Ex-MS engineer convicted of 18 felonies after stealing $10M in digital currency | Hacker News Reader

Ex-MS engineer convicted of 18 felonies after stealing $10M in digital currency

geekwire.com

61 pointsUnited85729 comments

Key points:

>>Volodymyr Kvashuk, a 25-year-old software developer and Ukrainian citizen who worked for Microsoft from 2016 to 2018, took advantage of a testing program for Microsoft’s online retail sales platform. He made test accounts to obtain “currency stored value” such as Microsoft gift cards and then resold them online.

>>Kvashuk will be sentenced June 1 in U.S District Court and faces up to 20 years in prison.

Ouch.

Why did he not run away to Russia?

Probably because he is Ukrainian but that is just a wild guess.

I was amazed that that long list of charges only results in a 20-year maximum.

I hope he gets the maximum to teach/deter others to not utilize their position, talents in a wrong way. He lived in a free country, smarter than millions, yet he betrayed the trust of his employer and the country that embraces him. I am an immigrant from Thailand, grateful to the opportunity this country giving me every single minutes.

A brilliant mind who wasted his talents blinded by greed. A very sad life.

He dug his own grave

The PDF of the complaint with some details is at https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf

> he stole $10 million worth of ... gift cards ... and then resold them online ... [for] about $2.8 million.

He sold stolen goods for about 28% of their retail value. Is Microsoft is able to cancel the cards if they haven't been spent?

Yes, and they did cancel $1.8m worth of them. $8.3m has been redeeemed.

Seconded. Based on my previous jobs working in retail fraud, most retailers are able to track and cancel gift cards when they can confirm them.

looks like he was concealing his tracks pretty well. Other than spending extravagantly, I wonder where he screwed up?

"Kvashuk’s grand scheme was thwarted by the hard-work of IRS-CI’s Cyber Crimes Unit"

Something that caught the IRS's attention, apparently. Probably lots of deposits of real money to real banks, from a crypto exchange.

I'd agree, 2.8m showing up in accounts will always trigger flags; there's just no way to avoid someone asking questions at that level.

Saying Crypto isn't enough which is why he tried to say it was a 'family member gift' which he couldn't prove. Probably all he could show was that his currency came in from a mixer which is going to raise questions.

I'm surprised he didn't simply hold tether (if he wanted stable) and then drip it into his accounts.

I think it's a common theme of how fraudsters get caught, they get greedy.

Banks in the U.S. are required to notify the IRS of any deposits/withdrawals in excess of $10,000.

My guess would be that Microsoft tipped them off. I couldn't find in the compliant where the IRS or Secret Service got involved, but it does say that Microsoft Fraud Investigators discovered the fraud and fired him.

He did not conceal his tracks. He would pop up on IRS radar just for moving a lot of bitcoin. I owned some bitcoin and was a bit worried because many exchanges were forced by the government to release information of people, coinbase for example. Even, if he did not use one of those exchanges, depositing large amounts of cash and buying 1 mil lakefront property will raise some eyebrows.

On his tax returns he said bitcoins were a gift from a relative....unless his relative is ultra rich, no uncle is just going to gift you 3 million bucks. Plus, I am pretty sure you need to present documentation, the IRS will not just take your word for it. Honestly, any deposit over I think 10k is reported to the IRS by the banks, and IRS knows how much this guy is making, what he owns, etc.

Crypto currencies are not really as anonymous as supporters would like you to believe, and IRS will crush this guy.

i wonder if he never switched it to fiat if he would have gotten caught on the IRS/Fed side. If he kept it Bitcoin or if he had some Bitcoin to Cash side hustle that he could keep under wraps from the IRS he might have gotten away with it.

He should have opened a "cash" type of business and inflated number of customers and basically laundered money. He would still probably get caught by Microsoft though eventually.

still gotta have someone buy that bitcoin from you. dude shoulda done whatever the dark net drug dealers do (and i have no clue what they do but the obviously need to eat so some of that bitcoin turns into cash)

The IRS really doesn't care where the money came from if it is reported. The money that he received was reported on his tax returns, so the IRS would not look further at this, as long as the numbers matched up.

In this case it appears that the IRS was brought in to it to correlate the individual's finances with the expected windfall, rather than instigating the investigation. That is, the investigators (in MS and law enforcement) knew who did it, and they were gathering further evidence.

You are correct the IRS doesn't but the US government does. This would fall under suspicious activity.

"Under the Bank Secrecy Act (BSA), financial institutions are required to assist U.S. government agencies in detecting and preventing money laundering, such as:

Keep records of cash purchases of negotiable instruments, File reports of cash transactions exceeding $10,000 (daily aggregate amount), and Report suspicious activity that might signal criminal activity (e.g., money laundering, tax evasion)"

> He did not conceal his tracks.

True but I'm not sure it's feasible to conceal a theft of $10M from a large public corporation for very long if you don't work directly in finance or have IT access to financial records. Ultimately, double-entry accounting is going to show an imbalance somewhere as that $10M in gift cards is redeemed into actual cash at retail. Once the finance dept starts investigating why the books don't balance, it's only a matter of time until they narrow it down to approximately the right neighborhood.

He was stupid not to realize they would eventually start looking for where the missing money went. The only way he might have gotten away with it was to cash it quickly and very carefully disappear under another identity somewhere outside the U.S. forever.

The complaint, linked above, shows how the investigation went forward. He was not careful; the test accounts were associated with his identity directly.

At the point where the Bitcoin was converted into bank account funds.

There's a reason why money laundering is a criminal specialty.

He needed to stop stealing and fencing the goods before getting caught, wait a few months or years without doing anything shady at all, then start dripping the ill-gotten gains into his account alongside an entirely legitimate cashflow, a little bit at a time.

Buying a mansion and a roadster out of the blue is an "stupid criminals get caught; all criminals are stupid" type of move.

Even if all you know of crime comes from the movie theater and television set, you'd know that after the airport job in Goodfellas, some of the guys got whacked for violating the "don't buy anything!" edict. In Breaking Bad, the car wash and the Pollos Hermanos chicken restaurants were necessary for laundering the methamphetamine revenue.

I think the mention of Bitcoin mixers was just chaff. The guy was caught because his bank tattled on him, and the IRS didn't buy his flimsy sourcing story. If he had just kept the proceeds as some variety of cryptocurrency, he might not have gotten away with it entirely, but the investigation would probably still be ongoing--the questions remaining to be answered being, of course, "how much did he steal, exactly?" and "how do we seize and forfeit those funds?" Someone might know that he was stealing something, but they wouldn't necessarily know how much.

Is there any way to exchange bitcoin for cash anonymously? Burner phone with in-person Craigslist arranged trades (where you hope the other person isn’t FBI)?

There are a few p2p exchanges like localbitcoins or Bisq where some anonymity can be achieved. But those type of trades don't scale far without risk.

There are a few local Bitcoin apps and sites. I don't think it would scale well for the FBI to have a sting on every Bitcoin to cash transaction, but would be good to have one on suspected Bitcoin wallets. Although most savvy cybercriminals at this point should be able to mix their dirty coins enough to avoid such a trap.

Reply on news.ycombinator.com