#18 | Q&A with Kevin Yang on Fighting Crypto Fraud

2023-06-14 · 10 min read

This is part of the Fraud Fighters Manual, a collective set of stories from Fintech fraud fighters.

This is the Q&A with Kevin Yang, following the Cryptocurrency Fraud chapter. Download your free copy of the Fraud Fighters Manual here to read the full version.

Why do you think crypto fraud is on the rise?

There are a lot of reasons. Cryptocurrency makes it easy for anybody to transfer digital assets without having to prove their identity. The point of blockchains and cryptocurrency is to have an open, decentralized, uncensored network for transferring assets. That was the original intention of Bitcoin. Anybody, whether a high school kid or a criminal, can use cryptocurrency to transfer assets and value anywhere in the world.

We see this general adoption—more and more people are using it. Compounding this is that there are so many new tokens and methods of transferring value. Before, like a long time ago, when cryptocurrencies were new, we had Bitcoin and Ethereum. Now we have thousands upon thousands of assets. So, it becomes easier to hide your tracks or cover it up by bouncing across all these different currencies.

How are organizations most frequently targeted by crypto fraud?

I think one of the biggest ones is phishing. Getting an email that sounds like it’s from somebody else in an attempt to compromise confidential information, like your private key for your crypto wallet. Once you get the private key, that pretty much unlocks all the funds in your wallet. You can have phishing emails; you can have fake websites that look like real websites.

The other way that companies get attacked, and we’ve experienced this too, is that a lot of cryptocurrencies right now run on community infrastructure. There’s no company that runs the blockchain; it’s people who set up mirrors and validators. These endpoints or services get attacked by malicious people who want to prevent others from using the network, or they have some financial gain from doing so.

Are there known profiles or archetypes of cryptocurrency scammers?

Anybody can do it. You don’t have to go to the bank with your ID and open a bank account to transfer money. You can just connect. All you need is an internet connection, and you can connect to a blockchain network like Ethereum and start sending money. And without that identification process, you remain anonymous. There are tools in Web3 that make it so your transactions are private. It doesn’t even show which address is sending transactions—or how much you’re sending.

So, these tools actually make it really easy for people to get away with money or launder money. There’s no centralization aspect. If your credit card gets stolen, you can report it to Visa or Mastercard, and they can cancel that credit card and possibly refund some money. There are safety features in place, and that’s possible. We have governing entities that take care of those types of procedures. But in crypto and Web3, there’s nothing like that.

There are no repercussions; it’s kind of like a lawless land. It’s like the Wild West right now because people can get attacked by somebody on the other end of the world without jurisdiction, law enforcement, or extradition. That makes it a playground for fraudsters.

How does fraud differ from NFT vs. traditional cryptocurrencies?

There are many types of fraud. There are “pump and dump” schemes where people will boost up the perceived value of an NFT art collection by claiming that it will give you access to some sort of benefit, social status, or tangible access, like clubs around the world. And then, once you buy the NFT, other people buy the NFT, and the NFT collection gets sold. The people who created the NFT can just run away with the money, and the value of the NFT gets diluted.

With NFTs, it’s more vibe-driven. I mean, there are smart contract codes to write NFT projects that aren’t complicated. There have been open-source examples of it. But a lot of it has to do with marketing and social media content that’s basically hyping up the NFT. I think it has a different target audience than people who try to commit fraud with decentralized finance and cryptocurrencies.

What about money mules? Are there money muling scams that don’t contain obvious red flags?

So, money mules: I would define it as somebody who carries money from point A to point B. For example, the head of a cartel wants to smuggle money across borders. They would hire money mules and take advantage of how everyone has a limit of how much cash they can bring across borders, take advantage of that kind of dead money over there.

With cryptocurrency, it’s a lot easier—all your assets live on a chain. You just need to know the private key to build those funds. If I want to send money to a person and know where he is, I just need to send the private keys somehow. And that could be via a hardware wallet. Because the asset’s digital, you don’t have hard cash, which can trigger authorities and show up in scanners. You can have just a little USB drive, and it becomes a lot harder to detect.

Even simpler than that, you can send assets on the chain without going through a middleman. So, you don’t have to wire money from a bank or go through Western Union or ACH transfer to somebody. You can send it right on the blockchain, and they’ll receive it. I can send some money to somebody in Singapore right now. It’ll take a few minutes to receive. I would even argue that, in certain places, depending on the type, the nature of the criminal we’re dealing with, there’s no need for cash bills anymore.

What kind of crypto regulation do you think we will see become law and enforced in the next few years/next decade?

The SEC and the IRS are getting smarter about tracking data on chains. And so they’ll probably get better at catching tax evasion, etc. Before, it was kind of lawless; they didn’t really know what was going on with crypto, and you could just report the cost basis and short-term gains or losses however you wanted. But the IRS is getting a lot smarter at that.

And there will probably be a lot more scrutiny around stablecoins in the future because there was a stablecoin last year called UST, which crashed; it went from billions of market cap to almost zero within a few days. There was a bank run, and they didn’t have enough capital to cover a shortfall. That caused a lot of market losses for a lot of people and hurt investors. I think we will see a lot more scrutiny of stablecoin and centralized exchanges. They’ll need to report their finances and conduct audits.

Globally, I think China is going to continue to be very anti-crypto. I think the United States is still trying to figure it out. Nobody knows for sure because there’s a lot of internal debate about the utility of cryptocurrency and its value to society, the philosophy, and the power struggle.

What do you think the cryptocurrency community needs to do to be ready for increased regulation?

More audits, more security, and playing by the rules. Crypto had a bad reputation for several years because of all the scams and frauds. If you will be operating in the United States, you must comply with the SEC reporting rules. You have to operate like an exchange. If you’re operating in the United States, you must operate like you’re governed by US rules.

One thing you could do right away is to implement a KYC process. If you want to use a decentralized application, you must upload identification or a utility bill proving you’re not a criminal or terrorist. That helps with money monitoring because you can identify the customer and users.

And security audits. One of the big reasons people are scared of crypto right now is all the hacks going on. Smart contracts are code written by humans, and humans are imperfect. So, having an extra pair of eyes from white hat hackers or security firms to ensure there’s no division by zero error, buffer overflow error, or just improper logic can help users feel secure and probably get a stamp of approval from the government in the future.

How can people and organizations protect their crypto assets?

The absolute hard rule of cryptocurrency wallets is never to share your mnemonic or private key with anybody.

Private keys are just a series of text and decimal numbers. Those are very hard to remember and write down. So, people have created basically an algorithm to take a string of 12 or 24 words that are easy to remember: that’s your mnemonic. But it’s unique to you; common words like zoo, animal, or laptop. That can be turned into your private key. So, your mnemonic and your private key are equivalent, and they are of paramount importance.

Another thing you can do is use something called a multi-sig wallet. To send a transaction to the blockchain network and dispense the fund, you need a threshold of people to sign the transaction. So, instead of having one person own it, you can have three, five, or nine. So, you’d need at least three, five, or nine people to approve a transaction. You can have a democratic consensus.

So, that’s a good way to protect highly valuable assets.

Hardware wallets (cold storage) are another technology. Basically, instead of having all your private keys exist on your computer or in the cloud, they exist on a handheld device—kind of like a USB drive. It has additional hardware encryption modules on top of it, so basically, every time you want to send a transaction, you need to connect your hardware wallet.

Even if your laptop or cloud gets compromised, your hardware wallet will change your private keys, so it’s safe. It’s better to never, ever store private keys on the internet, even if it’s encrypted. Because you never know. Let’s say you use iCloud or send it to yourself in an email, and you have perfect protection, but someone’s in the same public cafe as you and just hanging on the network. It’s not impossible for them to intercept your messages and listen to your packets.

Another example: a friend of mine had his encrypted keys in an email to himself, but his email got hacked, and he lost a lot of his NFTs last year. So, the more physical you can keep your mnemonic and private key, the safer it is.

What can organizations do to keep scammers from using their sites and engaging in crypto scams?

So, one thing you can do is watch your data—because all the data’s public and available. You can detect things like the age of accounts. If it’s an actual person’s account and they use cryptocurrencies regularly, you’ll see histories of transactions and applications they’ve interacted with.

Attackers will just use a script to create new accounts. These accounts are like bots on Twitter; the age of the account is a day or a week old, and they have no history at all and zero followers. You can do something similar on blockchains, so that would be something to watch out for.

If some projects or applications are being launched, but the owners stay anonymous, that’s a red flag to watch out for. It makes it easier for them to run away with the money. They might get caught later, but they might be in some jurisdiction with no extradition. You can’t catch them, right?

Security firms will always display the projects they’ve audited before—you can see which projects these firms have audited that have been hacked and if there’s a history of these products getting hacked. If a security firm audited such a project, they’re probably not great security auditors. A lack of security audit or a security audit by a not-so-great security firm is another flag to watch out for.

A lot of cryptocurrency projects have a community built around them. You have Discord and Twitter, and you can see how legit they are and how much they actually care about people. If you hop on Discord and see the type of culture there is—if there’s just a bunch of people who just care about the token launch—it might just be another rug-pull project or a get-rich-quick scheme. But if they’re dead set on the project’s utility and want to make the world a better place, I know it sounds cliche, but that’s a good sign.

Can you see automation or AI changing things in the future?

Automation, definitely. Botnets fall under the category of automation. You are automating user traffic to these different points. AI is an interesting one. There are so many possibilities there, especially with the release of ChatGPT.

With AI, you can have AI write code. AI can audit your smart contract code and tell you the obvious flaws. One of the most popular programming languages used to write smart contracts is Solidity. It’s not a difficult language to pick up, but it’s easy to shoot yourself in the foot if you’re not careful.

It works both ways. As a programmer, you can use it to detect flaws in your code and fix them as a hacker or attacker. Because all smart contract code is public, you can feed smart contract code through the AI bot, and it will tell you where all the vulnerabilities are.

Going further down the sci-fi path, you can even have chatbots pose as real people in Discord or on social media to make a project seem legitimate. You’re no longer interacting with this seemingly degenerate person who doesn’t care and only wants to get rich, but an AI bot who is programmed to be empathetic and talk to you in a customer support type of way.

If your AI is powerful enough, you can feed it all the blockchain data and kind of use it to catch obvious behaviors of money launderers. One thing money launderers would do is they would obtain a large pile of cash and divide it into small chunks, sending pennies or dollars to other accounts they own. You’d get this scatter effect from the accounts, making it hard for a human to trace. But a bot could read through that and determine whether the behavior is suspicious.

It’s kind of a cat-mouse game; if there’s something you think the good guys can use AI for, the bad guys can use it, too. You have an intellectual warfare right now between the good and bad.

Are there any common misconceptions about cryptocurrency fraud that you’d like cleared up?

There are many very polarizing people working in cryptocurrency; people who are smart and eccentric and people who are bad and immoral. It kind of happened that it’s possible for one bad apple to spoil the whole bunch.

It’s easy to generalize and say that everything you don’t understand has to be a scam or that cryptocurrency is bad. But there are a lot of good ideas. People have these intentions to make the world a better place or more efficient, such as giving access to financial products or banking services in countries that don’t have access.

When the Russia-Ukraine war started, citizens were able to escape with their life savings because of blockchain. In countries with high inflation, like Venezuela, cryptocurrencies offer a stable currency for people to transact with. And the transaction fees and the transaction processing time are a lot faster than other networks in areas where the banking infrastructure is weak. You can have a settlement within seconds or minutes rather than waiting a couple of days.

So, there are a lot of good ideas. I’m not saying that all of them are right or will work. But there are many really innovative people and a desire to do good in this space.

Download your free copy of the Fraud Fighters Manual here to read the full version.

🔮 Docs | 👾 Discord | 🐦 Twitter | 🔥 Web App

⛓️ ️Explorer | 🌴 Link Tree | 👨‍💻 Code | 🎥 YouTube