Hacker News Reader

Comment by Sealy | Hacker News Reader

Good timing. Yesterday, the UK Treasury released an official document stating that Bitcoin and cryptocurrencies have the lowest risk and lowest likelihood of money laundering amongst the areas of finance they studied. Guess who came first, Banks. Good job HSBC! You have laundered more money ever then the entire cryptocurrency industry is worth... 10x over

http://www.coindesk.com/uk-treasury-digital-currencies-low-m...

HM Treasury link to the National Risk Assessment carried out by the Home Office: https://www.scribd.com/doc/290214176/UK-NRA-October-2015-Fin...

View on HN

That's because bitcoin adoption is so low that it's not a threat.

Seriously:

>9.29 The money laundering risk associated with digital currencies is low, though if the use of digital currencies was to become more prevalent in the UK this risk could rise. Digital currencies are currently not a method by which terrorists raise or move money out of the UK (though they remain a viable method for doing so).

It s also not anonymous, and i guess terrorists would need something more immediately liquid.

I'm not sure about the other digital currencies, but if you tumble with bitcoins it becomes anonymous, right?

Believe in your lucky sunglasses all you want, but how much would you really stake on a tumbler?

"Such tumblers do a very poor job of hiding transactions, especially when dealing with a thousand or a hundred thousand bitcoins. The simplest approach is to simply look for common flow patterns."

- http://www.forbes.com/sites/valleyvoices/2015/01/15/how-pros...

Interesting article, but isn't that survivor bias?

All the tumblers seem inept when the only detectable tumblers are inept. You don't see the competent or succesful tumblers.

There is also an inherent risk in trusting that the tumbler operator is not willing to cooperate with (or happens to be operated by) western governments. It doesn't seem like a reliably sustainable strategy, especially for any substantial amount of funds.

Even if they don't control it, wouldn't a heavy user be able to build a probabilistic model of where the coins went? If you are 99% of the volume on a tumbler, you know with near certainty that your adversary's coins are being swapped with your own. Paying tumbler fees or even making massive amounts of small-loss bets on a gambling site is well within the resources of a state actor. Bitcoin is small. Eventually real money has to be taken in or out of the system, which gives them a smaller set of individuals to target for investigation.

Right, so you mix multiple times. You use unlinkable wallets. Electrum and Multibit wallets in Whonix VMs work well. And you successively use different mixing services, so deanonymization would require collusion. Doing three successive mixes is prudent.

If a tumbler is used by 1 person, they get their own coins back. To work, it needs as many users as possible. Therefore a researcher doesn't scan transactions looking for "possible tumbling", they look for the tumblers, use them and follow those transactions.

I meant tumbler as in a person, not a repeat service. It would be pretty easy to detect mass tumbling services through pattern recognition.

Why, though? Once coins from two separate sources enter a common wallet, they become impossible to differentiate from each other.

Not true. Each piece of each coin is traceable. With good mixers, you don't get your own coin back. And you check for taint.

True. If you want to anonymize that much coin, you must break it down into numerous small flows.

Only sort of, and only if you have a lot of other people willing to participate with you. If you are just looking to see how money is flowing, you just see the tumble cloud between your collections of interesting source and destination addresses, you are not foiled by it (in the worst case scenario you consider every output address interesting, but then you start paring that down with other information).

I wonder if some of the bitcoin gambling sites have really been operated by people trying to obscure the history of their bitcoin. If they can control how fast their coin moves through the site, they have some more assurance of how many addresses they are mixed with.

Even if it was, the simple fact of using a tumbler is illegal, as you are aiding to launder money.

So why don't we see headlines like "EU clamps down on banking industry and corruption in financial institutions"?

Because the E.U. already does and it's not news.

http://www.transparencyinternational.eu/focus_areas/eu-finan...

Really? Transparency International is not a government organization but a non-profit registered in Belgium.

edit: HN posting limit is extremely annoying, providing no way for a sustained discussion within multiple threads.

...Who runs a websites containing a series of announcements and headlines about financial regulation in the E.U.

Next you'll say those aren't true headlines, a la no-true-scotsman.

The Transparency International website that you've linked does talk about financial regulation in the EU, but Transparency International's position is that the regulators have failed - that they have not, in fact, clamped down on fraud and corruption, and that close ties between regulators and the banks they're regulating have made them unwilling to act. You're using a web page criticising regulators for failing to take action as proof that they didn't fail to take action.

I was using it as proof that E.U. financial regulation (however shitty it may seem) isn't new, since TI does a good job as watch dog and lists many examples that date back.

How exactly the Transparency International website that contains public statements critical of E.U. financial regulation backs up your point?

Because it's proof of E.U. financial regulation. What is your point?

That regulation of some sort exists, not that it is effective or "clamping down"

Here's a hint, along with some advice. You can get around the posting limit by clicking on the direct link of the comment you are responding to. Then again, it's there for a reason, so it's probably best to make sure your reply at least has some context and analysis, so the discussion doesn't devolve into a bunch of one line responses, which rarely convey enough information to make the conversation worth while.

Perhaps provide a _Rebuttal N:_ in the relevant post as you provided this edit.

You do. HSBC was fined billions of dollars for money laundering. Although some argue that convictions of individuals would be better.

Rumor has it that their profits from money laundering were substantially greater than the fines, though.

I don't think we have to call that just a rumor. I haven't heard anyone argue they weren't. But it's not important what the bank paid.

Everyone involved got their bonuses. No one was responsible. No one paid back. I don't think anyone involved cried over any fines the company had to pay.

Nobody got a criminal conviction. How are we OK about this?

You're mixing money laundering and terrorism funding. Terrorism doesn't need money laundering, they just need the money. They don't hold large accounts in Europe where they send the proceeds from their criminal activities to fund their retirements, quite the opposite.

Money laundering is about moving money from illicit to licit activities. Terrorism funding is exactly the opposite.

> Terrorism doesn't need money laundering, they just need the money.

You're absolutely correct. The whole thing reeks of security theater. Those people need money for logistics -- food, clothes, lodging and so on while they plan their crimes. I don't believe that there is anything safer than cash for such purposes. Even gold would be to suspicious. I'd imagine you'd want as few people to be in the know of the activity before it happens.

The moment, licit activities move money to illicit activities, they get targeted as illicit activities themselves.

So, yeah, money laundering needs to work both ways.

> You have laundered more money ever then the entire cryptocurrency industry is worth... 10x over

To be fair, the banking sector is also orders of magnitude larger

I'm a big supporter of bitcoin and I have a superficial understanding of how the public ledger works, but why is it not incredibly easy to launder money through bitcoin? Since the currency is fungible, aren't there services that allow you to send bitcoins and it will send move your bitcoin around through many other accounts, including bitcoin from deposits of others? The end result being that the end state of some bitcoin cannot be traced back to the origin. How would someone reasonably trace that with any degree of certainty?

It's not anonymous. All transactions are trivially followable, up to an anonymizer. But anonymizers have to eventually send the money to a destination, so their effect is pretty muted - just track the flow and user the resultant amounts to differentiate.

I think people look at bitcoin and hear "crypto" and immediately think opaque and unbreakable. Neither are true, but first impressions matter a lot.

> just track the flow and user the resultant amounts to differentiate.

The usual mitigation for this is to use common denominations for all inputs and outputs.

There are, called Bitcoin mixers. Also there's coinjoin matching services that's fairly automatic (community coordinated mixing instead of going through central servers).

Edit: How is this not relevant? Why is this downvoted?

Yes, so isn't this an effective way of laundering money?

>>The process is called tumbling, and it's primarily how bitcoin tax evaders use it now to get around the "public" ledger.

No, because they don't work, and even if they did successfully split up $1,000+ transactions, you can still analyse the public ledger to figure out where it all came from.

Edit: the proponents of such services also ignore the fact that anyone could be behind the tumbling services, governments included.

This is incorrect. If you have $1000 in bitcoin and send it to a tumbler in say 5 transactions of $200 each, and you specify that each of those transactions should send the output as 2 different transactions of $100 each, to different addresses, then there is no way to defintively link those addresses back up (unless the person sends all those coins back to the same address and even then it would take a lot of work to match them up again).

I think you think that someone sends $1000 btc to a new addres, then $500 btc to address 1, $500 to address 2, does this a few times and then sends all the coins to address 56, which then holds $1000. This would be possible to trace but would be time consuming to do.

The method I mention above would safely unlink any coins in the final addresses from the $1000 you started with.

Bitcoin itself is a chore to anonymize properly AND to feel 100% safe after doing it.

I know some people like Monero (crypto note ring signature based, not Satoshi base) but as far as using bitcoin base code, Dash (formerly darkcoin) has the best coin join like solution.

It's a decentralized, passive (done before any real transaction), denominated mixing with up to 16 rounds. Obtaining less than a 1% chance of unmasking a SINGLE transaction in their model would cost millions of $.

I don't bitcoin is going anywhere but the flexibility some of these altcoins have is amazing for development. Dash (digital+cash) btw, wants to fix every problem with bitcoin.

They have anonimity, incentivized full nodes which share the block reward, instant transactions (5 of 6 confirmations within a few seconds) and more recently a model to fund development of the currency directly on the blockchain. Developers propose projects which are voted on and the blockchain itself sets aside the budget.

Whoever is downvoting tumble commments is WRONG. Go read the bitcoin forums and note the people who have stolen large amounts of bitcoins after tumbling they are gone and have never been traced.

Tumbling is highly effective if done properly. You need many inputs other than just your own. Then you take the outputs and you don't combine them. You can spend them via psuedo transactions with scripts, use them to store coins, tumble them some more, sell them for cash. Since all inputs are combined there is no real way to no which outputs are from who inputted them if you're smart, disciplined, and it's done properly.

Generally, the large bitcoin thefts never get traced because the trail of bitcoin transactions leads to an exchange and then you can't follow them any more without the co-operation of the exchange.

Exchanges themselves are a kind of tumbler.

Bitcoin don't have individual coins. Each transaction is like taking several pieces of gold and melting them together and splitting them up in new pieces.

Mixing multiple transactions from multiple people do not reveal what came from where - you only know sending addresses, receiving addresses and amounts - but no links between which senders are tied to which recievers. Instead of having a bunch of individual historical lines for each "coin" and each person there's a big web of unknown addresses, with only a few known original senders and maybe a few known recievers. Coinjoin lets strangers securely pool together their coins and get the same amount of coins out to several new addresses of yours, except that now nobody knows which addresses belong together and which coins belongs to which sender.

this kind of service does exist [1]. however: -you have to trust the manager of the laundry to get your bitcoins back -the dirtiness of the average coins may be quite high -it costs money (X %)

Note the existence of alt coins with increased anonymity, such as ZeroCoin [2]

[1] https://en.bitcoin.it/wiki/Bitcoin_Laundry [2] https://en.wikipedia.org/wiki/Zerocoin

Zerocoin/Zerocash have no implementations, they are vaporware.

OK, did not realize that. Interesting research projects though.

Bitcoins are fully traceable. Every transaction is made public and every key is traceable to its origin block.

Reply on news.ycombinator.com