Hacker News Reader

Comment by trade_unionist | Hacker News Reader

The main problem with cyber crime for profit is you have to get the money at some point. So no matter what at some point you have to either trust someone (bad idea) or have the cahones to walk into a bank and withdraw the cash. Even then you to explain how you got the money if it's over like $10,000 or people start asking questions.

Yeah dumb people will focus on hacking but once you think it through you see there isn't a good exit strategy.

View on HN

Buy and sell art/jewelry to a third party who really, really likes your taste in art/jewelry.

Tape a banana to a wall and call it art.

https://en.wikipedia.org/wiki/Comedian_(artwork)

If your bank questions you for withdrawing $10,000 or more, I would use a different bank.

I withdrew about $13,000 a few months ago, and my (national) credit union didn't hesitate or ask me anything (except for an additional piece of identification).

In the US any cash withdrawal that large triggers a legal requirement for the bank to file a transaction report with the government. If the teller didn't ask you anything and you don't regularly make withdrawals like that then somebody messed up.

As far as I can tell, they are only required by law to ask for identification; no requirement about asking why. The report they make goes to the IRS where the IRS might ask a question.

https://finance.zacks.com/federal-banking-rules-withdrawing-...

The teller asked for identification which exactly what the law requires, so it doesn't sound like they screwed up.

Do it again. They will flag your account and you will be filling out paperwork if you regularly make large cash transactions. Federal law.

That doesn't change anything about the comment I replied to or my comment though. I don't need to withdraw more cash, and I'm not going to do so based on a command from a random person.

The point is if you were a "cyber criminal" doing it regularly, the FBI would eventually trace it back to organized crime and you'd get in trouble.

People make one-time withdrawls of large amounts of cash all the time.

Yes, they don't ask you any thing. However, banks/car dealerships/etc have to file CTRs(Currency Transaction reports). It is good that you withdrew $13K in one shot. Structured withdrawals (4k, one day, 5k three days later, another 4k ten days later) will be flagged by AML software of any financial institution. And folks in the compliance team will file SAR(Suspicious activity report).

Lesson: when you legitimately need $30K cash, just withdraw it in one transaction. Never ever withdraw $5K every week for six weeks. For every SAR, there are 100 CTRs filed.

Thank you, it sounds like you have some insight about the process.

I'm aware of structuring, but I don't think most people are. I've heard about it only once in the news where a store owner had his money seized because he was trying to avoid depositing more than $10,000 at a time, over a long time period.

IIRC, this was the case: https://www.forbes.com/sites/instituteforjustice/2015/05/05/...

Re: structuring, the most famous example I know of is Dennis Hastert[1].

[1] https://en.wikipedia.org/wiki/Dennis_Hastert#Indictment

Not only that, even if you manage to get decent profits uncaught, you'd still have to launder it to buy any large purchases like cars / houses etc without raising suspicion from the tax authorities.

Doesn’t this apply to almost all types of crime? Dealing drugs, burglary, etc.

Presumably those 'analog' crimes tend to pay in cash (which you may not be able to bank, but at least flies below the radar if you don't). But your botnet haul needs to be converted from BTC to USD in a bank account, and then when you try to buy anything bigger than a pair of shoes it may catch the attention of the authorities.

Bitcoin?

Can be traced. Monero is another option but I've heard it can be traced too. I certainly wouldn't bet my life on it. But in either case you still have to convert it into cash at some point.

Launder it through an MMO like EVE online

yeah but then all the authorities would have to do is go ask the people at Eve online what Bitcoin address was used to pay

No, you pay another player Bitcoin for ISK, and then sell the ISK to another player for USD

Still traceable.

Authorities follow Bitcoin transactions and ask questions which points them right to you.

And if you do it all at an internet cafe in Bangkok from behind 7 proxies and a fake beard?

No, you give the other player the entire wallet, you don't actually do a transaction

Then the investigators go to that person, and they point them towards you.

Eve knows the source of the ISK.

This is what these investigators do all day... track money as people try to move it around. They are good at their jobs

You're going to try to launder millions (maybe tens or hundreds of millions) of dollars through an MMO and think no one will notice? Good luck.

This isn't something I made up. Criminals have been using MMO's in-game currency to launder money for over a decade. The trick is to launder slowly over a long period of time. Very hard to catch.

I used Second Life (I believe, but may have been something else) years ago (a decade ago?) because it was one of the easiest ways to put money into anonymous paypal accounts (anonymous credit cards that get accepted by paypal weren't really a thing here back then). I bought crypto, used it to buy their in game currency, then cashed out their currency to the paypal account.

You pay a few percents of fees, and it's not "the NSA will not be able to find you", but it was more than good enough for my mildly paranoid ass.

Coinjoin and coinswap is quickly making the tracing very difficult.

Difficult ≠ impossible.

Chainalysis says that Coinjoin introduces taint: https://go.chainalysis.com/rs/503-FAP-074/images/Advanced-Ob...

I believe that if someone uses something that's private by default, then its okay. However if someone uses someyhing that isn't private by default, but goes through efforts to try to hide the source of the funds, then it's suspicious.

Not just that it can be traced, there's a long-lived distributed ledger of the transaction. In a way, it's one of the worst choices.

I agree that a long-lived distributed ledger is problematic. However it sounds like you're implying that Monero can currently be traced. If you have any links to any recent/relevant research, I'm interested in hearing about it. I'm not interested in speculation or rumors like the other comment wrote.

Do you have a link to any current research showing that Monero can be traced?

I'm interested in facts, not rumors.

Can you not use iTunes?

Become an artist, sell albums, people buy and gift your albums using iTunes gift cards?

I've also heard that long distance prepaid calling cards had the same fungibility + market.

I'm not sure if either are still viable as it seems like money laundering is a treadmill where the older techniques become liabilities and require constant refreshing of tactics.

Reply on news.ycombinator.com