Hacker News Reader

Hacker News

Comment by yborg | Hacker News Reader

Full thread

yborg

So how does one launder a half-billion dollar heist like this? Asking for a friend.

View on HN

1. Deposit to Tornado Cash using a script

2. Wait a year

3. Withdraw in batches (not all at once)

4. Move to Dubai

5. Find some sketchy guys who charge ~20-30% to go crypto -> wire transfer and don’t care about source of funds

6. Work with those guys to come up with documentation to placate compliance officers

This may not work forever because Dubai is probably going to have a big crackdown due to getting put on the FATF greylist. This also works in some Eastern European countries.

I thought Tornado Cash already spits out untraceable crypto. So it's not enough to use a mixer? Would you not be able to slowly withdraw from Tornado Cash and just exchange for fiat?

Imagine you steal 10,500 ETH. Then you deposit it into Tornado Cash. Then a year later a new address withdraws exactly 10,500 ETH from Tornado Cash (100 ETH at a time). That would look pretty suspicious.

Exactly you should slowly withdraw from Tornado. But you cannot use companies like Coinbase Gemini et al because they will ask about source of funds after a certain amount which you obviously do not want to reveal and coins that pass through Tornado are tainted now due to Tornado getting put on the OFAC list so they may freeze your accounts. So that’s where the sketchy people come in.

all you need is plausible deniability . If the govt. cannot prove you stole, then they cannot just prosecute you for using tornado cash (as far as the US is concered). Of course, exchanges may refuse to accept your coins if they are tied to tornado cash.

Any US person who has interacted with Tornado Cash after the OFAC designation has commited a felony (IEEPA violation). That means all funds tracable to it can be subject to forfeiture, and if you are directly receiving amounts of money from Tornado that substantially exceed your income for the past couple years you make the governments forfeiture case even easier. You are right that they may not be able to charge you with the initial crime. That is why you would want to leave the US for a jurisdiction that doesn’t care about those kind of things and work with people who aren’t regulated.

My understanding is that exchanging crypto that's gone through a mixer, especially Tornado Cash, is getting more and more difficult. The major exchanges don't want anything to do with coins that have gone through a mixer. That's where a sketchy guy who charges a large percentage comes in.

The government will ask you where you got the crypto from. This is why NFTs became huge. It's conceivable enough that you bought some for $100 and sold them for $10,000. When in reality you're just wash trading between your clean and dirty wallets.

Even if you manage to hide your tracks digitally on the chains, you still have millions of dollars you have to get out of a KYC off-ramp. You could possibly setup some sort of web service that offers something for crypto, but you'd have to believably falsify tons of customers and what you sold them. Again, this is assuming you've managed to perfectly hide the digital tracks and there's not an aggregated clear migration of the flow between the stolen funds and amounts ending in your account. Shady art and real estate deals are used in "real life", so maybe you could have some sort of NFT or metaverse thing going on. It'd be very difficult to pull off even over a long period of time, and you'd have a lot of people from all walks of life watching those funds, waiting for you to make a single mistake.

tornado cash, cross chain , etc. plenty of ways to evade tracking

>you still have millions of dollars you have to get out of a KYC off-ramp.

Come to Dubai, buy some mansions with crypto (some real estate developers accept crypto), sell those mansions for USD, and voila.

I would assume they'll try and push as much value into a currency that's meant to be untraceable (such as Monero or Zcash), move the money around a few wallets for safety, then start drip feeding to exchanges and claiming they got into the currency early by mining and are cashing out.

At least if I was going to risk a heist like this it's roughly what I would do.

Create NFT's with your real identity that can pass bank KYC and sell them for huge amounts of tumbled crypto to your hacker identity.

If they are smart enough to pull this off, they are probably smart enough launder it. And you don't need to launder all of it. Just $20 million is enough to live like a king for the rest of your life.

The Bitfinex hack shows that this is not always the case. I get the impression that the two nitwits did the hack perfectly but just assumed that mixing with alphabay would be enough. Then they transferred BTC into exchange accounts under their real names.

In a non-fiat system why would you need to?

To get a currency that you can pay taxes with, or buy traditional securities.

If it is totally non-fiat, where you can buy housing, food, fuel, devices, luxury items, etc., etc., etc., you would not need to cash out to fiat.

But seriously, in the current world, if we have a half-billion dollars "worth" of legitimate (or laundered) cryptocurrency, what can you do with it in the real world, especially contrasted to what we can do easily if we have a $$half-billion in legit $, €, £, or ¥ deposits?

I don't think we could even buy a Tesla or a pizza anymore. Maybe some things on Craigslist that take crypto?

A quick Google search finds that (it is claimed anyway) you can buy quite a few items from Amazon or Walmart at shopping.io

Go on Alibaba and you will find that a surprising number of companies take BTC or USDT. The next step in the laundering process is fairly obvious.

Tornado Cash might work here; it's a so-called "smart contract" (worst named things ever) that's designed precisely for this.

Reply on news.ycombinator.com