Met Police seize record £180m of cryptocurrency in London | Hacker News Reader

Met Police seize record £180m of cryptocurrency in London

bbc.co.uk

74 pointsColinWright65 comments

I’m curious how they “seized” the units of cryptocurrency here.

The cypherpunk trope is they either hacked their targets’ wallet with hither-untold mathematics or they used rubber-hose cryptography…

The idea of a Bitcoin nerd being forced by a court to transfer BTC via Bitcoin.exe amuses me - but that doesn’t sit right with me for some reason…

Unfortunately the article is light in technical details - does anyone know more?

Maybe it was just sitting on an exchange.

Yup. Most criminals aren't masterminds. Fuck - most of them don't even take basic steps to cover their tracks. That includes people with big bank rolls occasionally.

This is worth emphasizing. There's a reverse survivor bias at play. No matter what people do, some fraction will be really bad at it. Think about any workplace. In the criminal world, these are the people who get caught the fastest and result in the flashiest press releases.

Wouldn't they just need the private key file that can be taken from the target's device?

The private keys are usually encrypted, so the attacker would have to brute force the password, install a keylogger or use a wrench, to give some ideas.

your weekly friendly reminder that refusing to hand off passwords to authorities is a crime in the UK, punishable with up to 2 years in prison (5 if the case is marked as sensitive for "national security"). That's a pretty nice wrench.

I forgot my password.

Judges love arguments like this.

This has been tested in court as a defense. Try to guess what the result was.

Not sure if that applies to a password used to secure crypto, since you can argue that the gov can see what's behind the password (ie: the crypto amount), and the purpose of the law is to reveal data hidden by the password, not to take control over it.

The "legitimate interests" clause is broad enough that it can probably be bent for that, but I reckon it would boil down to the interpretation of the "no signatures" clause:

> (9) A notice under this section shall not require the disclosure of any key which-

> (a) is intended to be used for the purpose only of generating electronic signatures; and

> (b) has not in fact been used for any other purpose.

I'm not versed in bitcoin enough to judge if wallet data protected by that password is used only for signing. This clause seems largely meant to avoid the possibility that authorities will impersonate a user after forcing him to hand over his key.

Info about the relevant law: https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...

Keyboard logging, located the key paper on paper or a pc, seized from exchange, or cracked whatever wallet software they where using seems more likely than cracking the encryption or beating it out of the suspects. Really the more time you spend around people actually using crypto coins the less secure they seem. It’s clearly possible to be secure, but many people are doing the equivalent of stuffing their mattress with cash.

Doing the equivalent of putting your money in Fort Knox kind of kills the appeal of "money you carry in your head".

Easy. If it's a third party service like an exchange or other custody provider, get a court order, done. If it's on a personal wallet (very rare) then compel them to hand it over right now or go to prison until you do. No rubber hose required.

That's just rubber hose with a warning and paperwork.

It's just rubber hose with extra steps!

What does ‘rubber hose’ mean here?

https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

> In cryptography, rubber-hose cryptanalysis is a euphemism for the extraction of cryptographic secrets (e.g. the password to an encrypted file) from a person by coercion or torture[1]—such as beating that person with a rubber hose, hence the name—in contrast to a mathematical or technical cryptanalytic attack.

The "beating with a rubber hose" thing, in turn, comes from allegations that this method is favored by the likes of secret police, intelligence agencies, and organized crime because it leaves minimal marks on the victim compared to other forms of physical abuse.

A rubber hose attack is also sometimes called a wrench attack. It's the use of physical action (often implied as violence or torture) to gain some secret.

And the reality of a "wrench attack" is illustrated in this xkcd comic:

https://xkcd.com/538/

Along the same lines: To “”throw the book at him” is a double entendre euphemism (American) for both bringing a lot of charges against someone, and/or beating them with a phonebook because it (purportedly) doesn’t leave bruises.

Pretty sure you just made that up tbh

Why would you assume that it's rare to have it outside of an exchange/custody provider? For that sum I'd expect most operation to have most of them in their own wallets.

This speaks to a fundamental truth about cryptocurrency. In order to make it easier to use, these currencies adopt the trappings of fiat currency. When I had Bitcoin a while back, I always used an exchange. Most new users will do the same. And any financial transaction you're able to perform will likely go through intermediaries. Not because they're necessary but because they make things easier. If cryptocurrency is going to become mainstream, it will have to be indistinguishable from fiat for end users.

Alternatively, the trappings of fiat are the onramp and the social support that enable the meaningful use cases for the minority of power users.

I'm amazed by what has happened to Bitcoin in the last several years. I played around with it about a decade ago, and that involved setting up a node on my laptop, creating my private key, and going to town.

Now everyone is trying to move to a second network (Lightning), but that system is so overwhelmingly complicated that no normal human being can actually manage it themselves. So everyone just has all their coin stored with third parties and no one actually has their private key anymore.

Take a look at one of the "wallets" sometime in your app store of choice. The negative reviews are complaints about onerous know-your-customer processes (make sure to scan your driver's license into your Bitcoin wallet, kids!), deposit and withdrawal limits, etc. From the reviews, you can't even tell them apart from PayPal/Venmo/et-all.

Found the recovery phrase during a house search? Or phone search?

All you need to do is find an exposed machine with keys. That could be via physical seizures as well.

Or if it was on a KYCd exchange you just get a warrant and seize it.

I'd be my bottom dollar this wasn't some sort of cryptographic attack.

Bulgaria still holds the record of seized crypto, at 200K BTC which is at about 6.5 Billion $ ATM.

AFAIK, when the police comes to you the computer people come alongside with the guys with the guns and immediately start messing with your equipment before packing them for evidence.

How would they take your coins? If it's on an Exchange they will simply tell the exchange to hand over the dirty money. If the exchange is out of their jurisdiction, it can be harder but the cyber crime tends to be international in nature so they will probably activate some cooperation agreement and compel the exchange to hand over. If the exchange is extralegal, their best bet would be to compel you to hand it over.

The first thing the computer people do would be to take a look at the running devices and extract as much information is possible. They will take alive snapshot and manually look around your folders and browser history for points of interest. Since the raid is most likely to be as a result of an investigation they would likely have an idea what to look for. If they know that you run your business with BTC they would be looking for wallets and Exchange login info.

Once the accessible data is collected and disk images are taken and you are in custody they will start pushing you to give them access to the stuff that is locked down. Because you were investigated before the raid, they will have an estimate of your possessions and will know what to press for. If they nail you for some criminal activity, your best bet could be to cooperate and hand over your crypto if you don't want to be in prison for longer.

>Bulgaria still holds the record of seized crypto, at 200K BTC which is at about 6.5 Billion $ ATM.

It was sold for more like 3B euro[0] but yes still pretty good.

0. https://bitcoinist.com/bulgaria-not-bitcoin-1-6b-finance-min...

In the UK you have to give up any passwords or you get 5 years or something for failing that.

>The Met's economic crime command made the seizure after following up intelligence received about the transfer of criminal assets.

Are there any numbers on how much of cryptocurrency is probably illegitimate?

According to chainanalysis, about 0.34% of crypto transfers in 2020 were for crime if that's what you mean by illegitimate [1].

1: https://blog.chainalysis.com/reports/2021-crypto-crime-repor...

Yeah, just curious how much is for crime. That’s not that much (thought it might have been higher)

Using a transparent, public, mathematically provable correct, ledger to store your drug-laundering and income: who ever thought this would be a good idea?

Bitcoin only ever was pseudonymous, which is only anonymous if you manage to disconnect each link between with the real world and your bitcoin pseudonyms/addresses. For ever.

That is a lot of hard work, when for example a £20 bill works so much easier.

"The detectives on this case have worked tirelessly and meticulously to trace millions of pounds worth of cryptocurrency suspected of being linked to criminality"

sounds like they don't have anything more than a vague suspicion, at least that they are willing to speak publicly about.

Whenever law enforcement snags a "major haul", be it illicit cash or substances or arms or anything else, I guess I focus on its physical size as the thing that makes it impressive -- and worthy of tallying up records and high scores. The bigger the stash, the harder it is to hide, after all.

So when the haul is something like this -- without direct physical scale, which could fit in anyone's pocket regardless of its volume -- it doesn't have the same wow factor for me. But I feel like it should!

I'm having the opposite effect right now.

> Whenever law enforcement snags a "major haul", be it illicit cash or substances or arms or anything else, I guess I focus on its physical size as the thing that makes it impressive

law enforcement typically talks that up, to a high degree. e.g. a truck full of cocaine? Estimate the value as a per-gram street price, not what a wholesale truckload would change hands for to the next middleman who will break bulk.

A truckload of illicit cash? Large parts of "Breaking Bad" were all about how useless that can be.

Not exactly hacker news material, but couldnt help remind me of The Guard - "I dont know what street your buying your cocaine off but its not the same street I am buying mine" - https://www.youtube.com/watch?v=Pp37jdduMbI

The Guard is a piece of fine art. That couldn't be more appropriate.

Just as a caution to others, maybe don't play that with the volume up loud in the office. The context is critical, and there are a few loud... remarks.

I'm reminded of a scene in The Wire. The protagonists have collected intelligence, and want to continue collecting more to be able to permanently destabilize a criminal organization. A career-minded officer instead decides to use this intelligence for a bust with no long-term benefit, but it does produce a very photogenic collection of seized weapons and drugs for him to stand behind while the journalists take pictures.

I'm curious about "£180m of". Tried cashing it in yet?

They prevent launderers from cashing it out.

Tether will prevent it being cashed out for you anyway.

They don't "cash in" a drugs bust but can still assign a value to it.

Assign or invent. law enforcement typically talks that up, to a high degree. e.g. a truck full of cocaine? Estimate the value as a per-gram street price, not what a wholesale truckload would change hands for to the next middleman who will break bulk.

That seems like a reasonable thing to do. I don’t really see the problem, don’t they generally refer to that as ‘street value’ anyway?

Besides, what could they have done similarly in this case? Why would they not just be referring to the current spot value of the currencies?

Even then, its usually overpriced. I remember some years ago there was a cannabis bust where I am and they announced that they seized X amount and it had a street value of Y and I was just thinking those guys are getting seriously ripped off if that's what they're paying because anyone I knew selling it was charging a lot lot less.

"Street value" per gram goes down significantly as the weight of the transaction goes up. If someone has 100 pounds of weed the cops go by the absolute highest street price for the absolute smallest unit sizes (~$20/g) and call it a $1M haul.

In reality, it's not really feasible to move 45,000 individual grams in a timely manner (especially with products like cannabis that noticeably degrade fairly quickly), not to mention that you'd be opening yourself up to 10,000x the necessary risk to do so.

So while it's true on a certain level that 100 pounds of weed can eventually be worth about a million dollars once it makes its way through a distribution network, in reality it'll only ever probably net maybe 1/4 of that and the majority of that profit won't ever make it back up the chain even in an organized criminal network.

But when the pigs inflate their numbers by pulling these kinds of disingenuous tricks it makes them look good, and they know they'll never get in trouble for doing it.

There was a funny case some time back, local cops where a relative lives were estimating utterly nutty "street values" for busting college students with pot plants. A journalist starts asking questions, and finally figured out they were calculating value by weighing the live plants - dirt, pot and all.

There was a whole thing about how, legally, LSD for personal use landed you in more trouble than LSD for trafficking, because the penalties are by weight, and that include the carrier paper for personal use, but only the crystals for trafficking.

EDIT: This was specifically addressed in 1993, in amendment 488 to the US sentencing guidelines. https://www.ussc.gov/guidelines/amendment/488.

This 1992 article from the LA Times details some of the consequences — https://www.latimes.com/archives/la-xpm-1992-07-27-mn-4335-s...

> they were calculating value by weighing the live plants - dirt, pot and all.

You can forbid that specific corrupt practice; but as long as the incentives are to produce a high value, then ways will be found to inflate it to an unrealistic number.

No, it is the amount seized times the spot price of Bitcoin. It's the approximate fiat amount they would fetch if they were auctioned off today.

You probably would not want to sell it all in one go, but the market is quite a bit larger than you are believing in 2021. This isn't the mid 2010s where liquidity was in the $100k's.

A sell of this size spaced over the say, top 5 exchanges, would likely only cause a 2% price adjustment.

There is a huge huge deal more money than you realize floating about in this space. To give you some idea, take a look at the cryptodollar charts: https://defipulse.com/usd

A drop in the ocean compared to the amount of fiat currency laundered through high street banks in London every year.

> Transactions made using cryptocurrencies can provide more anonymity to senders and recipients of money

Well, yes, providing you use something like Monero. We all should know by now that Bitcoin has a transparent ledger and your kids in 20 years time will probably be able to see what you spent your Bitcoin on.

Bitcoin privacy tools are improving. Its possible to "mix" your coins using CoinJoin which masks your spending history.

The statement isn't incorrect. The majority of cryptocurrencies (including Bitcoin) are anonymous since they don't assign an external identity and unless you manually attach one, the only way an identity is attached is if it can be inferred by the activity on the account.

Monero and zk proof based networks are private (distinct from anonymous) because the interactions between the accounts and funds are largely obscured.

While these zk proof based networks are also anonymous, most networks are not also private.

It's a small distinction but it's important none-the-less. Privacy improves anonymity but it's perfectly possible to remain anonymous without privacy.

> the only way an identity is attached is if it can be inferred by the activity on the account.

Or by observing the IP from which you access Bitcoin.

This isn't really a thing, not without huge visibility of the bitcoin network to correlate 'first time transaction seen'. Transactions are relayed by peers -- just because you saw some gossip from IP 'A' does not imply the transaction came from IP 'A', it could have been relayed through 'B' and 'C'.

Furthermore, with dandelion routing, you cannot find the true origin of the tx by sight, even if you find the true first IP relaying the transaction.

Bitcoin makes this paper even more relevant: https://science.sciencemag.org/content/347/6221/536

Reply on news.ycombinator.com