are the least likely to be compromised.
On-chain monitoring: Similar to network security, real-time on-chain monitoring (the monitoring of transactions as they occur) can help organizations detect fraudulent transactions before their effects cascade.
Redundancy: Organizations need to understand the underlying technology and take action to protect it. Cryptocurrency runs through peer-to-peer and community-run solutions; in other words, the organization isn’t fully in control of its own infrastructure. It relies on these community servers and nodes. If the organization hasn’t built up its own infrastructure and provided for redundancy, the whole system could be taken down.

Further, individuals should never share their information—and should be skeptical about who they trust with their digital assets. Organizations must thoroughly vet vendors and cryptocurrency technologies, gauging not only the tech but the people behind the tech.

Kevin points out that you can have, for instance, a very slick platform but no one interacting with the community—or when they do interact, it seems obvious they are just out for cash.

Kevin explains, “There’s no company that runs the blockchain; it’s people who set up mirrors or validators. These endpoints or services get attacked by malicious people who want to prevent others from using the network, or they have some financial opportunity to gain from doing so.”

Regulating the Digital Frontier

Until fairly recently, organizations have been left to their own devices to figure out how they want to control and manage crypto assets. But regulations are likely to increase within the next few years, both in terms of how crypto is managed and how crypto-related assets and income are reported.

“The SEC and the IRS are getting smarter about tracking data on chains,” says Kevin. “And so they’ll probably get better at catching tax evasion, etc. Before, it was kind of lawless; they didn’t really know what was going on with crypto, and you could just report the cost basis and short-term gains or losses however you wanted.”

Increasing regulation is on the horizon—and some regulations have already been implemented. Cryptocurrency may soon be treated like a traditional currency, which also means that organizations will become more responsible for not only the money they hold but where it has come from. Specifically, the IRS has moved toward the accurate reporting of cryptocurrency and will hold organizations and individuals liable for gains made through crypto trading.

While this does mean that organizations need to be more cautious and skeptical regarding their cryptocurrency dealings, it also paves the way for safer, more secure, and more widespread adoption.

Key Takeaways

Cryptocurrency is on the rise both because it is becoming more popular and because it’s difficult to trace.
Increasing regulations will likely make the market more stable, although increased adoption may also increase fraud.
Organizations should protect themselves with robust KYC/KYB policies by thoroughly vetting cryptocurrency partners and by engaging in on-chain transaction monitoring.

In this chapter, we learned that hackers use phishing or other means to steal login credentials and gain unauthorized access to a user's cryptocurrency wallet or exchange account in crypto fraud. After obtaining access, they can transfer the victim's cryptocurrency to their own accounts, which is usually difficult or impossible to recover.

Similarly, account takeover fraud also involves an attacker gaining unauthorized access to a user's account using phishing or other tactics. They use the account to carry out fraudulent transactions, transfer funds to their own accounts, or steal sensitive information.