Last week a preview of the annual Cryptocrime Report of Chainalysis came out looking at cryptocurrency crime trends in 2021. The biggest takeaway is that illicit transaction volume as a share of global cryptocurrency activity in 2021 is at an all-time low, though criminal earnings are at all-time high, at $14 billion. While the all-time-low part may be true, it certainly doesn't feel that way to the public, especially for victims who lost all their life savings to con artists using the new medium. A more cynical interpretation is that reporting has not caught up and remained flat, and/or that criminals have become better at laundering their proceeds.
Without knowing of Chainalysis' methodology, we think that Chainalysis will naturally overweight business hacks, rug pulls, ransomwares, and blatant theft in their figures since these crimes tend to be more public with less stigma attached. However, cryptocurrency itself confounds traditional law enforcement reporting channels for individual victims of crime. The intake forms in many police departments in the US do NOT accept details of cryptocurrency crimes. The same is true for most other countries, their police simply do not accept or investigate cryptocurrency crimes. On the national level, even the FBI IC3 forms are not amenable to reporting cryptocurrency addresses and TXIDs (transaction IDs or transaction hash). Reporting to open databases like Bitcoin Abuse Database and Etherscan still require some knowledge. We occasionally encounter victims who have not reported for months at all either by choice or ignorance. Many do not know what TXIDs are or even how to use spreadsheets to submit to investigators. Finally, exchanges themselves do not help victims on how or what to report, and the onus is on victims to gather the technical details of the crime from their exchanges. Hard to do if you've been locked out:
(It's still not easy to find the transaction records in these platforms.)
Hence it is likely that there are many more individuals who lost money through cryptocurrency than those who would or could report. This could explain the dissonance between Chainaysis' findings of the illicit cryptocurrency at an all time low as a percentage of total global volume, and the public perception of cryptocurrency as chockful of scammers more than ever. Many big institutional investors or "whales" jumped in the crypto pool party since 2020. If transaction volumes from such whales are taken into account, what would the percentages be if counting only retail investors?
Losses from relationship-investment frauds are not trivial. The victims of crimes we have connected with have lost in the range of hundreds of thousands of dollars to more than a million individually, up to $2.5 million. In our survey of more than 400 victims of relationship-investment cybercrimes mostly involving cryptocurrency, 75% lost more than half their reported net worth. It is possible that Chainalysis has identified some of the biggest wallets involved in relationship frauds that we track, but from our own victims and losses counts and conservatively assuming that the true number is 6-fold higher, criminal proceeds just from this singular scheme is already more than half a billion dollars globally. Chainalysis did admit in this report that they later revised their estimates of illicit cryptocurrency activity in 2020 to almost double their initial estimate, and so we will be watching out for later reports from them and from official government statistics.
Customer service tip to exchanges:
When a customer reports being scammed, please immediately provide wallet addresses and TXIDs, maybe in table format, to your dear customers. Crypto investigators and the law enforcement agencies that you always push victims to will ALWAYS ask for TXIDs anyway. It is already hard for victims to hunt down their TXIDs in many platforms, not as intuitive as finding the "Buy" crypto buttons.
When a customer reports being scammed, immediately blacklist or warn the reported wallet addresses for other customers until further investigation i.e. block first, ask later.
When a customer reports being scammed, provide some basic tracing (one or 2 levels), as a courtesy, like how banks at least attempt to trace and recall wire transfers for fraudulent transactions, authorized or unauthorized, then inform victims of the results. You may think it's all open on the blockchain, but actually (and interestingly), many of your customers don't understand this.