Hackers who stole €1 billion allegedly laundered the profits with crypto

Some hackers prefer bitcoin.
Some hackers prefer bitcoin.
Image: Reuters/Steve Marcus
We may earn a commission from links on this page.

Government watchdogs are wary of bitcoin being used for illicit purposes, and now they have an example that seems ready for a Hollywood script: According to Europol, a cyber gang that stole more than €1 billion ($1.2 billion) from more than 100 financial institutions in 40 countries used crypto assets to cover their tracks.

The alleged mastermind is a 34-year-old Ukrainian man whom officials identified as “Denis K,” who wanted to create a money-laundering cryptocurrency for the Russian mafia, El Mundo reported.

During the nearly five-year plot, Europol says, the gang of cybercriminals used malicious software to access banking networks and servers controlling ATMs, which were then instructed to spew cash at certain times so that it could be collected by “mules” who were waiting for it. The hackers posed as representatives of legitimate companies, sending phishing emails to bank employees to trick them into downloading software that allowed the criminals to control the machines. They used the infiltrated e-payment network to transfer money into criminal accounts, and databases were modified to inflate bank balances.

Denis K appears to have stayed one step ahead of authorities over the years as the criminal group upgraded and refined its techniques. The first version of the malware was known as Anunak, which targeted ATM networks globally, and a more sophisticated version called Carbanak emerged in 2014. Cobalt, the latest version of the malware, allowed the group to steal up to €10 million per heist, according to the European Banking Federation.

Profits were laundered using prepaid cards linked to crypto wallets, which were used to buy expensive cars and property, Europol said. Eventually a global takedown transpired—the result of a sophisticated investigation that included Europol, the US FBI, Spanish National Police, as well as private security companies and authorities in Romania, Moldova, Belarus, and Taiwan, leading to the arrest in Alicante, Spain.

People were captivated last year by the potential for bitcoin price gains to make them rich, but government officials have been increasingly concerned about illicit uses of cryptocurrencies. Finance ministers and central bankers at the G20 meeting this month noted in a communique that crypto assets raise issues concerning “tax evasion, money laundering and terrorist financing.”

Crypto advocates point out that while transactions on the blockchain can be anonymous (requiring only a digital wallet and key, instead of a bank account), the distributed digital ledger that records these transactions is public. This ledger can help authorities (pdf) track down misbehavior. And indeed, that may have been the case with Denis K’s cyber gang, according to El Mundo.

As such, the episode has a little something for bitcoin’s detractors as well as its proponents. However, the fact that crypto was the money-laundering means of choice for a sophisticated, multi-year criminal campaign is unlikely to go unnoticed by authorities. While regulators fear slowing or driving away innovation, greater regulation and scrutiny appear increasingly inevitable.