[Senate Hearing 117-677]
[From the U.S. Government Publishing Office]
S. Hrg. 117-677
UNDERSTANDING THE ROLE OF DIGITAL ASSETS
IN ILLICIT FINANCE
=======================================================================
HEARING
BEFORE THE
COMMITTEE ON
BANKING,HOUSING,AND URBAN AFFAIRS
UNITED STATES SENATE
ONE HUNDRED SEVENTEENTH CONGRESS
SECOND SESSION
ON
EXAMINING DIGITAL ASSETS TO LEARN HOW THEY WORK AND THE RISKS THEY
CREATE FOR CONSUMERS AND THE FINANCIAL SYSTEM
__________
MARCH 17, 2022
__________
Printed for the use of the Committee on Banking, Housing, and Urban
Affairs
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available at: https: //www.govinfo.gov /
__________
U.S. GOVERNMENT PUBLISHING OFFICE
52-387 PDF WASHINGTON : 2023
-----------------------------------------------------------------------------------
COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS
SHERROD BROWN, Ohio, Chairman
JACK REED, Rhode Island PATRICK J. TOOMEY, Pennsylvania
ROBERT MENENDEZ, New Jersey RICHARD C. SHELBY, Alabama
JON TESTER, Montana MIKE CRAPO, Idaho
MARK R. WARNER, Virginia TIM SCOTT, South Carolina
ELIZABETH WARREN, Massachusetts MIKE ROUNDS, South Dakota
CHRIS VAN HOLLEN, Maryland THOM TILLIS, North Carolina
CATHERINE CORTEZ MASTO, Nevada JOHN KENNEDY, Louisiana
TINA SMITH, Minnesota BILL HAGERTY, Tennessee
KYRSTEN SINEMA, Arizona CYNTHIA LUMMIS, Wyoming
JON OSSOFF, Georgia JERRY MORAN, Kansas
RAPHAEL WARNOCK, Georgia KEVIN CRAMER, North Dakota
STEVE DAINES, Montana
Laura Swanson, Staff Director
Brad Grantz, Republican Staff Director
Elisha Tuku, Chief Counsel
Dan Sullivan, Republican Chief Counsel
Cameron Ricker, Chief Clerk
Shelvin Simmons, IT Director
Pat Lally, Hearing Clerk
(ii)
C O N T E N T S
----------
THURSDAY, MARCH 17, 2022
Page
Opening statement of Chairman Brown.............................. 1
Prepared statement....................................... 38
Opening statements, comments, or prepared statements of:
Senator Toomey............................................... 3
Prepared statement....................................... 39
WITNESSES
Jonathan Levin, Cofounder and Chief Strategy Officer,
Chainalysis, Inc............................................... 5
Prepared statement........................................... 41
Responses to written questions of:
Chairman Brown........................................... 92
Senator Reed............................................. 94
Michael Mosier, Former Acting Director, Deputy Director/Digital
Innovation Officer, Financial Crimes Enforcement Network
(FinCEN)....................................................... 7
Prepared statement........................................... 83
Responses to written questions of:
Chairman Brown........................................... 95
Michael Chobanian, Founder of KUNA Exchange, President of
Blockchain Association of Ukraine.............................. 8
Prepared statement........................................... 87
Responses to written questions of:
Senator Reed............................................. 97
Shane Stansbury, Robinson Everett Distinguished Fellow in the
Center for Law, Ethics, and National Security, and Senior
Lecturing Fellow, Duke University School of Law................ 10
Prepared statement........................................... 88
Responses to written questions of:
Chairman Brown........................................... 97
Additional Material Supplied for the Record
Letter submitted by NAFCU........................................ 102
Statement submitted by AEI Housing Center........................ 105
(iii)
UNDERSTANDING THE ROLE OF DIGITAL ASSETS IN ILLICIT FINANCE
----------
THURSDAY, MARCH 17, 2022
U.S. Senate,
Committee on Banking, Housing, and Urban Affairs,
Washington, DC.
The Committee met at 10 a.m., via Webex and in room 538,
Dirksen Senate Office Building, Hon. Sherrod Brown, Chairman of
the Committee, presiding.
OPENING STATEMENT OF CHAIRMAN SHERROD BROWN
Chairman Brown. The Senate Committee on Banking, Housing,
and Urban Affairs will come to order. We have two witnesses in
person, two remote. Thanks to all of you. This is in hybrid
format, obviously.
In 2019, a doctor's office in the Mahoning Valley in Ohio,
the Youngstown area, experienced a disturbing attack. Hackers
locked the office computers, making them unusable. They even
faxed over a ransom note, promising to unlock the computers if
the practice turned over $75,000, in Bitcoin.
Not long ago, a Syrian group tied to al Qaeda put out a
call for donations to help buy weapons. Their social media post
said that supporters should ``donate anonymously with
cryptocurrency.''
``Donate anonymously with cryptocurrency.''
A week ago today, the Justice Department announced an
indictment of two individuals who allegedly turned the profits
of scams into cryptocurrency. Then they would send the crypto
overseas, where it could be turned back into cash.
This Committee has been examining digital assets to learn
how they work and the risks they create for consumers and the
financial system. We have also considered how digital assets
can put workers' hard-earned money at risk.
We are here today because crypto also can be used to make
it easier to commit crimes, facilitating illicit finance,
terrorism, and other forms of criminal activity, and
threatening our national security. Bad actors around the world,
from hackers, scammers, and drug traffickers to terrorist
groups and pariah regimes, have sought digital assets to
facilitate their crimes and intimidation.
In October 2020, under the last Administration, the Justice
Department concluded, quote, ``cryptocurrency technology plays
a role in many of the most significant criminal and national
security threats that the United States faces.''
To be sure, criminals have tried to cover their tracks for
years with sham accounting and banks that looked the other way.
But there is a simple reason that crypto appeals to crime rings
and scam artists.
The dollar has safeguards to protect against crime and
illicit activity. Companies that deal with real money are
required to know their customers and report suspicious
transactions. They need to keep records.
And even when crypto companies are covered by the law, too
many do not play by the same rules, especially offshore crypto
operators that are not subject to U.S. law. Shady crypto
companies that fail to adequately monitor activity on their
platforms essentially give criminals a green light.
Digital assets make it easier to move money under
pseudonyms. They make it easier for money launderers to use
webs of transactions across the globe to cover their tracks,
and that makes it harder for law enforcement to trace illicit
funds.
FinCEN, the Financial Crimes Enforcement Network, the
Treasury bureau charged with safeguarding our financial system
from abuse, warned last week that Russian actors could even use
crypto to get around sanctions.
So sophisticated bad actors can use digital assets in ways
that, if they were using dollars, would likely raise red flags
and get them stopped in their tracks.
Last year, FinCEN fined a crypto exchange $100 million. For
6 years, the only identification the company bothered to get
from customers was an email address. That no-questions-asked
approach enabled more than $200 million in suspicious
transactions.
But the problem is not only shoddy compliance. It is more
fundamental. We hear all the time about how ``innovative''
cryptocurrency is. But criminals innovate, too. Crypto allows
money launderers and terrorists to do things they never could
have done with dollars. There is a whole new vocabulary to
explain cryptocurrency illicit activity.
Take what is known as ``chain hopping.'' That is when
someone launders money by changing funds from one
cryptocurrency ecosystem to another, to make it harder to
track. Or look at so-called ``rug pulls.'' That is when you set
up a sham digital asset project online, raise as much money as
you can, scamming investors all the while, and then run off
with the cash.
Then there is Hydra, the world's largest ``darknet.'' It is
an online black market for drugs, for stolen credit card
numbers, and for cyberattack services, all enabled by crypto.
Our laws and law enforcement agencies need to keep pace with
these bad actors that will exploit every opportunity and stay,
as the old clich? says, one step ahead of the law. And so far,
with lax rules and little oversight, we have given them plenty
of those opportunities.
Crypto lets money launderers, hackers, and rogue regimes
invent new ways to hide and move money in the dark. It lets
hackers and scammers create new ways to steal or defraud. And
if we allow them to get out ahead of us, our safety and
security are at risk.
Law enforcement is doing what it can. They use techniques
to stop cybercrime that did not exist three decades ago.
Financial regulators leverage new data and resources to expose
fraud and manipulation in our markets. Crypto technology also
embeds information that allows law enforcement and national
security officials to track and trace where it has been, though
not necessarily who owns it. That is where the tough new money
laundering and beneficial ownership law that we all passed
bipartisanly last year will help.
But as these problems continue to grow, we cannot sit on
the sidelines. We need to take a clear-eyed look at how these
assets can endanger consumers and our security.
Last month, the FBI announced the creation of a new unit
dedicated to tracking down illicit crypto. The Justice
Department is dedicating more resources and staff to cracking
down on crime using digital assets.
We need to take a whole-of-Government approach to the
problem if we are going to keep up with crypto in illicit
finance.
President Biden understands that. His Executive order on
crypto assets last week will drive progress on this issue. It
was comprehensive. It was done right. It will jumpstart a
coordinated strategy from law enforcement and regulators to
fight bad actors who want to use crypto.
Ultimately, we just cannot sit back and watch
cybercriminals, rogue regimes, terrorists, and others create a
shadow financial system that works essentially only for them.
The financial system should work for American families and
small businesses. Everything we do on this Committee has that
goal in mind. It means that we cannot let abuses of digital
assets endanger our financial and our national security.
As crypto technology evolves, this Committee must continue
to work together to craft a way forward on these issues. The
stakes are high, and the American people are counting on us.
Ranking Member Toomey.
OPENING STATEMENT OF SENATOR PATRICK J. TOOMEY
Senator Toomey. Thank you, Mr. Chairman.
This hearing is about digital assets and illicit finance,
and while this is an important topic and is appropriate to
discuss and understand this topic, we also need to work to
ensure regulatory clarity for digital assets.
Digital assets, including cryptocurrencies and their
underlying distributed ledger technology, have enormous,
tremendous potential benefits. Some are already being realized.
As the White House itself recently stated, the U.S. must
maintain its leadership in this space, which is why lawmakers
and regulators should do nothing to harm America's longstanding
tradition of fostering technological innovation.
Unfortunately, I am concerned that the current lack of
regulatory clarity here at home is undermining that tradition
and driving innovation abroad. We need Congress to work
together to enact a regulatory framework specific to digital
assets that provides this much-needed clarity.
While today's topic is illicit finance, I think an
important backdrop for this hearing is Russia's invasion of
Ukraine. By starting the largest land war in Europe since World
War II, Russia has unleashed the greatest threat to global
security in recent memory.
The sanctions imposed thus far by the Biden administration
are harmful to the Russian economy, but not crippling.
Sanctions have purposefully allowed Russia to continue
exporting oil and gas, funding Putin's war machine with what
could be as much as $5 to $7 billion each week, coming from the
West. Cutting off this revenue stream and getting more lethal
aid to Ukraine are the two things we could do to maximize the
chances that Ukraine wins this war, and Putin comes to
understand this war was a calamitous mistake.
To cutoff Putin's oil and gas sales globally, the
Administration and Congress should impose secondary sanctions
on Russia's entire financial sector. This would force the world
to choose between doing business with Russia or with the United
States. I urge the Administration to impose these sanctions and
give Ukraine a fighting chance to win this war.
I am concerned that part of today's hearing will be spent
disparaging cryptocurrencies and trying to draw some connection
between them and Russian sanctions evasion. There is no
sanctions regime that is completely watertight, so it is quite
possible that an oligarch somewhere that may be using a variety
of tools, including crypto, to try to hide some assets.
But according to Administration officials across multiple
agencies, there is simply no evidence of cryptocurrencies being
used by Russia to evade sanctions in any significant way.
Just this month, FBI Director Christopher Wray told the
Senate Intelligence Committee that, quote, ``the Russians'
ability to circumvent the sanctions with cryptocurrency is
probably highly overestimated,'' end quote. Acting FinCEN
Director Him Das said, and I quote, ``we have not seen
widespread evasion of our sanctions using methods such as
cryptocurrency,'' end quote. And the director of cybersecurity
for the National Security Council said, and I quote, ``the
scale that Russia would need to successfully circumvent all
U.S. and partners' financial sanctions would almost certainly
render cryptocurrency as an ineffective primary tool for the
State,'' end quote.
The facts are clear and the Administration has discovered
this. Russia cannot meaningfully use cryptocurrencies to evade
current sanctions.
While there has been virtually no evidence of that evasion
taking place, Ukraine has been actively using cryptocurrencies
to do tremendous good. Cryptocurrency donations for Ukraine
have reached approximately $100 million, which has helped
Ukrainians defend their country against this terrible invasion.
These funds have gone toward more than 5,500 bulletproof vests,
they have bought 500 helmets, and over 410,000 meals, among
other things. Ukraine's Deputy Minister of Digital
Transformation has said that, and I quote, ``each and every
helmet and vest bought via crypto donations is currently saving
Ukrainian soldiers' lives,'' end quote.
We are fortunate to have as a witness today someone deeply
affected by the war in Ukraine and the use of cryptocurrency to
help Ukraine and its citizens. Michael Chobanian is the Founder
of KUNA Exchange, a local cryptocurrency exchange based in
Ukraine. For the past several weeks, Mr. Chobanian has been
instrumental in coordinating efforts so individuals all around
the world can contribute cryptocurrencies in support of
Ukraine's defense.
Crypto's remarkable nature is that anyone across the globe
can contribute to this type of effort, almost instantaneously,
at very low cost. It is in this context that we should examine
cryptocurrencies and their relation to illicit finance.
Throughout history, criminals have always tried to utilize
new technologies for nefarious gain. But that is not a reason
to stifle new technological developments. Crypto can be used to
empower individuals and promote personal autonomy, but it can
also support the detection and prevention of illicit crime.
According to Chainalysis, transactions involving illicit
addresses account only for 0.15 percent. That is less than two-
tenths-of-1-percent of cryptocurrency transaction volume last
year.
And this should be no surprise. The traceable nature of
most cryptocurrencies is a factor making them terribly risky to
utilize for criminal purposes. Just look at the Colonial
Pipeline hack, which was one of the most disruptive ransomware
attacks on record. The Department of Justice recovered 85
percent of the Bitcoins that the pipeline paid in ransom,
dealing a very significant blow to the hackers.
One of today's witnesses, Michael Mosier, can speak
directly about the characteristics of cryptocurrencies that
help detect criminal activity. Mr. Mosier is the former Acting
Director for the Financial Crimes Enforcement Network, or
FinCEN, at the U.S. Treasury Department. His Government
experience makes him uniquely qualified to discuss the topics
before us today.
Today I hope the Committee takes a thoughtful and
reasonable approach to this topic, acknowledging both the risks
that cryptocurrencies present, but also their incredible
potential. I thank the witnesses for their testimony and
participation today, and I look forward to the discussion.
Chairman Brown. Thank you, Senator Toomey.
I will introduce the four witnesses. We will hear from
Jonathan Levin, Cofounder and Chief Strategy Officer at
Chainalysis, Inc; Michael Mosier, the General Counsel of
Espresso Systems and Former Acting Director and Deputy Director
and Digital Innovation Officer at FinCEN. They both are sitting
at the table in front of us.
And appearing remotely, as Senator Toomey said, is Michael
Chobanian, Founder of KUNA Exchange, President of Blockchain
Association of Ukraine. Welcome. And Shane Stansbury, a Fellow
at the Duke University School of Law, Former Assistant U.S.
Attorney.
Mr. Levin, please proceed. Thank you.
STATEMENT OF JONATHAN LEVIN, COFOUNDER AND CHIEF STRATEGY
OFFICER, CHAINALYSIS, INC.
Mr. Levin. Chairman Brown, Ranking Member Toomey, and
distinguished Members of the Committee, thank you for having me
here today to testify about this topic at an important time, as
we have put significant sanctions on Russia to end the war in
the Ukraine and we work together on a full Government digital
asset policy, as according to President Biden's Executive
order, put in place last week.
My name is Jonathan Levin, and I cofounded Chainalysis 8
years ago with Michael Gronager.
At the turn of the 20th century, my family fled the pogroms
of Eastern Europe to look for a better life in the West. They
left with nothing. People in the Ukraine today are fleeing
their homes and crossing borders, leaving loved ones and
possessions behind.
We, as a global community, have come together at an
unprecedented pace to counter this movement. This has been due
to the speed of information that is possible with the internet,
and this ultimately has to be matched with the speed and
inclusiveness of finance.
The transparency that the internet has created about these
atrocities has not been matched by the transparency realized in
financial services. Bitcoin and Ethereum are technologies that
pose the greatest opportunity to increase the degree of
transparency and financial services, included the excluded, and
create new ways for commerce to happen.
Bitcoin has evolved over the last decade. It started off as
just a promising technology, but today there is a community of
more than 100 million people who depend on it. It has also
spurred the creation of other digital communities. Commerce,
such as music, art, and even electric vehicles depend on the
underlying technology.
Chainalysis is the blockchain data platform. We provide
data, products, services, and research to Government agencies,
financial institutions, and the digital asset industry, more
broadly. Through the use of our software, law enforcement has
managed to take down the largest darknet markets, prevent the
use of cryptocurrency for terrorist financing, and has
prevented scams and investigated ransomware campaigns, as
previously mentioned.
Tens of thousands of cases and investigations have taken
place on our platform by both public sector and private sector
in the fight to remove illicit activity from cryptocurrencies.
Our compliance software enables AML compliance for the digital
asset industry to ensure their compliance with obligations
under the Bank Secrecy Act.
The blockchain's transparency and the permanence of the
records that are contained within this allow us to root out
this illicit activity. Law enforcement leverages the permanence
of these records and its openness to take proactive steps in
being able to investigate crimes without the need to serve
subpoenas or have reporting requirements.
When it comes to the use of sanctions as a tool for
national security, OFAC has used the fact that there is
compliance among the exchange to foster a degree of sanctions
across the Russian ecosystem. In September 2021, OFAC
sanctioned SUEX and Chatex, effectively removing these enablers
as exchanges from the digital asset ecosystem.
We at Chainalysis have also, last week, released a free and
open sanctions screening tool for everyone in the industry to
be able to screen against addresses that are listed on the OFAC
SDN list.
Just with any new technology, criminals have found
innovative ways to exploit digital assets. As mentioned
previously, illicit transactions only represent 0.15 percent of
total transaction volume, as outlined in the Chainalysis Crypto
Crime Report. I have included a much deeper analysis in my
testimony, and I am happy to answer questions on it.
The sanctions imposed on Russia demonstrate the power of
investing in financial technology and the dominance of the
dollar that we managed to achieve over the course of the 20th
century. We need to make sure that we continue to invest in
financial technology and build the financial rails that will be
used by the global in the 21st century. Embracing digital
assets will help the U.S. build this future. These new rails
can be built in a way that encourages transparency and that not
only protects our national security and public safety but
actually enhances it.
At the end of my testimony I have written some
recommendations about how regulators and Congress can act to
reduce illicit activity in digital asset markets, and I am very
happy to answer questions.
Chairman Brown. Thank you, Mr. Levin.
Mr. Mosier, please proceed. Welcome again to the Committee.
STATEMENT OF MICHAEL MOSIER, FORMER ACTING DIRECTOR, DEPUTY
DIRECTOR/DIGITAL INNOVATION OFFICER, FINANCIAL CRIMES
ENFORCEMENT NETWORK (FINCEN)
Mr. Mosier. Thank you, Chairman Brown, Ranking Member
Toomey, Members of the Committee.
My grandfather was a justice of the peace in a small mining
and steel town in Western Pennsylvania. Sadly, he died long
before I was born. But I treasure one of his 1953 election
campaign cards. It says, ``Endorsed by labor and avowed enemy
of Communism''. Those statements represent a sense of
collective empowerment as well as vigilance that power can be
oppressive.
The desire to protect personal sovereignty led me to public
service. After pro bono cases to help victims of domestic
violence I became a prosecutor at the Manhattan District
Attorney and eventually Deputy Chief in the Department of
Justice, investigating kleptocracy and the financing of human
trafficking.
Protecting self-determination, as enshrined in the
Constitution, is a critical part of public service. To that,
when we speak of illicit finance we must also not forget the
defenders of democracy whose financing may be considered
``illicit'' to autocrats and invading armies. The same
cryptographic capabilities discussed here today enabled secure,
auditable, humanitarian aid to 60,000 health care workers in
Venezuela, under a repressive regime. No doubt the regime there
considered it subversive ``illicit'' finance, but to the White
House and Treasury who approved it, it was cryptographically
secure humanitarian aid.
As we debate risks of technology based on cryptography it
is critical to remember that encryption has protected and
reflected our democratic values for years. Likewise, in the
past few weeks, tens of millions of dollars' worth of
cryptocurrency were donated to Ukraine, faster and more aid
than the U.N. provided. With the transparency of Government-
identified wallets on a public ledger, far more accountability
than the U.N.'s Oil-for-Food scandal.
A few observations about ransomware in particular.
Ransomware dates back to 1989, two decades before the emergence
of Bitcoin. Yes, Bitcoin has become a preferred payment method
because of speed and perceived anonymity. However, public
ledgers offer law enforcement significant visibility and
investigative benefits over opaque international banking. We
saw this with the recovery of $2.3 million from the Colonial
Pipeline attackers.
The increase in ransomware has more to do with other
developments. First, the advent of ransomware-as-a-service,
making kits widely available, regardless of coding skills, and
drastically reducing barriers to entry. And the use of double
extortion, greatly increasing payouts by also threatening to
expose stolen data, not just lock the computer.
We also know from SolarWinds that there are plenty of
malign actors driven by nonfinancial incentives. Over-
attributing cybercrime to cryptocurrency misses critical causes
and preventive measures that could be taken.
Certainly there is work to be done yet for Web3 to be
safely accessible, but the early internet had a lot of fraud
and exploits as well. Instead of shutting down the internet, we
worked persistently to find the balance while prioritizing
risks and pathways to consensus and clarity.
If you want to tangibly impact illicit finance here are
three concrete actions you can take.
First, pass the budget that was due last October. Fifteen
months after landmark AML modernization legislation, FinCEN and
OFAC are without the roughly $74 million increase in personnel
and technology, while more and more are demanded of them.
Resource them for their current job before burdening them--and
industry--with more unfunded mandates.
Second, resource and expansively clarify the AML
whistleblower program to empower crowdsourced leads related to
corruption and abuse. Explicitly include any violation of money
laundering, not just the BSA.
Last, press FATF representatives to focus on regulatory
arbitrage through baseline consistency across jurisdictions
before adventuring into new rules. We know that the gaps are
concentrated at a small group of foreign centralized exchanges.
Help diligent U.S. exchanges by leveling the playing field
before expanding the rules to mere developers, in conflict with
our Constitution.
I will close at that. Constitutional principles set the
foundation for our country and our standing in the world. As we
see in unified solidarity with Ukraine, principles are a key
rallying point in the global battlefield of ideals. Thank you
for this opportunity to advance our ideals today.
Chairman Brown. Thank you, Mr. Mosier.
Mr. Chobanian is joining us remote. Mr. Chobanian, welcome.
STATEMENT OF MICHAEL CHOBANIAN, FOUNDER OF KUNA EXCHANGE,
PRESIDENT OF BLOCKCHAIN ASSOCIATION OF UKRAINE
Mr. Chobanian. Good day. Can you hear me? I guess so. Good
day.
So my name is Michael Chobanian. I am the founder of KUNA
Exchange, and I am also the President of Blockchain Association
of Ukraine. Currently we serve more than 450,000 users.
I would like to tell my story. You have my statement to
read, but I would like to do a bit of storytelling. So on 24th
of February, I woke up at 5 a.m. because I heard really loud
noises, and my windows were shaking, my house was shaking, and
I immediately understood that the war had started. So I woke
up, I went up on the internet, I googled, I saw that the formal
proof that the war has started. My kid woke up, my wife woke
up, and they asked me what was happening, and I said, ``Russia
has started war on us.'' And my kid asked, ``How?'' because we
have so many friends in Russia. How could this happen? And I
could not give her an answer.
So a few hours later we had to leave my home. This is
pretty much all I have left--a few sweaters, sneakers, and
jeans--and the same with the other probably three million
people, we had to flee toward Western Ukraine.
So a couple of hours later, when we got to Western Ukraine,
I decided that we have to set up a fund in order to help my
people, my army. I knew that the army was in terrible
conditions in terms of supplies, considering that we were
fighting the probably second-largest army in the world.
So we set up a fund, and a few hours later I was approached
by the Minister of Digital Transformation and we discussed that
instead of setting up a few smaller funds it is better to set
up one big Government fund in order to, first of all, give
transparency, in order to speed up the process of buying all
the vital goods for my people, for my army. And basically we
set up a fund, and now it is being run by both Ministry of
Digital Transformation and by the Ministry of Defense.
Right now we already collected more than $50 million in
equivalent. We are reaching for about $100 million. Mr.
Chairman stated what exactly we bought with it. This is just a
tiny fraction of what we bought. We also had opportunity to
supply finance to the cities like Mariupol, to Kharkiv, which
are now enclosed and captured by Russians. The internet still
works there so we can supply crypto there, and, with this
crypto, people can buy food and whatever is required there.
Our fund, well, because it is run on my exchange, it is
fully compliant with the current laws and regulations in
Ukraine. That is why we are working with the Government.
Yesterday the President has signed the bill and now crypto is
fully legal in Ukraine.
In terms of sanctions, because, Mr. Chairman and Vice
Chairman, you also said about the sanctions, so the first thing
that we did as a crypto community in Ukraine, we shut down all
the robo-operations, because that was a big hole in the
sanctions list. And sanctions really help because that is how
we would fight with economic means.
Unfortunately, not all crypto companies followed our lead.
Namely, Binance still works with the ruble, and it is a big
hole in the sanctions so we are likely to investigate more on
this.
Also there was the note, Mr. Chairman, that Russians could
use crypto to avoid sanctions. This is not exactly true. I am
the person who is behind all the numbers. I know how it
happens. So it is impossible, physically impossible to transfer
large amounts of money from fiat into crypto. And again, even
if they do, which is impossible, as I said, there is nothing
they can do with it. Their yachts are being arrested. Their
house is being arrested. They cannot travel to the civilized
world. So for them it just done numbers, which are pretty
useless.
But I have to stress this out, and I have to stress this
out very clearly, that there are a lot of Russians in Russia
and outside of Russia who rely on crypto. These people are
basically the opposition to the Putin regime, and we have to
make sure that when you draft the laws that we do not actually
kill this opposition within Russia that could actually help us
bring down the regime.
And the final I would like to read from much of my
statement. By concluding, I would like to thank the U.S. Senate
and U.S. people for the opportunity to stand here and speak on
these vital issues. Our Nation is eternally grateful for all
the help given by our international friends. Namely, yesterday
we received the news that a lot of weapons will be given by
U.S. country and by the U.K. and other European partners. I
truly believe that the unprecedented global unity and support
for Ukraine during this unmerited, unwanted, and unnecessary
bloodshed can put an end to Putin's reign of terror and lead us
to an even brighter future.
Thank you, and Slava Ukraine.
Chairman Brown. Thank you, Mr. Chobanian, and best wishes
to you and your family. Mr. Stansbury, remote, I believe, from
North Carolina.
STATEMENT OF SHANE STANSBURY, ROBINSON EVERETT DISTINGUISHED
FELLOW IN THE CENTER FOR LAW, ETHICS, AND NATIONAL SECURITY,
AND SENIOR LECTURING FELLOW, DUKE UNIVERSITY SCHOOL OF LAW
Mr. Stansbury. Chairman Brown, Ranking Member Toomey,
distinguished Members of the Committee, thank you for the
opportunity to testify today.
I am a Senior Fellow in the Center on Law, Ethics, and
National Security at Duke Law School, where I teach primarily
in the areas of cybercrime and national security. I spent more
than 8 years as a Federal prosecutor in the United States
Attorney's Office for the Southern District of New York.
Today I have been asked to talk about the role of
cryptocurrencies in illicit activity and also the challenges
facing law enforcement, so I will begin with some context.
Criminals have always sought to take advantage of new forms
of technology to facilitate illegal activity. Over the last two
decades, the pace at which they have done has increased
dramatically as the internet, social media, smartphones, and
other innovations have changed the way we communicate.
As a prosecutor, I saw digital communication like social
media and encrypted messaging apps revolutionize the way that
terrorist organizations recruit members and carry out
operations. And, of course, drug traffickers and criminals of
all types also adopted these technologies to further their
criminal conduct.
So in similar ways, cryptocurrency is changing the way that
criminal finance illegal activities. In some ways we have been
here before, but in other ways cryptocurrencies present new and
distinct challenges. Because they are decentralized, easy to
use, and hold the promise of at least some level of anonymity,
cryptocurrencies can act as magnets for illicit activity.
Cryptocurrency is now a multibillion-dollar business for
criminals. It is used in connection with virtually every type
of crime--child exploitation, human trafficking, extortion,
fraud, you name it.
Perhaps nowhere is cryptocurrency's role more vivid than in
ransomware attacks. As many Americans know all too well,
ransomware is no longer just a problem for U.S. businesses. It
is a serious threat to our public safety and our national
security. Look no further than the Colonial Pipeline attack
last year, which caused fuel shortages throughout the Southeast
United States. But that was only one incident among many.
Hospitals, school districts, city governments, all of them are
being victimized by this modern-day hostage scheme.
Cryptocurrency is the defining feature of modern
ransomware, and the attraction for ransomware criminals is the
same for other criminals--obscurity. Cryptocurrency ransom
payments can often pass through multiple layers involving
different entities, including entities outside regulated
markets. Criminals employ a variety of methods along the way to
hide their tracks, and I explain some of those methods in my
written testimony.
Some of these same methods can be used by criminals who use
cryptocurrency to launder proceeds or hide illicit assets
without traditional intermediaries. Even the cryptocurrency
market itself is providing new opportunities for crime. Wallets
and exchanges have become targets for theft and fraud.
Criminals both steal money directly and also engage in scams to
defraud innocent investors in cryptocurrency.
In short, cryptocurrency-related crime is here and it is
growing, and we should be clear that the threat is not just
from ordinary criminals. Rogue Nation States like North Korea
have increasingly turned to cryptocurrency theft and other
crimes to help finance their regimes.
I would now like to just say a few words about the
challenges for prosecutors and law enforcement. Law enforcement
is getting much better at tracing digital assets used to commit
and cover up criminal activity. With the help of forensic
analysis and know-your-customer information from regulated
entities, law enforcement can sometimes shine a light on an
otherwise opaque world.
Last year, DOJ recovered a substantial portion of the $4.4
million in ransomware payments made in connection with the
Colonial Pipeline attack, and just last month DOJ recovered a
record $3.6 billion in cryptocurrency allegedly related to a
2016 hack. These are promising and welcome developments.
We should not be too quick to conclude that tracking down
the criminals using cryptocurrency is always easy or even
always possible. Even with the latest analytics, a single
investigation can be resource intensive and take years. The
hardest part of a cyber-related prosecution can often be
demonstrating what investigators sometimes refer to as ``hands
on the keyboard.'' Prosecutors have to demonstrate, beyond a
reasonable doubt, that an identifiable person was behind a
particular act. Digital clues from cryptocurrency transfers can
be invaluable, but they do not provide all the answers about
who is behind the criminal activity.
When my colleagues and I investigated international money
laundering cases we often connected dots because of information
made available by institutions that followed their compliance
obligations. That kind of information is sometimes available in
today's cryptocurrency market but too often it is not. Not all
platforms comply with existing regulations, and many operate in
jurisdictions beyond the reach of the United States law
enforcement agents.
At the end of the day, an investigation is only as
successful as the information and resources available.
Blockchain technology does offer fascinating possibilities, and
I look forward to seeing how it develops, but we should also
recognize the role that cryptocurrency is playing in criminal
activity. Only then can we take steps necessary to protect our
health, our safety, and our national security. Thank you.
Chairman Brown. Thank you, Mr. Stansbury.
I will begin the questions with Mr. Levin, but first, Mr.
Mosier, you mentioned the request for the dollars. The
President signed the bill a couple of days ago with $50
million, a significant number obviously, to combat money
laundering. So your request was granted.
Mr. Mosier. Thank you. I will not take credit for that.
Chairman Brown. Oh, go ahead.
Mr. Levin, you noted that in 2021 the volume of illicit
crypto transactions grew something like, at least $14 billion,
a pretty big number. You explained the methods criminals use to
conceal their transactions, new tactics like chain-hopping or
mixers to obscure the trail of funds.
These are the strategies they are using right now. Tell us,
if you would, what are the emerging ways that illicit actors
are exploiting digital assets to avoid detection and obscure
their identities? What are their next moves that you expect?
Mr. Levin. Thank you, Chairman. So when it comes to these
types of obfuscation techniques or any sort of anonymizing
techniques that the criminals pursue this is a very cat-and-
mouse type situation where Chainalysis, the business, we
research these techniques and stay, oftentimes, one step ahead
of these criminal actors.
And so you mentioned chain-hopping and mixing. I think the
largest gap is truly on the offshore exchanges that you also
mentioned, in being able to cash out these types of
transactions. You will note in the Crypto Crime Report that we
put forward there is a concentration of cashouts by ransomware
actors at only a few destinations. And so if law enforcement
could focus in on those we could get ahead of some of the
illicit flows that you are concerned about.
Chairman Brown. Thank you. Mr. Stansbury, it seems digital
assets have enabled and emboldened whole new types of criminal
activity. Look at ransomware, that you discussed. There are now
criminal groups that license out ransomware software to other
hackers, or take dark web markets, where people can buy and
sell drugs and stolen credit card numbers using crypto.
Mr. Stansbury, how have criminals used features of digital
assets to invent new kinds of crime, and as you answer that,
what kinds of criminal conduct are built around these
cryptocurrencies?
Mr. Stansbury. Thank you, Senator. Yeah, I think I would
divide it into a couple of different categories. As you
mentioned, cryptocurrency has made some crimes, some existing
crimes, easier and has changed the nature of some crimes, like
extortion. Ransomware has been around for a while, but
cryptocurrency has changed the way extortion looks, and
ransomware is a perfect example of that. Cryptocurrency is now
the currency for ransomware. A senior director in the FBI
mentioned, just this year, that cryptocurrency is the exclusive
medium for exchanges for ransomware. So in some ways it has
made things easier for existing crimes and changed the nature
of those crimes.
In other ways it has provided new opportunities for new
crimes. The DOJ Cryptocurrency Enforcement Framework from a
couple of years ago I think does a nice job of outlining that
and framing it. But I would say that any time you build a new
financial ecosystem it presents new opportunities for
criminals, obviously. And so that means that exchanges can be
hacked by North Korea. It means that wallets can be hacked. It
means that there are new scam opportunities, and we have seen a
variety of those scams increase in frequency over the last
year. In fact, Chainalysis does a nice job of describing some
of those techniques.
So it both can contribute to existing crime and also create
new opportunities.
Chairman Brown. Thank you. Mr. Chobanian, the 2022 Crypto
Crime Report from Chainalysis pinpoints Russia as a leader in
illicit criminal activity using digital currency. Many
ransomware groups, like Evil Corp--that is actually what they
call themselves--are based there. Moscow is a hub, as you know,
for crypto money laundering.
Why is it important that we crack down on Russia's
cybercrime that uses digital assets?
Mr. Chobanian. Very good question. Well, obviously,
cybercrime is not good but I will have to stress out one thing.
Think of crypto as energy, for example, nuclear energy. You can
use nuclear for good, to create cheap energy, or you can create
bombs with nuclear energy. So the same with crypto. You can use
it for good or you can use it for bad. It depends on who uses
it and how he uses it.
So in terms of hackers, and especially Russian hackers, I
think that pretty much they are stuck in Russia right now and
there is nothing that they can do with this crypto, as I said
before. I mean, they are sitting in a city where you cannot
even go to McDonald's. You cannot buy any of the Western world
goods and services. So the only thing they can do is just look
at the numbers. So right now I do not see that there is a big
problem, but it potentially could be a big problem if something
happens to Russia, not the way that we plan in Ukraine.
Chairman Brown. Thank you. Senator Toomey.
Senator Toomey. Thank you, Mr. Chairman. Mr. Chobanian,
first let just say our heart breaks for you and your family
like it does for the several million Ukrainians that have been
forced from their homes by this outrageous and completely
unjustified brutal attack by Russia. And we are particularly
grateful that you have taken the time to join us, despite the
experience you are going through.
I wonder if you could just tell us, in a simple way, for a
layman to understand, you mentioned that you are on track, you
are hopefully going to raise $100 million from donations from
people all around the world who want to help Ukraine. Why is
this being done through crypto? Why are not people just sending
dollars and yen and euro and other currencies?
Mr. Chobanian. Very good question. Thank you. The banking
system I your country is totally different to my country. So
for you it is easy just to press two numbers and you can send
any amount to other participants that you want. With crypto in
Ukraine it is slightly different. The first problem that we are
solving is urgency. So in order for U.S. dollars to actually
land in Ukrainian bank accounts it takes at least 1 day, if we
are lucky, but usually it takes 2 days. If it is a Friday
afternoon you have to wait until Monday.
For my country, which is fighting right now with bare
hands, time is the vital thing. So for the crypto, which works
24/7, we receive money instantly and we can spend money
instantly, and by ``money'' I am speaking in the broader terms.
So yeah, that is the key thing. And the other thing is that
with crypto we can attract donations from pretty much anyplace
in the world, even countries which do not have access to
banking but they have crypto, like in Africa or in Asia.
Speed, urgency, and ease of use.
Senator Toomey. And it is inexpensive, is it not?
Mr. Chobanian. It depends. Here it depends which currency
you are sending us. So Bitcoin and Ether is slightly expensive,
but again, it is like $10, $20, maximum $50. But at this point
it does not really matter. Here what we are fighting for is
speed. The faster we buy the helmets, the faster we buy the
bulletproof vests, the faster we buy the first aid kits, the
more people I can save in my country. So here I am praying just
for crypto because it is so fast.
Senator Toomey. And given the disruptions to daily life in
Ukraine, has there been an increase in the use of crypto as a
medium of exchange? Are ordinary people using crypto to buy
ordinary things, in some cases, because, of course, that is not
common in the United States.
Mr. Chobanian. Well, even before the war Ukraine was the
number one country per capita in terms of crypto wallets and
crypto usage. Now it is probably double that. The reason for
that is you cannot buy U.S. dollars on the bank accounts right
now because national bank closed that option on the day of the
war.
So if you want to buy something abroad, the only option
that you have--and if you have like local currency, hryvnia, on
the bank account or you have cash in U.S. dollars in Ukraine,
yeah, that is it, the two options. So the only option to
actually buy something abroad, you need U.S. dollars, and you
cannot buy them. With the crypto you can actually buy USDT,
which is a token, which is backed one-to-one to U.S. dollar.
You can buy that with local currency. You can use that to pay
for the helmets in Europe or in U.S. The transaction takes
about 10 minutes, and that is it. And that is the only option
for these small and medium businesses and for regular people
like me.
Senator Toomey. Thank you very much. This question is for
both Mr. Mosier and Mr. Levin. So we all want to make sure we
have got the tools to find the bad guys, and there are bad guys
out there. For a very long time we have had reporting
requirements for financial institutions that serve as this
massive dragnet, like require banks to report every single
transaction over $10,000.
Now we know, we have long known, that the vast,
overwhelming majority of those transactions are perfectly
legitimate, but we did not have a way of sort the good from the
bad so we report them all, and we have this expensive,
inefficient mechanism for this over-reporting in the hopes
that, well, at least we will sweep up the bad guys too.
With crypto we have a whole new kind of technology, it
seems to me, and I guess what I would like you to comment on is
rather than apply the old, outdated, like literally 50-year-old
technology to crypto, should we be thinking about using the
tools that crypto avails us to zero in on the likely
problematic transactions rather than having this universal
reporting requirement that sweeps in preferably legitimate
transactions? If you could both comment on that, I would
appreciate it.
Mr. Mosier. I will start. Thank you. Thank you, Senator
Toomey. No, I think it raises a really important question and
something that we struggled with at FinCEN, both from a
resource and a technology perspective and also with protecting
personal data. And I think there is another piece of that,
which is when we collect data we are regularly asked, I think
legitimately, by the public and by Congress, ``OK, what have
you done with that, that it was worth the burden?'' And, in
fact, every rulemaking requires a burden assessment on industry
for that.
And I think what we struggled with was getting the tools
and the technology to be able to sort through the data that we
had--indeed, they still continue to do that--and we are always
conscientious that if we are creating new reporting
requirements, will we be able to use it, and will we be able to
use it fast enough?
So I think given, what Mr. Levin will surely talk to you
about, the capabilities and what we, I think, have all
discussed in terms of the public transparency, the critical
piece right now is it is on a public ledger. We do not really
need you to send stuff in. What we need are the tools to sort
through that efficiently and connect it across data. It is
already actually exceptionally clean data because it is
structured data. It is numbers. It is alphanumerics. It is not
the old days of fax machine and people writing it into the
wrong format and we cannot sort it. So it is actually quite
good data. It is just the ability to use it.
Mr. Levin. Thank you, Senator Toomey, and I agree sort of
with the premise of the question. The problem with a reporting
requirement with a fixed number means that that becomes a
difficult thing to change over time and creates sort of a
deluge of information around something that seems fairly
arbitrary in nature.
When it comes to the blockchain, there is a complete set of
records out there for everyone to look at, that actually also
updates in real time, so there is no waiting for reporting to
happen. And so not only are you able to access it, you are able
to access it faster than you would otherwise be able to in a
reporting sense, and then actually being able to sift through
what is illicit activity from what is regular commerce is much
easier in a cryptocurrency context than in traditional finance,
where you are looking for behavioral patterns.
So I think when it comes to thinking about regulating the
digital asset economy we have to take into account those unique
attributes of the technology and think about sort of as my
esteemed colleague here said, the scarce resources that there
are in Government agencies to actually look at this and invest
in the technology to be able to have that real-time oversight
of the sector.
Senator Toomey. Thank you, Mr. Chairman.
Chairman Brown. Senator Menendez, from New Jersey, is
recognized.
Senator Menendez. Thank you, Mr. Chairman.
I have raised concerns in the past with Iran's practice of
mining cryptocurrency in order to launder its sanctioned oil
and natural gas reserves into cash. Because the main cost
associated with mining cryptocurrency is energy, I worry that
the Russian Government will also look to mining as a way to
evade sanctions.
According to the Cambridge Bitcoin Electricity Consumption
Index, Russia accounts for 13.6 percent of all Bitcoin mining,
as measured by energy consumption, so they certainly have the
infrastructure for such activities.
So, Mr. Stansbury, are there tools that would allow
financial institutions and regulators to prevent use of mining
to avoid sanctions?
Mr. Stansbury. There are tools available to regulators, but
I think largely it is all on the enforcement front. You are
right that Iran has successfully mined cryptocurrency to its
advantage. There is also a lot of reporting about North Korea
that has turned to cryptocurrency to fund its regime. So it is
a huge problem.
But I think that mostly we need to look, on the enforcement
front, how are these Nation States able to bypass sanctions?
How are they able to convert the cryptocurrency that they are
mining because they are moving it across borders and somehow
converting it to a medium that they can use. So that, I think,
is where most of the problem lies.
Senator Menendez. Mm-hmm. And Mr. Levin and Mr. Chobanian,
what is your understanding of the links between Russian miners
and the Russian Government?
Mr. Levin. Michael, you can go first.
Mr. Chobanian. Thank you. So I can say that probably there
is none because Russian miners are just regular people, the
businessmen who are doing it for principles of crypto, because
they believe in this technology or especially if they want to
earn money, that is what they do. But again, when you talk
about sanctions on a Government level, what kind of sums are we
talking about? If we are talking about billions then I can
answer you right now--it is impossible to substitute Bitcoin or
any other cryptocurrency for U.S. dollars on the Government
level.
You cannot transfer that easily a couple of billions of
dollars without anyone noticing on the physical level, so I
would like to stress this point. It is not an issue of the big
numbers, and smaller numbers, you know, it is not about buying
oil or buying weapons, or buying anything else with these small
numbers in U.S. dollars. Thank you.
Senator Menendez. Interesting.
Mr. Levin. Yes, and I would agree with what Mr. Chobanian
said. I think the only other thing to raise is that it has been
possible for U.S. law enforcement and the intelligence
community to actually identify and attribute Russian Government
activity inside the crime cases when it comes to the issues of
ransomware, hacking, or other forms of financial crime. And so
it is the case that we need to further the capabilities of
those agencies to get close to the operatives and the
operations of Russia in this domain to continue to understand
the evolving picture.
Senator Menendez. Mm-hmm. Now there is a difference between
the Russian Government and Russian oligarchs. The Government's
relationship with exchanges, both foreign and domestic, is
going to be an increasingly key element in enforcing sanctions
going forward. We are seeing, with the current crisis in
Ukraine, that law enforcement is reliant on exchanges
themselves to screen users and block sanction targets.
Mr. Stansbury, what are the risks to U.S. persons and
institutions that are trading with exchanges in Russia and
other jurisdictions with poor monitoring and know-your-customer
rules?
Mr. Stansbury. One of the risks is scam, fraud, and theft.
So, you know, there is a degree of risk that any consumer is
taking when they place their investment money into the
cryptocurrency ecosystem, and in a high-risk environment like
that I think that is one of the chief concerns, particularly as
cryptocurrency grows in popularity and less-sophisticated
investors get into the market.
Senator Menendez. And finally, Mr. Levin, your firm
estimates that of all the ransomware payments made in 2020, 15
percent of them carried a risk of sanctions violations. So
essentially victims of ransomware attacks are increasingly
finding themselves targeted by sanctions entities and therefore
victims that make ransom payments in cryptocurrency may
themselves be committing sanctions violations. How should we,
in Congress, think about addressing this problem without
undermining the efficiency of our sanctions tools?
Mr. Levin. Thank you, Senator. It is a delicate balance
between the issue of sanctioning and disrupting the cybercrime
activity and raising the deterrence against such attacks. And
so I think the effective sanctions against entities like Evil
Corp that have been sort of behind these types of attacks has
meant that there are fewer firms that are willing to actually
pay those ransoms, which does actually reduce the incentive by
which they have to attack our population.
And so I think it is another example of how effective
sanctions can be when it comes to disrupting activity that we
are worried about for our public safety.
Senator Menendez. Thank you, Mr. Chairman.
Chairman Brown. Thank you, Senator Menendez.
Senator Hagerty, for Tennessee, is recognized.
Senator Hagerty. Thank you, Mr. Chairman, and Happy St.
Patrick's Day to everybody today.
Over the past year, law enforcement has recovered billions
in stolen crypto. All of this has been done in an ecosystem
that has been often described as anonymous, illicit, the Wild
West, in fact, of illicit finance. But in my view it is
inconsistent with the architecture of blockchain technology
because most cryptocurrencies are built on a public ledger,
that makes the chain of ownership visible, and by extension, it
makes it traceable to any token's existence at any point.
Mr. Levin, I will start with you. Cryptocurrencies are
pseudo-anonymous, right? The wallets addresses themselves do
not identify the owners. But with the proper tools and proper
legal authority what capabilities exist to actually track and
identify illicit actors in cryptocurrencies such as Bitcoin?
Mr. Levin. Thank you, Senator, and it is an important point
to make because it is often conceived that cryptocurrency is
not as transparent as it actually is. So when it comes to
having the necessary tools in place, Chainalysis, what we do is
we map all the transactions that occur in cryptocurrencies to
the entities and services that people are using to conduct that
activity. And so the fact that all of the industry and all of
law enforcement and the regulatory authorities can all have
access to that same information about what services and what
entities are behind these transactions, you know, that allows
us to take unprecedented steps in being able to collaborate on
weeding out illicit activity.
You point out that the Government has also managed to seize
record sums of money from these cases in a world in which
people thought that it was anonymous and that it was unable to
be seized. So law enforcement can have these types of successes
in this environment.
Senator Hagerty. I think it is interesting, when you
compare cryptocurrency to cash, on the other hand, and if you
think about cash, cash is fully anonymous. It is untraceable.
There is no underlying record of the chain of ownership with
cash, and no one knows where a particular $100 bill may have
been, whose hands it may have passed through, or how many hands
it may have passed through.
So it seems to me that an individual that wants to break
the law without being traced would probably find cash a more
attractive alternative than cryptocurrency. Do you agree that
cash is less traceable than cryptocurrency?
Mr. Levin. Indeed, Senator, cash is far less traceable than
cryptocurrency for the point that you point out. The other
thing about this is that it is the case that law enforcement
also has the permanence of the record when it comes to
cryptocurrency. The cases far back in the past can be solved
based on information that is collected in the future.
The problem with a cash transaction is that when I hand you
a $10 bill that is a completely ephemeral event, and that is
never captured forever. And so your prosecutors are able to
actually leverage the permanence of the blockchain to have
conclusive evidence of the type of illicit activity that we are
worried about, which is another deterrent against criminals
using it.
Senator Hagerty. Yeah, I completely agree. Yet when you go
back to thinking about cash, I do not hear anybody saying that
we ought to outlaw the use of cash. Do you hear that? I do not
think so.
In reality, the mischaracterization that crypto is the Wild
West of illicit finance, you know, I would hate to see that be
used in a way to open the door to drop a morass of regulation
on an industry that poses so much potential for America and for
our competitive advantage.
Mr. Levin, I would like to continue to follow up there.
There is a lot of discussion here on Capitol Hill that Congress
needs to craft legislation to make it harder to use
cryptocurrency to evade sanctions. One of your firm's
specialties is tracking cryptocurrency transactions and
monitoring potentially illicit activity. So hypothetically, how
would someone trying to evade sanctions convert their
cryptocurrency holdings into fiat without interfacing with the
banking system?
Mr. Levin. So, Senator, the question about how to move from
cryptocurrency into traditional finance requires a traditional
financial institution, and there are these interfaces that have
been, you know, the subject of anti-money laundering
legislation globally. And so I think, to your question, you
cannot move from cryptocurrency into traditional finance
without interfacing with one of those institutions that has the
regulatory obligations that protect us against its abuse.
Senator Hagerty. The sanctionable regulatory obligations,
just to be clear.
Mr. Levin. Yes.
Senator Hagerty. Mr. Mosier, just very quickly, I think
that there has been a lot of attention paid to the possibility
that digital assets are undermining America's sanctions regime,
and I would like to get your perspective on what Congress can
or should do to help authorities and firms in the crypto space
more effectively fight illicit finance.
Mr. Mosier. Thank you, Senator Hagerty. Yes, I think the
most important thing that Congress can do is help provide
clarity. There are a lot of crypto firms out there that would
like to be certain in that they are complying with the law, and
I think there is a lot of debate, particularly across the SEC
and the CFTC, about what exactly is needed to be in compliance.
Senator Hagerty. And who is in charge of compliance?
Mr. Mosier. And who is in charge of compliance. And I think
there are a lot of people that really want to have a business
model that is successful for everybody, and, by the way, that
means a safe financial system that people feel comfortable
putting their money into, and they are just looking to know
``what exactly should I do, what is the standard and what
should I meet?''
Senator Hagerty. I appreciate your point on certainty and
clarity. Thank you, Mr. Chairman.
Chairman Brown. Thank you, Senator Hagerty.
Senator Tester, from Montana, is recognized.
Senator Tester. Thank you, Mr. Chairman. I want to thank
you all for being here, both virtually and in person. I am
going to start out with a question that has already been
probably answered but I just want to hear it from your lips to
my ears. And that is, do you think Putin and the oligarchs are
using cryptocurrency to get around sanctions? Yes or no.
Mr. Levin. Sorry. Is that a question for me, Senator?
Senator Tester. It is for you first, Mr. Levin. I am going
to go down the list, but very quickly.
Mr. Levin. Thank you, Senator. So we have not seen evidence
of Russia or Putin systematically using cryptocurrencies to
evade sanctions at this moment in time.
Senator Tester. OK. Mr. Mosier, would you like to respond
to that?
Mr. Mosier. Thank you, Senator Tester. No, in fact, I will
quote my successor, as counselor to the Deputy Secretary of the
Treasury, who recently said, ``You cannot flip a switch
overnight and run a G20 economy on cryptocurrency. There just
isn't the liquidity.''
Senator Tester. OK. And Mr. Chobanian?
Mr. Chobanian. I would say no, and the reason for that is
they tried to ban crypto for a long, long time, and the only
time when they said that probably they should reconsider their
decision is after the war. So I would say most definitely no.
Senator Tester. Thank you. And Mr. Stansbury, do you have
an opinion on that?
Mr. Stansbury. I would just add that I think there might be
a difference between individuals engaging in that activity and
whether it is occurring at scale. I think the possibility is
certainly there, which is why DOJ has recently set up a task
force to address just that issue.
Senator Tester. OK. And so, Mr. Levin, I think that you
pointed out that the reason why crypto is safe is because it is
totally trackable. Correct?
Mr. Levin. The inherent transparency does provide
advantages, yes.
Senator Tester. So we had folks that came after the
Colonial Pipeline with ransomware, and we got 85 percent of the
money back. Why did we not get 100 percent, if it is totally
trackable?
Mr. Levin. That is a great question. I think when it comes
to the ability to see the money versus seize the money, it is a
distinction which is not always the case. There was a 100
percent degree of transparency about where the money was
actually going, but in terms of actually the operation to be
able to recover the funds, you know, that is not always 100
percent possible.
Senator Tester. Mr. Stansbury, the question for you is in
your statement you had talked about the fact that is very
difficult to connect people with the payments when it comes to
illegal activity. Is that pretty much what you said? I was just
curious.
Mr. Stansbury. Yes, Senator, thank you. I was making the
point that it can sometimes be difficult to connect the last
two dots in terms of linking cryptocurrency payments to
specific individuals. Firms like Chainalysis can do a fantastic
job of looking at patterns and giving law enforcement a lot of
tools to follow financial transactions on the blockchain, but
ultimately you have to connect those things to real people, and
that is not always available just through analytics.
Senator Tester. All right. And so if you cannot connect
people with payments, how can you hold people accountable for
illegal activity?
Mr. Stansbury. There are a lot of tools at law
enforcement's disposal, but, you know, things have to go right.
I think a good example is the recent seizure announced by DOJ
last month, the record seizure of cryptocurrency payments. Now
those are allegations so I want to be careful and say that.
But they worked for 5 or 6 years to connect the dots, and
even though they were able to identify certain payment patterns
by those individuals who were in possession of Bitcoin that
came from the hack of an exchange back in 2016, it really took
sort of traditional law enforcement tools like search warrants,
and it also depended on the fact that, for example, the
defendants were living in plain view in New York City, and they
were using cloud storage accounts that were within the reach of
U.S. law enforcement so they could serve search warrants on
those accounts.
So it is really fact dependent, Senator, on whether law
enforcement is going to be able to sort of get that last piece
of the puzzle.
Senator Tester. Well I certainly appreciate all your
perspectives, and I can tell you that the reason, at least from
my perspective, why cash is a whole lot different than
cryptocurrency is it takes a lot of suitcases to transfer the
kind of cash that you are talking about, what I believe is a
simple press of a button in crypto.
I think this is a great hearing. I think that there is far
more information to be fleshed out there, and I want to thank
the Chairman for holding it.
Chairman Brown. Thank you, Senator Tester.
Senator Smith, from Minnesota, is recognized.
Senator Smith. Thank you very much, and I agree, Senator
Tester, this is a very interesting hearing and I am grateful
for our panelists for being here today.
So as we focus on controlling the illicit use of crypto
there is this discussion about how we should regulate it, and
how we should regulate digital assets in order to control the
bad guys. And so to a certain extent it seems like what we are
trying to do is to fit this new technology into existing
regulatory frameworks. So, for example, should we think of
digital assets as commodities in the jurisdiction of the CFTC,
or should we think about it as security in the jurisdiction of
the SEC, and maybe neither of those frameworks are the right
way of thinking about it.
But it seems to me that without some regulatory framework,
without a cop on the beat, so to speak, we are at a great
disadvantage in terms of cracking down on illicit use. So I am
not advocating for one framework versus the other, but I am
wondering--Mr. Levin, I am going to ask you this--I guess the
first question is what impact is there when, with a lack of a
clear regulator or regulatory framework, what impact does that
have? Let me ask you that first.
Mr. Levin. Thanks, Senator, and I share the concern that
you have when it comes to the clarity point. And the impact of
that on really the U.S. and the industry in general is that
there is less funding available, there are fewer innovators
actually going to work on this type of technology inside this
jurisdiction, which gives rise to the possibility that the
financial rails that are going to govern the 21st century are
going to be built outside of this country and beyond our
ability to have real insight, and the records of what is
actually happening in these types of new payment systems.
So I think the twofold is that we are going to lose out on
a very large economic promise, which is that this is an
economic industry that will create dynamism in this economy,
but second, we may lose out on the national security risk, that
we lose some visibility into what could be conducted on these
rails if they are built outside of this country.
Senator Smith. So if we are building a regulatory framework
that becomes a standard, then we have, by definition, more
national security benefit because we understand what those
standards are and we have more control.
Mr. Levin. Yeah, that would be correct, Senator.
Senator Smith. And it is sort of a truism of business, in
general, broadly speaking, when they think about regulation
that they will say, ``I just want to know what the rules are so
that I can follow them, and I want an even playing field,'' the
good businesses, the businesses that are operating above board.
It seems like that would be pretty much the same view if you
look at digital assets and crypto.
Mr. Levin. Yes, Senator, indeed. So the industry in this
country has done a lot of work on collaborating with regulators
on the different proposals that are being put in place. They
participate extensively in public consultation on this type of
regulation, and there have been a lot of efforts on educating
regulators, policymakers on really the unique attributes of
cryptocurrencies and what potential it has for really novel
types of oversight.
And I think one of the points here is that the transparency
of cryptocurrencies and the availability of the data means that
there can be greater oversight for these financial regulators
in novel ways that actually this Committee has been very
focused on achieving in broader financial services and actually
setting up a regulatory architecture that can endure over time
but costs less for business and is more effective.
Senator Smith. And Mr. Stansbury, to the same extent that
having an understandable regulatory framework can create a fair
and even playing field for good actors, how do you respond to
this if you are trying to figure out how to crack down on the
bad actors? What impact does the lack of a clear regulator or a
clear regulatory framework have if you are trying to take
advantage of the system, like we know some are?
Mr. Stansbury. Thank you, Senator. Yeah, I think the lack
of clarification lends itself, obviously, to the sort of murky
situation that we have now where we clearly have a group of
exchanges working in the cryptocurrency world that are
trustworthy, doing the right things, and that are providing the
kind of know-your-customer information and things that are
helpful to prosecutors and investigators. But the lack of
clarity also contributes, I think, to a very large ecosystem of
institutions that are working outside that.
And so I think the clarity would help, but also I think
enforcing the Bank Secrecy Act more aggresively could help, and
drafting maybe tighter rules on money transmitters like
cryptocurrency exchanges and payment providers. There has been
some movement like that, but those things help on the
enforcement front because it helps push people toward the
legitimate exchanges, I think.
Senator Smith. Thank you very much. Thank you, Mr.
Chairman.
Chairman Brown. Thank you, Senator Smith.
Senator Warren, from Massachusetts, is recognized.
Senator Warren. Thank you, Mr. Chairman.
The cryptocurrency market has exploded over the past few
years, with the volume of crypto transactions reaching nearly
$16 trillion last year. That is up about 600 percent just from
2020.
Now most of that growth has been driven by speculation and
gambling, but we also know that crypto provides a new payment
option for criminals and cheats, and it is how those who attack
our systems with ransomware collect their money, with the least
risk that they will be caught. In fact, according to one of our
witnesses who is here with us today, about three-quarters of
the money collected in ransomware attacks last year went to
Russia-linked actors. So Russians certainly know how to run
illegal scams through crypto. And we know that other countries
have used crypto to evade sanctions.
Mr. Levin, your company tracks illicit finance in crypto.
Do you know which countries have already used crypto to evade
sanctions?
Mr. Levin. Thank you, Senator, for the question. It is an
incredibly important issue and something that we spend a lot of
time researching and detecting, actually.
So when it comes to sanctions evasion the transparency of
the blockchain actually does----
Senator Warren. Excuse me. My question was do you know the
three countries that have already used crypto in order to evade
financial sanctions?
Mr. Levin. We have detected the use of cryptocurrency in
Venezuela, Iran, and North Korea.
Senator Warren. OK. And just last week, FinCEN, the Federal
agency responsible for identifying financial crimes, issued a
warning that in light of the sanctions against Russia, quote,
``sanctioned persons, illicit actors, and their related
networks or facilitators may attempt to use crypto and
anonymizing tools to evade U.S. sanctions and protect their
assets around the globe,'' end quote.
Even so, the crypto industry claims that Russians cannot
use crypto to hide their wealth because the $3 trillion crypto
market is too small and too transparent for that to work.
So let us test that out just a little bit. Mr. Levin, let
us consider one of Putin's cronies, who already has a billion
or so in crypto, that he wants to hide from the Governments
that are enforcing sanctions on oligarchs. Now, can this
oligarch make it harder to trace his money if he hops from one
blockchain to another, if he deposits those tokens into a
couple of wallets that do not require him to provide
identifying information, and if uses a mixing service that
launders his money with other people's money?
Mr. Levin. Thank you, Senator. So the scenario that you
describe where an oligarch has $1 billion to be able to launder
requires significant amounts of liquidity to be able to
obfuscate that amount of money through the use of
cryptocurrency. In fact, many times we have been able to
identify----
Senator Warren. I am sorry. Let me just remind you of what
my question was again. What I am asking is about the tools that
are available. Now he may have to break it up into multiple
pieces of who knows, $100 million at a crack. But the question
I am asking is does hopping from one blockchain to another,
does depositing tokens in a couple of wallets that do not
require him to provide identifying information, and does using
a mixing service all make it easier for him to hide his money?
Mr. Levin. So, Senator, the answer to that question is no,
because the chain-hopping that occurs, you need to actually
provide the tokens, which in a transparent way allows you to
move across blockchains. We have actually got software that
allows----
Senator Warren. So you do not think chain-hopping makes it
any easier to hide your money? How about depositing tokens in
wallets that do not require identifying information?
Mr. Levin. You can always split the money up into wallets
that do not require----
Senator Warren. And that would help hide the money?
Mr. Levin. But that does not remove the record of where the
money actually sits----
Senator Warren. The question I am asking is does it make it
harder to track the money?
Mr. Levin. No. So it does not make it harder to track the
money because there is----
Senator Warren. And using a mixing service, you are telling
me, does not make it harder to launder money?
Mr. Levin. The daily liquidity value of mixing services
globally is about $30 million. And so, therefore, it would----
Senator Warren. So he might have to do this day by day?
Mr. Levin. And we have done extensive work in tracking
large sums of money through mixers that have led to the arrests
of people and the disruption of their activities.
Senator Warren. You know, I am actually a little surprised
by your answer, since you charge a lot of money to untangle and
track assets through the system, and the system keeps
developing more ways to obscure that money, and that is part of
what you advertise.
But I want to get on to a question with Mr. Stansbury. You
are a former Assistant U.S. Attorney who has led major
cybercrime and money laundering investigations. So let me ask
you, is it possible that the oligarch, my hypothetical
oligarch, could now buy and sell some of the things that he
wants--diamonds, art, maybe even real estate--without ever
needing to put his money into the formal banking system, which
also would make it harder for law enforcement to catch him?
Mr. Stansbury. Thank you, Senator. Yes, it is theoretically
possible in today's market. Obviously, it is hard, but at least
if he is able to go to a friendly jurisdiction and use
cryptocurrency exchanges or some other platform that is not in
compliance with internationally recognized anti-money
laundering standards, as you have suggested, that is possible.
There is also some reporting recently of jurisdictions being
friendly for some purchases of real estate and other items
through cryptocurrency.
Senator Warren. So no one can argue that Russia can evade
all sanctions by moving all its assets into crypto, but for
Putin's oligarchs who are trying to hide, well, a billion or
two, a few hundred million, crypto looks like a pretty good
option.
And that is why I am introducing today my Digital Asset
Sanctions Compliance Enhancement Act, along with nine members
of the Banking Committee, including the Chairman of the Senate
Armed Services Committee, the Chairman of the Senate
Intelligence Committee, and the Chairman of the Defense
Appropriations Subcommittee, and several other Senators. This
is a bill that would authorize the President to sanction
foreign crypto firms that are doing business with sanctioned
Russian entities, and authorize the Secretary of the Treasury
to act.
Thank you for being indulgent, for letting me run over on
time. I appreciate it.
Senator Toomey [presiding]. Senator Lummis.
Senator Lummis. Thank you, Mr. Chairman. I appreciate your
appearing here today. Thank you for joining us.
Mr. Mosier, I want to ask you a straightforward question,
based on your law enforcement experience at the Treasury
Department. If an investigator was forced to choose between
investigating an illicit finance case involving cash or digital
assets, which do you believe most would choose, and why?
Mr. Mosier. Thank you for the question, Senator Lummis. I
think there is no question--and this comes from time at the
Department of Justice and also being the head of enforcement at
OFAC--it is far, far faster to get to the critical point that
you need to dig deeper with cryptocurrency, given the nature of
the public ledger. This is for several reasons. One, you have a
public, immutable ledger.
So if you take the example of when OFAC designates an
address, within hours mathematical heuristics from Chainalysis,
TRM, Elliptic, all these tools out there, are quickly building
out all the public ledger networks that are associated with
that address through cospending and other relatively
mathematically certain ways of at least knowing what the
association is. In the fiat world, you seen an address and for
the next 3 years you do Mutual Legal Assistance Treaty requests
and hope that you get something back. You guess what regional
banks might be involved, based on the customers you think it is
going to be, and send subpoenas, and hope that they come back.
And then you manually try to associate addresses with entities.
It is just exponentially faster.
Senator Lummis. Thank you. Mr.--is it Le-VIN or LEV-in?
Mr. Levin. Senator, I respond to either, but it is Levin.
Senator Lummis. Levin. OK. Thank you. Chainalysis found
that approximately 0.15 percent of all digital asset
transactions were related to illicit finance in 2021. Is that
correct?
Mr. Levin. Yes, 0.15 percent. Yes.
Senator Lummis. The United Nations recently estimated that
money laundered in the traditional financial system is between
$800 billion and $2 trillion in U.S. dollars a year. So how
does that compare with digital assets?
Mr. Levin. Thanks, Senator. So just to put the like-for-
like comparison, it is important to look at the percentages as
estimates. And so in the traditional financial sector, the OCED
and IMF and others, estimates somewhere between 2 to 5 percent
of world financial flows are related to money laundering and
illicit flows, comparing that to the 0.15 percent when it comes
to cryptocurrencies.
Senator Lummis. So clearly cryptocurrencies have a smaller
illicit use than fiat currencies.
Mr. Levin. Yes, Senator, that is correct.
Senator Lummis. OK. Is Mr. Chobanian online?
Mr. Chobanian. Yes, I am.
Senator Lummis. Oh, excellent. I have a question. Hi, Mr.
Chobanian. I so appreciate your being here. I want to ask you
about the record sums of money that the people of the world
have donated to Ukraine using digital assets over the last few
weeks. How long did it take for you to set up the
infrastructure to begin accepting donations, and how long does
it take for the Ukrainian Government to begin to use those
donations?
Mr. Chobanian. Thank you. So the setup was about 10
minutes. The hardest part was to actually put the addresses on
Twitter because we had to go through the bureaucracy of who is
in charge of a Twitter account of Ukraine. And in terms of
usage, the minute the crypto landed on these addresses, the
Government could use them, so immediately. No bureaucracy here.
Senator Lummis. So how long and how burdensome would it
have been for you to accept donations using traditional forms
of payment from other countries, including wire transfers?
Mr. Chobanian. If I can remember and recall correctly, I
think it took National Bank about 10 days to post the IBAN and
the rest of the correspondent addresses needed to wire the
money to Ukraine.
Senator Lummis. So digital assets have made an important
difference to the defense of Ukraine. Is that true?
Mr. Chobanian. I am sorry, differently. We actually
received the first humanitarian aid on the second day after we
received the first crypto, so we spent it immediately, and the
next day the goods were in Ukraine, less than 24 hours. Is that
the answer?
Senator Lummis. That is the answer, and I am so pleased you
were willing to take the time to be with us today, because
while a lot of attention has been paid here in Congress to
whether the Russians could use digital assets to evade
sanctions, there has been very little attention paid to how
much the existence of digital assets have benefited the
Ukrainians in being able to get badly needed supplies.
So I am deeply grateful to all of our witnesses today.
Thank you very much, Mr. Chairman. I yield back.
Senator Toomey. Is Senator Warner with us remotely?
Senator Warner. I am, Senator Toomey. I am here.
Senator Toomey. Senator Warner is recognized.
Senator Warner. Thank you, and I do appreciate you and the
Chairman holding this hearing, and I think there is a little
bit of a conundrum here, as somebody who has been looking at
this issue for some time, as Chair of the Intelligence
Committee. I am not sure the kind of positing of this is an
either/or circumstance is the correct posit. I believe there is
some value in digital assets. I think we need to continue to
explore it.
And, you know, candidly, I want to acknowledge Senator
Lummis' last point with our witness from Ukraine. This has been
a way to move assets to the Ukrainian people in a relatively
fast way, and I want to commend that.
But I also want to start--and I am actually proud to be one
of the sponsors, along with Senator Warren, because I am hugely
concerned that because of some of this ease of transferring of
assets that has helped the Ukrainian people, as we have seen
from some of the press reports and we litigate the Reuters
article, that that same ease and, frankly, lack of transparency
has allowed, and will allow Russian oligarchs--and I hope we
can move further and not just sanction the top oligarchs but we
ought to sanction the whole Russian Duma for being complicit
with Putin's illegal invasion of Ukraine. But that same ease is
allowing conversion of fiat currency to crypto, to then
potentially buying properties in Nations around the world that
have accepted this.
But I want to start with Mr. Stansbury, because on the
whole question of ransomware, I respectfully disagree very
strongly with Mr. Levin's analysis of 0.15 in terms of illicit
payments, and again, one of the reasons why we passed--and I
appreciate everybody's support on this--a mandatory cyber
reporting bill. We only had about a third of the cyber
incidents being reported to the Government that need to be
reported, so can share, frankly, with our private sector
partners. But I can assure you, and we saw this with the
Colonial Pipeline incident, that I believe the volume of
ransomware that is paid in crypto assets, Bitcoin, et cetera,
is exponentially higher.
Mr. Stansbury, the continued growth and profitability of
ransomware, do you see that connection to the ability and the
liquidity brought about by cryptocurrencies, and that
interaction? I think it is, again, much higher than what the
other witness testified to.
Mr. Stansbury. Thank you, Senator Warner. I would agree,
and, in fact, the FBI and other agencies have indicated that
ransomware incidents are much, much higher than all of those
that we hear about and know about, obviously, because not all
of them are reported, and I think we have a lot of unknowns.
And in terms of where the trends are going, I think that
probably tells you a lot of what you need to know. Last year,
in October, in a FinCEN report, it was revealed that SARs
filed, in I think 2021, were projected--in the first half of
2021--were projected to have a higher ransomware-related
transaction value than SARs filed in the previous 10 years
combined.
So I think the trend tells us that cryptocurrency works.
The fact that it is the exclusive tool for ransomware actors I
think tells us a lot. So I would look at that evidence as much
as anything else.
Senator Warner. And I completely agree with that, and
again, I think one of the things that this new law will have is
cyberincident reporting but also there will be some ransomware
reporting, so we will have, candidly, better data.
And the notion, frankly, that the Russian Government, in
one effort, did help us potentially identify some of the
Colonial Pipeline ransomware criminals, using crypto as their
payment methodology sure as heck means the Russian Government
knows how to use this currency, knows how to use this payment
method. And I think we need to make sure there is not the
leakage of these sanctions.
We all want to sanction the bad guys in Russia. I think we
ought to broaden those sanctions, and I think the legislation--
and I hope we will be able to work through this and gain
broader-based support, that Senator Warren and a group of us,
eight of us, nine of us, have put together, will ratchet off
that ability to evade those critically important sanctions.
I know I have gone over time, but I hope we can come back,
Mr. Chairman, and revisit this issue in a broader way. Thank
you.
Chairman Brown [presiding]. Thank you, Senator Warner.
Senator Cortez Masto is recognized, from Nevada.
Senator Cortez Masto. Thank you, Mr. Chairman, and thank
you to the panelists.
Let me associate myself with some of the comments by
Senator Warner, and let me start with this to the panelists.
Mr. Levin, let me start with you. What are the illicit
finance risks of digital assets? We are hearing from law
enforcement agencies that there are still concerns around the
use of cryptocurrency, that it is still an attractive vehicle
for illicit financial activity. What do we need to be aware of?
Mr. Levin. Thank you, Senator. The law enforcement agencies
that are responsible for investigating these illicit flows need
more resources to be able to get their arms around this new
technology. They have to adapt a whole new way of policing, and
they need new techniques and methods to be able to get after
these types of crimes. Particularly in the realm of cybercrime
and cyber-enabled crime, cryptocurrencies have been used to
effect by those actors. But with the appropriate tooling we
have seen successes when it comes to everything from the types
of money laundering infrastructure that helps facilitate these
types of crimes.
Alexander Vinnik is sitting in jail in France, having
started BTC-e, which was one of the major sorts of Russian
money laundering operations, in a historical sense. And so, you
know, cryptocurrencies with the appropriate techniques from law
enforcement agencies can actually combat these types of illicit
flows.
Senator Cortez Masto. And Mr. Mosier, do you feel the same
way?
Mr. Mosier. I do, Senator Cortez Masto. Thank you for
asking. And actually I just want to underscore one part of what
Mr. Levin said. As the Acting Director of FinCEN and Deputy
Director, I pushed and pushed and had the same argument with
the Office of Management and Budget and the White House
repeatedly saying there is an enormous amount of data here and
transparency. We need the tools to be able to do it.
What I got were questions of, ``Why do you need more than
one?'' or ``Why do you need more than one license?'' ``Can't
you just call somebody else who has one and ask them to look it
up?'' And I had to explain to them, as the former in-house
counsel at Chainalysis, I am certain that is a violation of
license terms to simply not buy a license and have someone else
look it up for you.
And actually, part of the benefit of having a public ledger
and the ability to monitor in real time to go after the people
that are doing these things is that you need the tools to do it
in real time to benefit from this. We do not have to wait 3
years for a Mutual Legal Assistance Treaty, but we do need the
resources to do it.
Senator Cortez Masto. Right.
Mr. Mosier. Thank you.
Senator Cortez Masto. No, I appreciate that, because I also
know that the concern--I have worked in law enforcement for a
number of years addressing money laundering issues, right. The
drug cartels in Mexico, they are always trying to figure out
how they can move cash, whether it is actually a briefcase full
of case, then to debit cards, to some other form or system. And
we are always trying to follow the money, as you said, and
track it as quickly as possible to lead us to that criminal
activity or terrorist activity, whatever it is.
Do either of you think that digital currency or
cryptocurrency is going away?
Mr. Levin. Senator, I do not think cryptocurrency is going
away. In fact, I think that it will continue to become a more
important financial rail for commerce more broadly. And I think
what you are seeing is that at the beginning of
cryptocurrencies we had cryptocurrencies that represented
themselves in these communities that use them.
But increasingly you see it intersecting with a broad range
of industries. And so if you look at the art market today or
you look at the music industry, or even how people manage their
data for their electric vehicles, there are ways in which these
types of value are being represented on these cryptographically
secure ledgers to introduce brand new ways of conducting
markets. So I do not believe it is going away.
Senator Cortez Masto. Thank you. And Mr. Stansbury, any
comment to add to the questions that I have just asked?
Mr. Stansbury. No, Senator.
Senator Cortez Masto. Thank you. And let me also say this
to Mr. Chobanian. First of all, let me just say our thoughts
are with you and your family and all Ukrainian citizens right
now as they fight the cruel and deadly invasion ordered by
Putin. And thank you for your comments around the benefits that
you are seeing right now with respect to the cryptocurrency and
the support for Ukraine. But is there concern that you have
about how the people in Russia are opposing Putin's murderous
regime by the use of cryptocurrency?
Mr. Chobanian. That is correct. They are running away from
ruble, and most of them are running away physically from
Russia. And the only way for them to exist outside of Russia
right now is actually cryptocurrency. You are not being able to
buy a house or a car but at least you can survive.
Senator Cortez Masto. Thank you. I know my time is up. I am
going to submit some of my questions for the record, the
remaining of them. But this is such an important panel. Thank
you all for being here.
Chairman Brown. Thank you, Senator Cortez Masto.
Senator Reed, from Rhode Island, is recognized.
Senator Reed. Thank you very much, Mr. Chairman, and thank
you, gentlemen, for your testimony.
I think one of the premises we are beginning is that you
can divide the world into good actors and bad actors, and the
bad actors can use cryptocurrency with great efficiency and
great effect. The good actors, they are good people, but we are
focused on the bad actors. And I think in Chainalysis you
basically identify wallets that are connected to a bad actor.
How do you do that, Mr. Levin?
Mr. Levin. Thank you, Senator. So we track all
cryptocurrency transactions, so not just the good actors and
not just the bad actors. We track the entire ecosystem to be
able to map really which services are present, putting those
transactions into these ledgers and facilitating the movement
of currency.
And so when it comes to illicit activity we track
ransomware actors and all of their enablers by actually
gathering intelligence about those ransomware campaigns. We can
actually also make transactions with these types of actors. We
have a team of about 50 people that are specialist researchers
that conduct collection on these types of illicit activities
and specialize in specific types of crime, to be able to label
that in our system so that not only can law enforcement
partners investigate those types of crimes but our private
sector customers can screen for that type of risk in these
transactions, and prevent it, and report them as suspicious
activity reports to FinCEN.
Senator Reed. So effectively you are employing human
intelligence to analyze the activity that is going on, and then
you are identifying the bad actors and communicating that to
your clients and others. But how effective are you in
identifying the bad actors since there is so much anonymity in
the system?
Mr. Levin. Thank you, Senator. Yes, so the way in which
this works is that not only do we have the ability to collect
human intelligence on this activity but actually because of the
transparency we actually can further the identification of the
activity beyond the individual incident that we have detected.
And so maybe just to go back to the question about
ransomware reporting from Senator Warner is that actually we
tend to have higher estimates of the amount of ransomware
revenue being generated, because we can take a solo incident of
ransomware reporting and broaden that out to be able to
identify all of the activity that that campaign has been
running.
So I think it is important to see that we only need to see
them once, and we can then unravel the financial network, due
to the completeness of it and the transparency.
Senator Reed. Just a final quick question. Can you reach
down to identify real individuals?
Mr. Levin. So, Senator, we do not collect information about
individual people. That is collected by the regulated financial
institutions that have to have their KYC processes, and then
law enforcement typically uses their legal authorities to go
and further their investigation and collect that piece of
information.
But the interesting thing is that the investigation can
progress a lot faster and you can complete the picture of the
entire financial network when it comes to cryptocurrencies
without actually get down into the individual identity.
Senator Reed. Just another quick question. Our assumption,
I think, is that the oligarchs and the bad actors of the world
deliberately have put in their portfolios cryptocurrency. That
is an avenue they want to exploit. Is that your sense too?
Mr. Levin. Senator, I think that assumption, you know, may
be something that we can easily have a hypothetical scenario in
which that is the case. I think when you look at the actual
data about the amount of wallets that are present, and you look
at the concentration of cryptocurrency and its use, I think the
most sophisticated actors in Russia when it comes to
cryptocurrency have been largely around sort of large
cybercrime rings and not sort of large sums of money with
Russian oligarchs.
Senator Reed. Thank you. Just a final question, and I do
not expect an answer. But to what extent do we have to worry
about cryptocurrency displacing fiat currency so that there is
really no way for the Federal Reserve, for example, to control
or attempt to control the economy?
Mr. Levin. Yeah, Senator, it is obviously a question that
requires deep inspection. But the quick answer is that
cryptocurrencies represent global communities and new ways of
commerce, and I think it is more beneficial to view
cryptocurrencies as truly a technology that enables a lot more
industries and a lot more business models that can change the
way--you know, away from, say, rent-seeking organizations to a
much more distributed economy. And so I think that would
complement, actually, the issuance of the dollar.
Senator Reed. Thank you very much. Thank you, Mr. Chairman.
Chairman Brown. Thank you, Senator Reed.
Senator Van Hollen, of Maryland, is recognized.
Senator Van Hollen. Thank you, Mr. Chairman. I thank all of
you for your testimony, and I want to thank the Chairman and
Ranking Member for holding this series of hearings of
cryptocurrency, because I think everybody is working to get up
to speed on the public policy challenges. And clearly there are
benefits, as has been described in this hearing, and there are
also risks.
And I think it is fair to say, and I have been trying to
follow the testimony from my office, is that for people who
engage in ransomware, I mean, cryptocurrency is the preferred
method of payment today. That happened in Baltimore City.
Baltimore City was the victim of a ransomware attack. They
insisted on payment in Bitcoin. That was the case in the
Colonial Pipeline. I mean, we recovered some of it, a lot of
it. But is that not a fact, that right now at least the people
perpetrating these crimes perceive this method of payment to be
the best in terms of hiding their identity? Mr. Levin.
Mr. Levin. Thank you, Senator, and yes, I was very
intimately familiar with the Baltimore case, where ransomware
has affected people's lives.
So when it comes to being able to detect this, and the
reason why criminals actually use it, is they are economic
actors and so they are looking for methods that maximize
profitability first, not necessarily their anonymity. And so
cryptocurrency has been used in ransomware cases because it is
easy to acquire Bitcoin, it is easy to send that Bitcoin
anywhere in the world, and that is why it has risen to
prominence inside ransomware.
But those actors typically feel like they are beyond the
reach of the law, and that has systematically become not the
case as we have become a lot better at detecting the entire
financial network that actually enables ransomware.
And so if you look at the NetWalker case, where an
affiliate of a ransomware campaign was arrested up in Canada,
that was made possible because we can see the entire business
model of these ransomware campaigns on the blockchain, and so
we can identify those enablers and shut them off, which would
start to disrupt the amount of ransomware that affects this
country.
Senator Van Hollen. Right, and a lot of the testimony here
has been that because of the blockchain technology we are
better able to at least track the identity of a digital wallet.
Then there is always the challenge of figuring out who is
behind the digital wallet.
But in the Colonial Pipeline case, as I understand it, the
FBI was able to get the key to the digital wallet. Is that your
understanding?
Mr. Levin. Senator, yes, that is my understanding too.
Senator Van Hollen. Which is a different method of
recovering the payment than hacking into the system, or does
that amount to the same thing?
Mr. Levin. So, Senator, the details of all of the way in
which the FBI managed to retrieve those funds are not
necessarily in the public domain, but the way in which this
occurs is access to the key itself rather than hacking into the
entire system. The Bitcoin system is secure. Someone's ability
to hold those keys can be a vulnerability that could be
exploited in those types of cases.
Senator Van Hollen. So I want to press this point a little
bit because it is getting to the other side of the equation,
which is on the one hand people say, well, cryptocurrencies are
a secure way for someone, a criminal, to hide their assets, but
we also have cases like the Colonial Pipeline but also cases
where crypto exchanges have been hacked, right? I mean, there
are numerous examples of crypto exchanges being hacked. Is that
not the case?
Mr. Levin. Yes, that is the case, Senator.
Senator Van Hollen. And, you know, this Committee has had a
conversation about if you are an investor in a cryptocurrency
what is your recourse if a cryptocurrency exchange that you
have invested in gets hacked. Are you able to recover your
assets? And right now there is no protection.
Can you just speak, though, to the question of
vulnerability and hacking of the crypto systems, because that
seems to be another area where, on the one hand we say they are
very difficult to penetrate, but increasingly this seems more
like the arms race, right, where people just try to leap ahead
of the technology. What is the vulnerability in terms of
hacking?
Mr. Levin. Thanks, Senator, and it is an incredibly
important issue, particularly for consumers. So when it comes
to the ability to hack into exchanges, these are financial
intermediaries, where someone is holding funds on behalf of
someone else. And in those instances, that is where regulation
can come in and be very helpful in establishing sort of best
practices and standards by which those exchanges and financial
intermediaries should hold funds the same way that other
financial institutions do.
And increasingly what you see is, you actually see the
largest custodians in the world--you know, the Bank of New
York, Mellon--actually come into crypto custody to be able to
offer really robust custody solutions, the same way that we
have for traditional securities and other financial
instruments.
And so I think what we will see is that there is an
increase in the maturity of the types of actors actually
entering this market, where those types of vulnerabilities, at
least on the exchange level, will start to be closed. We do see
vulnerabilities starting to emerge in other parts of the
ecosystem that do also need some more attention, but this is
something that matures over time with the technology and also
with the actors that get involved in the industry.
And so I think you are seeing a very positive direction
with that, with the types of actors that are now stepping into
the space.
Senator Van Hollen. Thank you. No, I agree with the Ranking
Member's observation that this is an area that is here to stay
and does require regulation, and we need to be very sort of up
to speed on how we go about doing that. But this is one of the
areas, it seems to me, where consumers beware and where
regulation could be important.
Thank you, Mr. Chairman.
Chairman Brown. Thank you, Senator Van Hollen.
Senator Sinema is recognized from her office, from Arizona,
from her office.
Senator Sinema. Thank you, Mr. Chairman, and thank you to
the witnesses for being here today.
Arizonans and Americans stand with the people of Ukraine in
opposition to Russia's illegal war. Just yesterday we heard
from President Zelenskyy in a joint address to Congress about
the tools Ukrainians need to defend themselves. I am committed
to working with my Senate colleagues to deliver more military
equipment and humanitarian support to Ukrainians.
Our efforts to crack down on illicit financing are an
integral part of this strategy, as we work to break the supply
chains and the financing of Putin's war machine and to bring
this needless violence to an end.
Mr. Levin, thank you for being here today. Your company,
Chainalysis, has helped law enforcement and our sanctions
professionals track down illicit activity on the blockchain. I
appreciate your team's willingness to proactively brief my
staff last year on your company's work. For many, the idea that
your company could help connect illicit activity on a
supposedly anonymous platform to real people is surprising.
Your testimony spoke to this, but briefly, how does your
company manage to catch illicit activity in cryptocurrency
without attempting to break the blockchain or undermine the
integrity of the distributed ledger?
Mr. Levin. Thank you, Senator, for the question. The
ability for us to actually detect illicit activity on the
blockchain depends on our ability to actually see the
transactions. And so the public nature of the blockchain means
that our team can look at every single transaction that has
ever happened in the majority of cryptocurrencies. And we use a
combination of human intelligence, where we are actually able
to collect information and transact on these networks, with our
machine learning algorithms that allow us to tie different
transactions together to form a full picture of the way the
services are being used by people to use cryptocurrency
technology both for good and for bad.
And so, you know, what it takes is a team of specialists
and a lot of dedication over the last 8 years to build an
expertise in how cryptocurrencies can be abused, and we are
able to map out the full wallet infrastructure that these
illicit actors are using and provide that in our tools, both to
our private sector customers and the public sector.
Senator Sinema. Thank you. Some more sophisticated
criminals will use tactics like chain-hopping or make use of
mixer or tumbler services, where they will repeatedly move
transactions between and within cryptocurrencies to make it
harder to track funds. Do your company services offer an
effective response to these evasion tactics, and what is the
biggest limiting factor in the services that your company can
provide?
Mr. Levin. Thank you, Senator. So yeah, when it comes to
the issues of chain-hopping and mixing I will take them
separately.
So the ability to chain-hop often requires transactions
where you lock up a cryptocurrency asset on one chain to unlock
a rapt version on another chain, which is commonly referred to
as chain-hopping. That activity can be seen on the blockchain,
and we have released the ability to actually do cross-chain
investigations on our investigation platform. So that type of
activity actually does not provide the level of anonymity that
it may seem in the name of it.
When it comes to mixing services, we have, and not
necessarily completely publicly been seen to actually have
techniques that have the ability to de-mix certain
transactions. And so our research and development efforts
consistently keep with the way that people try and obscure
themselves in financial transactions, and we have actually seen
successes operationally, and we would be happy to follow up
with a separate briefing on that, to actually find ways to de-
mix transactions and find the individuals responsible at the
end of it.
So that is where we invest R&D efforts in continuing to
keep up and actually stay ahead, mostly, of the way in which
criminals use or abuse cryptocurrencies.
Senator Sinema. Thank you. Mr. Chobanian, thank you so much
for being here with us today, and I want to express my
continued solidarity with the people of Ukraine.
Yesterday, President Zelenskyy signed a law legalizing
cryptocurrency in Ukraine. Can you share a bit about why this
was important and how Web3 technologies are providing new tools
to help the people of Ukraine weather this illegal war and
unprecedented humanitarian crisis?
Mr. Chobanian. Hello. Thank you. So yeah, we have an
official law now. The next step would be to make changes to the
tax laws, and after that the law will be in place.
So basically what it does, it provides rules of the game
for the business in crypto on how we can operate, whether we
can open a bank account--obviously, we will be--what are the
rules for AML/KYC in regard to crypto, who is in charge,
whether us or in the banks, and so on and so on. So basically
within the year after we finish the war we are going to have
the full market. And I see that you are still discussing
whether to ban or allow crypto in U.S. I invite all U.S.
companies to come to Ukraine and open up there. You can use
Ukraine as a sandbox for U.S. I do not see a problem here.
Web3, it is basically going to change the world. It will be
the technology that we are going to use to rebuild my country,
namely the blockchain, because it shows the transparency of
everything, and that is the main topic that we have been
discussing for the past hour. Thank you.
Chairman Brown. Thank you, Senator Sinema.
Senator Daines is recognized, from Montana.
Senator Daines. Chairman Brown, thank you. I think this
topic is really important for us to be discussing, given the
war in Ukraine and recent comments. I strongly believe that
President Biden should never have given a green light on
Putin's Nord Stream 2 pipeline in the first place. In fact, I
had Ukrainian leaders in my office September 30th--I went back
and grabbed the memo--leaders from Odessa, Deputy Mayor, former
member of Parliament, current member of Parliament. They were
in my office pleading with us to stop the Nord Stream 2
pipeline. That was September 30th.
And while I am disappointed in my colleagues across the
aisle--and by the way, if you want to see what is going on in
Odessa just look at the latest press reports. They are gearing
up right now. They think that is going to be the next battle
city. They call it the Southern Capital of Ukraine, beautiful
port city, the Black Sea, and the Russians look like they are
headed there next, and they are hoping to save this beautiful
opera house, other great community there in Odessa. But it is
what it is at the moment.
I am disappointed that my colleagues across the aisle voted
against reimposing sanctions on the Russian pipeline earlier
on, despite the pleas from the Ukrainians. I believe we can all
agree that the sanctions that have been imposed thus far have
had a significant impact on the Russian economy, and that is
probably to say the least.
And while it is possible, it is unclear to me that digital
assets are being used by Russia to evade the sanctions in any
meaningful way. In fact, Treasury officials, including the
Financial Crimes Enforcement Network, have stated this to be
the case.
Legitimate crypto intermediaries, such as CoinBase, Gemini,
others abide by KYC and AML standards, are interactively
updating their standards to comply with the sanctions. Even
actors utilizing so-called dark web typically need to involve a
financial institution obligated to AML and sanctions
requirements to convert crypto assets into fiat currency.
At the same time, we have seen the Ukrainian Government
explicitly solicit crypto donations. On Monday, the Ukrainian
Government launched a crypto donation website, partnering with
FTX, Everstake, and the KUNA Exchange, based in Ukraine, which
will route donated crypto to the National Bank of Ukraine.
According to the Ukrainian Government, over $100 million in
crypto donations have poured into the website and other smaller
funds. This demonstrates, I believe, how powerful crypto and
other digital assets can be as a tool to revolutionize finance
in the speed at which donations can flow around the world.
Now turning to my questions. Mr. Mosier, can you describe
the process of converting digital assets into fiat, and related
to that, would someone trying to evade sanctions be able to do
this?
Mr. Mosier. Thank you for the question, Senator Daines. So
actually it is a complicated process because you have got to
get liquidity on the other side to begin with. Someone has to
want your rubles, and there are not a lot of people in the
world right now that want rubles. So first you have the market
problem.
Second, you have to find somebody that is willing to make
that trade that also feels comfortable that they are not
violating any sort of global laws that they are going to be
come after with, whether it is sanctions or domestic currency
controls. But most likely it is not going to be anyone outside
of Russia, that is for sure, because, first of all, no one
wants the ruble, and second, they have their own jurisdictions
enforcement to look at, and they have global sanctions in
probably the most united front that we have seen, certainly in
the Western Bloc.
Senator Daines. So drawing from your past experience at the
Office of Foreign Assets Control and FinCEN, do you think
blockchain technology provides certain benefits with regard to
the ease of detecting illicit financial flows?
Mr. Mosier. Absolutely, I do, Senator. And I think it is an
important question because there are two benefits to blockchain
technology that are important to think of from an American
perspective. One is the ability to much faster home in on what
is the bad actor that we need to worry about, because you can
follow the transactions almost indefinitely, and it is an
immutable public ledger, which means you can share that
information with partners around the world. But I think there
is another important piece here. We are sometimes talking about
privacy like it is an obstacle, but privacy is part of the
Constitution, as a matter of security and personal sovereignty.
That is not just something to slow down investigations. It is
something that we also want to protect vulnerable people. That
is why we have subpoenas. That is why there is court process
about this. And so what this does is instead of the dragnets,
that Senator Toomey had mentioned before, is you focus on what
we have already identified through activity----
Senator Daines. I would think the Ukrainians at the moment
would be very sensitive to the issue of privacy.
Mr. Mosier. Exactly. Absolutely, sir.
Senator Daines. In my remaining time I want to ask a
question to Mr. Chobanian. Mr. Chobanian, can you describe how
the Ukrainian Government has utilized the crypto donations that
have been received to date?
Mr. Chobanian. Sure. It is public information. We bought
helmets, bulletproof vests. We bought the first aid kids,
blood-stopping wound, something--I do not know what is the real
name of it--the scopes, and then we bought a lot of rations for
the soldiers, close to 500,000. We delivered money to, for
example, people in Mariupol, to people in Kharkiv, to people in
Sumy. So we actually sent money in crypto to those cities and
they managed to buy, well, first of all, changed it to local
currency or directly using crypto, to buy food and distribute
it among the citizens of those cities. So these are the
examples of how we are using money. Everything is transparent,
so it is fantastic. I would say it is a lifesaving thing. It is
impossible to do with a regular banking system.
Senator Daines. I am out of time, Mr. Chairman. Thank you.
Chairman Brown. Thanks, Senator Daines.
In the interest of time--Senator Toomey has one short
question--I will provide a question in writing to Mr. Stansbury
and then we will wrap.
Senator Toomey. Thank you very much, Mr. Chairman, for that
indulgence. The question is for Mr. Chobanian. Reading a
section of the legislation that Senator Warren referred to, one
of the things I am concerned about is it would impose the
equivalent of really secondary sanctions on anyone doing crypto
business with anyone from Russia. I know the intent is to go
after oligarchs, but it looks to me like it would have a hugely
negative impact on anybody in Russia engaged in any kind of
crypto transactions.
And so my question, Mr. Chobanian, is, could you just talk
to us a little bit about the overlap or the correlation between
those Russian people who use crypto and those who are opposed
to what Putin is doing, those who are maybe hostile to his
regime?
Mr. Chobanian. There is a very good correlation here. Well,
first of all, the people who are using crypto in Russia are at
least intelligent, they have money, and they understand
technology. So these are clever people, obviously. And they do
not watch TV, so they are not zombies of the regime, so they
understand what is happening around the world. They travel the
world. They see the Western world. They see how it is different
to the regime in Russia.
So these people are actually our closest friends, because
they oppose Putin just as much as we do. Unfortunately, they
cannot really do much because they do not have any insurance to
fight the regime, at least from their point of view.
So for us, yeah, it is very important--and I want to stress
this out again, that it is very important that we do not block
the regular people in Russia who are actually opposition within
Russia. We only have to go after the sanctioned list and
sanctioned people, and these people actually have much, much
more wealth accumulated. So for them it is probably the
average, you know, amount that they want to hide is in hundreds
of millions. For the regular Russians it is probably $1,000 or
$10,000, in equivalence.
So we have to make sure that we do not block these people
and we still allow for the opposition to survive, both within
Russia and outside. Because as you know, they cannot use Visa
or MasterCard outside of Russia right now, so the only means of
payments they have is cash or crypto. That is it. And
considering that all of the anarchy we see imposed in the world
right now, you can only exchange crypto to like, I think it is
$1,000 in most of the jurisdictions. So we have to make sure
that we do not, you know, cutoff these people from actually
surviving.
Senator Toomey. Thank you, Mr. Chairman.
Chairman Brown. Thank you, Senator Toomey. For Senators who
wish to submit questions for the record those questions are due
1 week from today, Thursday, March 24th. Witnesses, please, if
you can, you will have 45 days to respond to any questions.
Thank you again for the testimony from the four of you.
Thank you. And Mr. Chobanian especially, good luck to you.
This Committee is adjourned. Thanks.
[Whereupon, at 12:12 p.m., the hearing was adjourned.]
[Prepared statements, responses to written questions, and
additional material supplied for the record follow:]
PREPARED STATEMENT OF CHAIRMAN SHERROD BROWN
In 2019, a doctor's office in the Mahoning Valley in Ohio
experienced a disturbing attack: hackers locked the office computers,
making them unusable. They even faxed over a ransom note, promising to
unlock the computers if the practice turned over $75,000--in Bitcoin.
Not long ago, a Syrian group tied to al Qaeda put out a call for
donations to help buy weapons. Their social media post said that
supporters should ``donate anonymously with cryptocurrency.''
``Donate anonymously.''
A week ago today, the Justice Department announced an indictment of
two individuals who allegedly turned the profits of scams into
cryptocurrency. Then they'd send the crypto overseas, where it could be
turned back into cash.
This Committee has been examining digital assets to learn how they
work and the risks they create for consumers and the financial system.
We've also considered how digital assets can put workers' hard-earned
money at risk.
We're here today because crypto also can be used to make it easier
to commit crimes--facilitating illicit finance, terrorism, and other
forms of criminal activity, and threatening our national security. Bad
actors around the world--from hackers, scammers, and drug traffickers,
to terrorist groups and pariah regimes--have sought digital assets to
facilitate their crimes and intimidation.
In October 2020, under the last Administration, the Justice
Department concluded that, ``cryptocurrency technology plays a role in
many of the most significant criminal and national security threats
that the United States faces.''
To be sure, criminals have tried to cover their tracks for years
with sham accounting and banks that looked the other way. But there's a
simple reason that crypto appeals to crime rings and scam artists.
The dollar has safeguards to protect against crime and illicit
activity. Companies that deal with real money are required to know
their customers, and report suspicious transactions. They need to keep
records.
And even when crypto companies are covered by the law, too many
don't play by the same rules--especially offshore crypto operators that
aren't subject to U.S. law.
Shady crypto companies that fail to adequately monitor activity on
their platforms all but give criminals a green light.
Digital assets make it easier to move money under pseudonyms. They
make it easier for money launderers to use webs of transactions across
the globe to cover their tracks. And that makes it harder for law
enforcement to trace illicit funds.
And, the Financial Crimes Enforcement Network--FinCEN, the Treasury
bureau charged with safeguarding our financial system from abuse--
warned last week that Russian actors could even use crypto to get
around sanctions.
So sophisticated bad actors can use digital assets in ways that, if
they were using dollars, would likely raise red flags and get them
stopped in their tracks.
Last year, FinCEN fined a crypto exchange $100 million. For 6
years, the only identification the company bothered to get from
customers was an email address. That no-questions-asked approach
enabled more than $200 million in suspicious transactions.
But the problem isn't only shoddy compliance. It's more
fundamental.
We hear all the time about how ``innovative'' cryptocurrency is.
But criminals innovate, too. Crypto allows money launderers and
terrorists to do things they never could have done with dollars.
There's a whole new vocabulary to explain cryptocurrency illicit
activity.
Take what's known as ``chain hopping.'' That's when someone
launders money by changing funds from one cryptocurrency ecosystem to
another, to make it harder to track.
Or look at so-called ``rug pulls.'' That's when you set up a sham
digital asset project online, raise as much money as you can, scamming
investors, and then run off with all the cash.
Then there's Hydra, the world's largest ``darknet.'' It's an online
black market for drugs, stolen credit card numbers, and cyberattack
services, all enabled by crypto.
Our laws and law enforcement agencies need to keep pace with bad
actors that will exploit every opportunity.
And so far, with lax rules and little oversight, we've given them
plenty of those opportunities.
Crypto lets money launderers, hackers, and rogue regimes invent new
ways to hide and move money in the dark. It lets hackers and scammers
create new ways to steal or defraud. And if we allow them get out ahead
of us, our safety and security will be at risk.
Law enforcement is doing what it can. They use techniques to stop
cybercrime that didn't exist 30 years ago. Financial regulators
leverage new data and resources to expose fraud and manipulation in our
markets.
Crypto technology also embeds information that allows law
enforcement and national security officials to track and trace where
it's been--though not necessarily who owns it. That's where the tough
new money laundering and beneficial ownership law we enacted last year
will help.
But as these problems continue to grow, we can't sit on the
sidelines. We need to take a clear-eyed look at how these assets can
endanger consumers and our security.
Last month the FBI announced the creation of a new unit dedicated
to tracking down illicit crypto. The Justice Department is dedicating
more resources and staff to cracking down on crime using digital
assets.
We need to take a whole-of-Government approach to the problem, if
we're going to keep up with crypto in illicit finance.
President Biden understands that. His Executive order on crypto
assets last week will drive progress on this issue. It will jumpstart a
coordinated strategy from law enforcement and regulators to fight bad
actors who want to use crypto.
Ultimately, we can't just sit back and watch cybercriminals, rogue
regimes, terrorists, and others create a shadow financial system that
works for them.
The financial system should work for American families and small
businesses. Everything we do on this Committee has that goal in mind.
That means that we cannot let abuses of digital assets endanger our
financial and national security.
As crypto technology evolves, this Committee must continue to work
together to craft a way forward on these crypto policy issues. The
stakes are high, and the American people are counting on us.
______
PREPARED STATEMENT OF SENATOR PATRICK J. TOOMEY
Thank you, Mr. Chairman.
This hearing is about digital assets and illicit finance. While it
is appropriate to discuss and understand this topic, we also need to
work to ensure regulatory clarity for digital assets.
Digital assets, including cryptocurrencies and their underlying
distributed ledger technology, have tremendous potential benefits. As
the White House itself recently stated, the U.S. must maintain its
leadership in this space, which is why lawmakers and regulators should
do nothing to harm America's longstanding tradition of fostering
technological innovation.
Unfortunately, I am concerned that the lack of regulatory clarity
here at home is undermining that tradition and driving innovation
abroad. We need Congress to work together to enact a regulatory
framework specific to digital assets that provides this much-needed
clarity.
While today's topic is illicit finance, the real backdrop for this
hearing is Russia's invasion of Ukraine. By starting the largest land
war in Europe since World War II, Russia has unleashed the greatest
threat to global security in recent memory.
The sanctions imposed thus far by the Biden administration are
harmful to the Russian economy, but not crippling. The President has
said ``all options are on the table'' in terms of sanctions. So what
are we waiting for?
Sanctions have purposefully allowed Russia to continue exporting
oil and gas, funding Putin's war machine with what could be as much as
$5 to $7 billion each week. Cutting off this revenue stream and getting
more lethal aid to Ukraine are the two things we could do to maximize
the chances that Ukraine wins this war, and Putin comes to understand
this war was a calamitous blunder.
To cut off Putin's oil and gas sales globally, the Administration
and Congress should impose secondary sanctions on Russia's entire
financial sector. This would force the world to choose between doing
business with Russia or the United States. I urge the Administration to
impose these sanctions and give Ukraine a fighting chance to win this
war.
I am concerned that part of today's hearing will be spent
disparaging cryptocurrencies, trying to draw some connection between
them and Russian sanctions evasion.
There is no sanctions regime that is completely water tight. So
it's quite possible that an oligarch somewhere may be using a variety
of tools, including crypto, to try to hide some assets.
But according to Administration officials across multiple agencies,
there is simply no evidence of cryptocurrencies being used by Russia to
evade sanctions in any significant way.
Just this month, FBI Director Christopher Wray told the Senate
Intelligence Committee that ``the Russians' ability to circumvent the
sanctions with cryptocurrency is probably highly overestimated.''
Acting FinCEN Director Him Das said that ``we have not seen widespread
evasion of our sanctions using methods such as cryptocurrency.'' And
the director of cybersecurity for the National Security Council said
that ``the scale that Russia would need to successfully circumvent all
U.S. and partners' financial sanctions would almost certainly render
cryptocurrency as an ineffective primary tool for the State.''
The facts are clear and as the Administration has found: Russia
cannot meaningfully use cryptocurrencies to evade sanctions.
While there has been virtually no evidence of Russia meaningfully
using cryptocurrencies to evade sanctions, Ukraine has been actively
utilizing cryptocurrencies to do tremendous good. Cryptocurrency
donations for Ukraine have reached approximately $100 million, which
has helped Ukrainians defend their country against Russia's invasion.
These funds have gone towards more than 5,500 bulletproof vests,
500 helmets, and 410,000 meals, among other things. Ukraine's Deputy
Minister of Digital Transformation has said that ``each and every
helmet and vest bought via crypto donations is currently saving
Ukrainian soldiers' lives.''
We're fortunate to have as a witness today someone deeply affected
by the war in Ukraine, and the use of cryptocurrency to help Ukraine
and its citizens. Michael Chobanian is the Founder of KUNA Exchange, a
local cryptocurrency exchange based in Ukraine. For the past several
weeks, Mr. Chobanian has been instrumental in coordinating effforts so
individuals all over the world can contribute cryptocurrencies in
support of Ukraine's defense.
Crypto's remarkable nature is that anyone across the globe can
contribute to this type of effort, almost instantaneously, at very low
cost. It is in this context that we should examine cryptocurrencies and
their relation to illicit finance.
Throughout history, criminals have always tried to utilize new
technologies for nefarious gain. But that is not a reason to stifle new
technological developments.
Crypto can be used to empower individuals and promote personal
autonomy, but it can also support the detection and prevention of
illicit crime. According to Chainalysis, transactions involving illicit
addresses account only for 0.15 percent of cryptocurrency transaction
volume last year.
This should be no surprise: the traceable nature of many
cryptocurrencies is a factor making them terribly risky to utilize for
criminal purposes. Just look at the Colonial Pipeline hack, which was
one of the most disruptive ransomware attacks on record. The Department
of Justice recovered 85 percent of the bitcoins that the pipeline paid
in ransom, dealing a significant blow to the hackers.
One of today's witnesses, Michael Mosier, can speak directly about
the characteristics of cryptocurrencies that help detect criminal
activity. Mr. Mosier is the Former Acting Director for the Financial
Crimes Enforcement Network, or FinCEN, at the U.S. Treasury Department.
His Government experience makes him uniquely qualified to discuss the
topics before us today.
Today I hope the Committee takes a thoughtful and reasonable
approach to this topic, acknowledging both the risks cryptocurrencies
present, but also their incredible potential. I thank the witnesses for
their testimony and participation today, and look forward to the
discussion.
______
PREPARED STATEMENT OF JONATHAN LEVIN
Cofounder and Chief Strategy Officer, Chainalysis, Inc.
March 17, 2022
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
______
PREPARED STATEMENT OF MICHAEL MOSIER
Former Acting Director, Deputy Director/Digital Innovation Officer,
Financial Crimes Enforcement Network (FinCEN)
March 17, 2022
Thank you Chairman Brown, Ranking Member Toomey, and Members of the
Committee for holding this hearing and inviting me to participate. It's
an honor to be here. Congress represents the breadth of viewpoints
across our society and has a critical role in reflecting and protecting
the democratic foundation and personal sovereignty of the people.
My grandfather was a justice of the peace in a small mining and
steel town in Western Pennsylvania. Sadly, he died long before I was
born. But I treasure one of his campaign cards from a 1953 election
that announces: ``Endorsed by Labor. An avowed enemy of communism''.
Those juxtaposed statements encapsulate a sense of collective
empowerment of the time, but also a resolute vigilance against
totalitarian collectivism. They underscore the importance of
maintaining a balance. Of sufficiently empowering people,
organizations, and Governments to prevent abuse, while ensuring checks
on that power, so that it is not itself used to abuse.
A desire to protect personal sovereignty in the face of abuse led
me to public service. As a new lawyer at a firm, I took on pro bono
cases to help victims of domestic violence obtain protective orders,
then wanted to do more. I became a State prosecutor at the Manhattan
District Attorney and eventually a Federal prosecutor at the Department
of Justice (DOJ), investigating kleptocracy as well as the financing of
human trafficking. Preservation of self-determination has guided me
through roles as Deputy Chief in DOJ's Money Laundering Section,
Director at the White House National Security Council, OFAC Associate
Director, Counselor to the current Treasury Deputy Secretary, and, most
recently, Acting Director of FinCEN.
From my experiences, \1\ I have seen firsthand that, yes,
investigative ability is critical, including as a deterrent; but we
must not confuse tools with the mission, which is to preserve the self-
determination upon which our country was founded, and to empower people
to be able to thrive and protect themselves. Preserving this balance
requires a thoughtful approach to new technologies. If every new
technology is viewed with suspicion, we risk harming the citizens we've
sworn to protect. At FinCEN, we constantly invited the public for
conversations, from cryptography professors, to civil society
explaining how vulnerabilities are turned against people under
authoritarian rule, constitutional privacy and speech experts, child
exploitation and anticorruption groups, and core developers of privacy
technology. This education was nearly weekly--an obligation as public
servants to ensure we reflected all the perspectives of the people we
serve.
---------------------------------------------------------------------------
\1\ General Counsel, Espresso Systems. Previously: Acting
Director, Dep.Dir./Digital Innovation Officer, FinCEN; Counselor
(cybersecurity and emergent technology) to the Deputy Secretary of the
Treasury; in-house counsel, Chainalysis; Director (transnational
organized crime), White House National Security Council; Associate
Director, OFAC; Deputy Chief, Money Laundering Section, USDOJ; adjunct
professor, Georgetown University Law Center.
---------------------------------------------------------------------------
The Anti-Money Laundering Act (AML Act) \2\ passed last year
modernizes 2 our approach to financial integrity, including the need to
prioritize some risks over others, and to strike a balance that
guarantees opportunity. That balance is also reflected in our
separation of powers and our Constitution. Because no matter the best
intentions, people are fallible. In thinking about self-determination,
when we speak of ``illicit finance,'' we must not forget defenders of
democracy whose financing might be considered ``illicit'' to the
autocrats and invading armies they resist. As we painfully see around
the world right now, it is fundamental to democracy that people have
the opportunity to protect themselves in the face of fallibility and
brutality.
---------------------------------------------------------------------------
\2\ https://www.fincen.gov/anti-money-laundering-act-2020
---------------------------------------------------------------------------
The same cryptographic capabilities discussed here today enabled
secure, auditable humanitarian aid to 60,000 health care workers in
Venezuela under a repressive regime, accomplishing a major foreign aid
objective tied to a White House national security emergency. \3\ The
best way to send Office of Foreign Assets Control (OFAC)-authorized aid
that would not be intercepted by the Venezuelan regime was to do it
outside of their domestic banking system, through USDC cryptocurrency,
and using Virtual Private Networks (VPNs). \4\ No doubt the Venezuelan
regime considered the use of those previously frozen assets ``illicit
finance,'' but to us they were cryptographically secure humanitarian
aid. \5\
---------------------------------------------------------------------------
\3\ https://www.circle.com/blog/circle-partners-with-bolivarian-
republic-of-venezuela-and-airtm-to-deliver-aid-to-venezuelans-using-
usdc
\4\ https://www.ft.com/content/2a271032-35b4-4969-a4bf-
488d4e9e3d18
\5\ https://www.ft.com/content/2a271032-35b4-4969-a4bf-
488d4e9e3d18
---------------------------------------------------------------------------
Likewise, in the past few weeks, tens of millions of dollars worth
of cryptocurrency were donated by the public to Ukraine--faster and
more aid than the U.N. provided. Further, the transparency of
Government-identified wallets on a public ledger is a substantial
improvement in accountability from U.N. aid through traditional
banking, like the U.N. Oil-for-Food scandal. \6\ Streaming in 24/7,
with no limited banking hours; with fewer intermediaries to be
disrupted or take fees off the top; and available with a mere phone
app. No doubt, the Russian Government considers that money ``illicit''
and would stop it if they could. Resilient money is part of a duality
of sovereignty that, like most things, can be considered good and bad.
---------------------------------------------------------------------------
\6\ https://www.law.nyu.edu/news/IILJ-IRAQ-OILFOOD
---------------------------------------------------------------------------
For policymakers, the key is to find a balance that doesn't merely
chase bad actors but also prevents exploitation of the vulnerable from
the start. Having spent decades with victims of crime, I can say: you
will never make them whole. Even if you get some of the money back--and
rarely will you get it all back--you will never undo the trauma of
being violated, exploited, and having your vulnerability exposed so
concretely. We must empower people to protect themselves from
exploitation, not just avenge the victims. Cryptocurrencies, like the
cryptography with which they are built, can be used in crime, but we'd
be naive to think they are not also powerful tools to empower and
protect the innocent.
Related to democracy and threat prevention, while briefly serving
as Counselor to the current Treasury Deputy Secretary, my portfolio was
cybersecurity and emergent technology in the wake of the SolarWinds
cyberattack. The Russian Foreign Intelligence Service spent months
inside computers across the private sector and Government agencies. It
confirmed \7\ what we had been saying for years: that cybercrime is not
just about the money. Over-attributing cybercrime to cryptocurrency
misses significant operating models and preventive measures that can be
taken.
---------------------------------------------------------------------------
\7\ https://www.gao.gov/blog/solarwinds-cyberattack-demands-
significant-federal-and-private-sector-response-infographic
---------------------------------------------------------------------------
Having worked on cybercrime for years, including at FinCEN and the
National Security Council, here are a few observations about ransomware
in particular:
1. Ransomware dates back to 1989, two decades prior to the emergence
of Bitcoin in 2009. Payments have come in a variety of fiat
``digital'' methods such as online payment processors, credit
cards, and other traditional money transmission services for
decades.
2. Yes, cryptocurrency has become the recent payment of choice
because of the speed and its perceived anonymity. However,
payments made in cryptocurrency offer Law Enforcement
significant visibility and investigative benefits over opaque
banking, as we saw with the recovery of $2.3 million in
cryptocurrency from the Colonial Pipeline attackers. There are
many other examples of cases being solved much faster because
cryptocurrency was involved, cases where we could immediately
identify on a public ledger which Virtual Asset Service
Provider (VASP) to subpoena using immutable public evidence
rather than years of Mutual Legal Assistance Treaty (MLAT)
process and guesswork about which bank might be involved due to
opaque wire transfers and shell companies.
3. The increase in ransomware payments has less to do with criminals
reflecting current financial trends, and more to do with three
practical emergences:
a. First, the advent of Ransomware-as-a-Service, making kits
widely available, regardless of coding skills, drastically
reducing barriers to entry;
b. Second, the use of double extortion, greatly increasing payouts
by also threatening to expose stolen data, not just lock the
computer; and
c. Third, wide adoption of cyber insurance, which, while good in
itself, also means ransomware actors know victims have ability
to pay, driving up demands and payouts.
In light of these three substantial factors, it greatly
oversimplifies the issue to blame ``cryptocurrency'' for payments
increasing. Ignoring the variety of factors at play, this claim fails
to recognize that part of the solution is having cyber insurance
policies require that the policyholder develop and maintain meaningful
cybersecurity practices as one of the best ways to help reduce
payments--and, importantly, reduce victims from the beginning. A
ransomware attack avoided is a bigger victory than a perpetrator
apprehended. We make decisions everyday about balancing risk and
opportunity to thrive. The best defense against cybercrime is
disconnecting computers. But we have decided that it's better to manage
risk rather than stop communicating, creating, and transacting across
the world seamlessly. Likewise, we decided as a Nation that although
encryption itself makes it more difficult for the Government in some
instances to monitor activity, that security also protects people from
hackers and protects human rights actors from autocrats so they can
promote democratic discourse. As Sen. Wyden has said, ``Secure,
encrypted communications give people the power to organize and access
information that authoritarian regimes don't want seen. End-to-end
encryption is life or death for people living in authoritarian
countries like Russia, China, or Saudi Arabia.'' \8\ The democratic
resilience of cryptography doesn't stop with mere messages.
---------------------------------------------------------------------------
\8\ https://twitter.com/RonWyden/status/
1499384550165725190?s=20&t=1UzXFuPo-X4czlgMBVYSg
---------------------------------------------------------------------------
If we chronically underestimate what cryptocurrencies can do for
democracy, we also grossly overestimate its use in crime. For
perspective, ``Chainalysis's 2022 Crypto Crime Report'' estimated
crypto-illicit finance at $14 billion, about 0.15 percent of all
transaction volume in 2021. \9\ The UNODC estimates fiat illicit
finance between $800 billion--$2 trillion, or 2-5 percent of global
GDP--that fiat illicit percentage is up to 33 times higher than
crypto's percentage. \10\ For scale, crypto's 2021 illicit finance
number of $14 billion is comparable to the $12.4 billion lost by bank
customers through overdraft fees alone in 2020. \11\ Apples to oranges
perhaps, but meaningful context in terms of scale of impact on
consumers. Note, it is impossible to have an overdraft with crypto,
because there is no double-spending. That alone is $12.4 billion back
to some of the most economically vulnerable people. Not to mention
mandatory account minimums that have kept roughly 3.5 million U.S.
households unbanked, which crypto does not have. \12\
---------------------------------------------------------------------------
\9\ https://blog.chainalysis.com/reports/2022-crypto-crime-report-
introduction/
\10\ https://www.unodc.org/unodc/en/money-laundering/overview.html
\11\ https://www.forbes.com/advisor/personal-finance/how-to-
prevent-overdraft-fees/
\12\ https://twitter.com/-amanda-fab/status/
1479629264194572291?s=21
---------------------------------------------------------------------------
There is work to be done yet for cryptocurrency. There are too many
exploits, rugpulls and scams. The early internet had a lot of fraud and
exploits as well. You'd order something online and have no idea whether
you'd actually get it. It took years to work out consumer protections,
and certainly data privacy and protection remains elusive to this day.
But we haven't decided to shut down the internet. We work persistently
to find the balance and prioritize risks. As an example of the wisdom
in fully exploring positive uses for edge technology before
preemptively overreacting, the U.K. previously talked of banning The
Onion Router, or Tor, browser, which was originally designed by the
U.S. Naval Research Laboratory and provides multilevel encrypted access
to the internet. \13\ Now the BBC is broadcasting via Tor in Russian
and Ukrainian to bring the free flow of information to where BBC
signals have been blocked. \14\
---------------------------------------------------------------------------
\13\ https://www.bbc.com/news/technology-50150981
\14\ https://www.bbc.com/news/technology-50150981
---------------------------------------------------------------------------
And how should we prioritize risks in the context of the Russian
invasion? A senior Administration official said on background call to
the Digital Assets Executive order: ``I will say, on Russia, in
particular, the use of cryptocurrency we do not think is a viable
workaround to the set of financial sanctions we've imposed across the
entire Russian economy and, in particular, to its central bank.''
Similarly, my successor as Counselor to the Deputy Secretary \15\
recently said, ``You can't flip a switch overnight and run a G20
economy on cryptocurrency. It's an access problem, it's a rails
problem, and it's just a basic liquidity problem. Certainly there's
going to be an element [of crypto] that's part of their playbook, but
it frankly isn't at the top of the list.'' \16\
---------------------------------------------------------------------------
\15\ https://www.whitehouse.gov/briefing-room/press-briefings/
2022/03/09/background-press-call-by-senior-administration-officials-on-
the-presidents-new-digital-assets-executive-order/
\16\ https://twitter.com/aredbord/status/1500116597607915527?s=21
---------------------------------------------------------------------------
Three Recommendations
If you want to tangibly impact illicit finance, here are three
concrete actions you can take now:
1. First, pass the budget that was due last October. Fifteen months
after the passage of landmark AML modernization legislation,
none of the tens of millions of dollars needed to implement it
has been appropriated. Under a Continuing Resolution, FinCEN
and OFAC are without the roughly $74 million increase for
personnel and technology, while more and more are demanded of
them. \17\ Empower FinCEN to use the data already coming to
them before burdening them--and industry--with additional data
collection for which they will be asked what good use they made
of it. They are being set up for failure by unfunded mandates.
---------------------------------------------------------------------------
\17\ https://financialservices.house.gov/news/
documentsingle.aspx?DocumentID=407592
---------------------------------------------------------------------------
2. Second, resource and expansively clarify the AML and Kleptocracy
whistleblower programs. The AML Whistleblower Program should
explicitly include sanctions evasion and any violation of money
laundering laws in 18 U.S.C. 1956, not just BSA violations, so
that everyone is clear to crowd-source leads related to
corruption and abuse, and that it is ``administrative''
forfeiture amounts that are excluded from awards. Also, provide
the separate Kleptocracy Whistleblower Program with dedicated
funds and much higher caps, for the people risking their lives
under autocratic regimes. Not resourcing whistleblower programs
is doubly bad because it sets them up for failure, which
undermines the whole system of people who want to help--from
whistleblowers to overburdened public servants.
3. Third, reduce global regulatory arbitrage. According to
Chainalysis, crypto- money-laundering activity is ``heavily
concentrated . . . at a surprisingly small group of services,''
which we know to be foreign, high-risk, centralized exchanges.
\18\ With limited resources, we must prioritize. Help the
diligent U.S. exchanges working hard to do things right.
Further, until there are global registration standards to
identify trusted exchanges to send personal information,
industry cannot implement the Travel Rule. Congress should
press U.S. FATF representatives to focus on standardized
licensing across jurisdictions, instead of FATF developing new,
expansive definitions of ``Virtual Asset Service Provider''
that include software developers in a way that FinCEN cannot
implement under our Constitution.
---------------------------------------------------------------------------
\18\ ``2020 Chainalysis Crypto Crime Report'', p.10.
In closing, thank you again for this opportunity. Conversation is
the fastest and most democratic way to ensure we are not
underestimating or overestimating nuanced risks and opportunities. That
is also the value of robust Notice and Comment periods for rulemakings,
for which I argued strenuously with Secretary Mnuchin around the rushed
wallets rulemaking that I opposed. We cannot claim to know more than
all of the public. That is not how we best protect and empower. Your
invitation shows dedication to discourse, and I am so grateful.
Our President issued an Executive order last week that lays out an
ambitious and thoughtful approach to empowering innovation to increase
the innovative resilience and economic strength of our country--clear
national security goals. All I ask is that you give our Nation and
President that chance to complete the studies so that we are clear on
opportunities and real risks before rushing ahead of the smart and
dedicated public servants working hard for years to protect and empower
our country's and the world's democratic values. We compete with China
and Russia through the power of ideals and democratic freedom that show
the world what is possible such that they want to join us. Democratic
discourse and personal sovereignty are foundational to our country.
And, as we see in the unified solidarity with Ukraine, principles are a
key national security defense in the global battlefield of ideas and
ideals.
I will end with a quote engraved at the National Memorial for Peace
and Justice, informally known as the National Lynching Memorial, to
remind us that personal sovereignty requires vigilance, and that we
always need a dynamic tension of personal empowerment in relation to
the potential for politically sanctioned injustice, which is hardly far
in our rearview mirror. Thinking also, in his own personal, local way,
of my grandfather, who as justice of the peace got up everyday knowing
that justice is a constant struggle for many. And of course thinking of
so many people around the world living this right now, and our
obligation to do better:
For the hanged and beaten.
For the shot, drowned, and burned.
For the tortured, tormented, and terrorized.
For those abandoned by the rule of law.
We will remember.
With hope because hopelessness is the enemy of justice.
With courage because peace requires bravery.
With persistence because justice is a constant struggle.
With faith because we shall overcome. \19\
---------------------------------------------------------------------------
\19\ https://ideas.ted.com/this-is-sacred-ground-a-visit-to-the-
lynching-memorial-in-alabama/
---------------------------------------------------------------------------
Thank you.
______
PREPARED STATEMENT OF MICHAEL CHOBANIAN
Founder of KUNA Exchange, President of Blockchain Association of
Ukraine
March 17, 2022
My name is Michael Chobanian, and I am a Ukrainian fintech
entrepreneur and crypto enthusiast. In 2014, I founded KUNA--Eastern
Europe's first Bitcoin agency which has since transformed into a full-
fledged cryptocurrency exchange with more than 450,000 users worldwide.
On February 24th, the Russian Federation attacked my homeland with
a full-scale war. Thousands of civilians have been killed and hundreds
of homes have been destroyed. By the Ministry of Finance's accounts,
the damage from the Russian invasion has already amounted to $500
billion dollars--and the number rises daily.
From the invasion's first moment, we at KUNA decided to act swiftly
to help our army and the people who suffered most due to these horrific
events. In collaboration with the Ministry of Digital Transformation
and the Ministry of Defense, our team launched the official Crypto Fund
of Ukraine to solicit cryptocurrency donations. The majority of funding
comes through crypto assets such as Bitcoin and Ethereum, where AML
technologies (e.g., Chainalysis, Crystal Blockchain) have been
successfully implemented. All crypto that we received and converted was
analyzed for illegal activity. These solicited funds are used to
purchase much needed medical supplies, military equipment, and
humanitarian aid here in Ukraine.
As of today, the Fund has collected more than $50 million dollars
in donations, while shooting for a $100 million dollar goal.
One of our top priorities throughout this fundraise was to ensure
the transparency of the donation process. While KUNA is providing the
technological platform for crypto donations, the Ukrainian Government--
specifically, the Ministries of Digital Transformation and Defense have
ultimate control of the funds and it is they who are responsible for
the fund's distribution. KUNA is serving a strictly technical and
organizational role in the fundraising process and coin management--
crypto banking.
I would also like to address the sanctions many crypto platforms
are currently imposing on Russia-based crypto accounts. Being the
founder of a crypto exchange and a Ukrainian patriot, I have decided to
cease all support for the Russian ruble on KUNA. Although it wasn't an
easy decision, I believe it was the right one. We can't support Russia
while Ukrainian people are being killed and cities are being bombed and
attacked by ballistic missiles. Many crypto platforms adopted similar
initiatives such as blocking the accounts of sanctioned Russian
officials and businessmen who support Putin's regime.
I am sure that you will do everything possible to protect Ukraine,
Europe, and the entire democratic world from bloody authoritarian
Russian aggression. To stop Russia in its tracks, and to bring about a
more democratic world with personal freedom through cryptocurrency, we
appeal to crypto exchanges worldwide, including Binance, to block any
interaction with sanctioned individuals until the fall of Putin's
regime and end of aggression against Ukraine.
Nevertheless, crypto remains a viable option for Russians who
oppose the war and wish to stand up against Putin's regime. The ruble
has already reached historical lows and keeps falling, while Russia's
GDP has lost $30 billion, or 9 percent, in 2022. Many civilians
justifiably fear the seizure of retail deposits and want to protect
their capital. Purchasing digital assets is an effective means by which
ordinary Russian citizens can demonstrate their opposition to Putin's
regime by moving their savings out of the financial system of the
Russian ruble.
By concluding, I would like to thank the U.S. Senate for the
opportunity to stand here and speak on these vital issues. Our Nation
is eternally grateful for all the help given by our international
friends and partners. I truly believe that the unprecedented global
unity and support for Ukraine during this unmerited, unwanted, and
unnecessary bloodshed can put and end to Putin's reign of terror and
lead to an even brighter future for tomorrow.
Slava Ukraine!
______
PREPARED STATEMENT OF SHANE STANSBURY
Robinson Everett Distinguished Fellow in the Center for Law, Ethics,
and National Security, and Senior Lecturing Fellow, Duke University
School of Law
March 17, 2022
Chairman Brown, Ranking Member Toomey, and distinguished Members of
the Committee, thank you for the opportunity to testify today.
I am a Senior Lecturing Fellow in Law and the Robinson Everett
Distinguished Fellow in the Center on Law, Ethics, and National
Security at Duke University School of Law. At Duke, I teach primarily
in the areas of cybercrime and national security law.
I previously spent more than 8 years as a Federal prosecutor in the
U.S. Attorney's Office for the Southern District of New York (SDNY). At
SDNY, I spent much of my time investigating and prosecuting
transnational crimes, including terrorism, cybercrime, international
narcotics trafficking, money laundering, international public
corruption, and global weapons trafficking. I also served as a
representative in the Department of Justice's (DOJ) National Security
Cyber Specialists Network.
Although my testimony is based on my experience as a prosecutor and
my current academic work, I am testifying today on my own behalf. No
organization has paid for or approved this testimony.
Introduction
Criminals have always sought to take advantage of new forms of
technology to facilitate their illegal activity. Over the last two
decades, the pace at which they have done so has increased dramatically
as the internet, social media, smartphones, and other innovations have
changed the way we communicate and do business. I witnessed these rapid
changes firsthand as a Federal prosecutor focused on terrorism,
international narcotics trafficking, and other transnational crimes.
For example, my colleagues and I saw new digital communication
methods revolutionize the way terrorist organizations recruit members,
spread propaganda, and carry out operations. An early example was the
launching in 2010 by al Qaeda in the Arabian Peninsula (AQAP) of a
digital English-language magazine that could be easily distributed
around the world through social media channels. Not long after that, we
saw the Islamic State of Iraq and al Sham (ISIS) take that strategy to
another level. The group expanded its reach by exploiting a variety of
platforms, including social media networks such as Twitter and Facebook
and encrypted messaging apps like Telegram. These technologies allowed
the group to reach individuals around the world at a speed and scale
previously unthinkable--sometimes to devastating effect. Of course,
these new technologies did not just benefit terrorists. Drug
traffickers and criminals of all types were quick to adopt social
media, encrypted messaging apps, and other tools to better communicate
with one another and carry out their illicit operations.
In the same way these technologies revolutionized the way
terrorists and criminals communicate, cryptocurrency has provided new
avenues for how they finance illegal activities. I will describe some
of those avenues in a moment. But it is worth noting at the outset that
in its current form cryptocurrency presents challenges that are in some
ways distinct from technologies previously adopted by bad actors.
Because of their principal features, cryptocurrencies can often act as
magnets for criminal activity. They are decentralized, borderless, and
most provide a high degree of anonymity. Add to these features other
advantages--such as convenient access, storage, and transfer--and it is
not hard to see why many criminals are attracted to cryptocurrency.
How Criminals Use Cryptocurrency To Facilitate Criminal Activity
As DOJ has explained, criminals can exploit cryptocurrency in
several different ways, including (1) using cryptocurrency to
facilitate the commission of crimes, or to support terrorist activity;
(2) using cryptocurrency to illegally hide financial activity, such as
through money laundering or sanctions evasion; and (3) committing
crimes within the cryptocurrency market itself. \1\ I will highlight a
few examples of each of these types of activities.
---------------------------------------------------------------------------
\1\ U.S. Dep't of Justice, ``Report of the Attorney General's
Cyber Digital Task Force: Cryptocurrency Enforcement Framework'' (Oct.
2020), at 5-6, available at: https://www.justice.gov/archives/ag/page/
file/1326061/download.
---------------------------------------------------------------------------
The most obvious way cryptocurrency has changed the criminal
landscape is simply by making some crimes easier to commit and harder
to detect. By avoiding or minimizing cash transactions or bank
transfers, criminals can seek to accomplish more easily one of their
chief objectives--not getting caught.
My colleagues at SDNY saw this phenomenon firsthand in the early
days of Bitcoin's adoption, when they were investigating the now
infamous Silk Road website, which allowed users to buy and sell illegal
drugs and other unlawful goods and services anonymously and beyond the
reach of law enforcement. Bitcoin was the established currency on Silk
Road, and it served as the perfect vehicle for anonymous, illegal
transfers. With criminals free to buy, sell, and trade without ever
having to exchange cash or deposit money in a mainstream account, the
website flourished. At the time of its seizure in 2013, Silk Road was
considered the most sophisticated criminal marketplace on the internet,
having been used by several thousand drug dealers to distribute
hundreds of kilograms of illegal drugs. \2\
---------------------------------------------------------------------------
\2\ ``Manhattan U.S. Attorney Announces the Indictment of Ross
Ulbricht, the Creator and Owner of the `Silk Road' Website'', U.S.
Dep't of Justice (Feb. 4, 2014), available at: https://www.justice.gov/
usao-sdny/pr/manhattan-usattorney-announces-indictment-ross-ulbricht-
creator-and-owner-silk-road.
---------------------------------------------------------------------------
Since that time, cryptocurrency has grown even more popular--and
unfortunately so has its use in criminal conduct. Cryptocurrency is now
used in connection with a broad array of illicit activity, ranging from
child exploitation and human trafficking to extortion and fraud. \3\
According to one estimate, illegal cryptocurrency transactions reached
a record total of more than $14 billion in 2021. \4\ There are also
signs that terrorists may be turning to cryptocurrency to finance their
operations. In August 2020, DOJ seized millions of dollars as part of a
wide-scale seizure of cryptocurrency tied to the al Qassam Brigades
(Hamas's military wing), al Qaeda, and ISIS. \5\
---------------------------------------------------------------------------
\3\ DOJ Cryptocurrency Enforcement Framework, supra n. 1, at 6-7.
See also U.S. Gov't Accountability Off., GAO-22-105462, ``Virtual
Currencies: Additional Information Could Improve Federal Agency Efforts
To Counter Human and Drug Trafficking'', (Dec. 2021), available at:
https://www.gao.gov/assets/gao-22-105462.pdf.
\4\ Chainalysis, ``The 2022 Crypto Crime Report'' (Feb. 2022), at
3, available for download at: https://go.chainalysis.com/2022-Crypto-
Crime-Report.html.
\5\ ``Global Disruption of Three Terror Finance Cyber-Enabled
Campaigns'', U.S. Dept. of Justice (Aug. 13, 2020), available at:
https://www.justice.gov/opa/pr/global-disruption-three-terror-finance-
cyber-enabled-campaigns.
---------------------------------------------------------------------------
Perhaps nowhere is cryptocurrency's role in criminal activity more
vivid than in ransomware attacks. \6\ As many are aware, ransomware is
not just a growing problem for U.S. businesses, \7\ but also a serious
threat to public safety and national security. The hack of Colonial
Pipeline in 2021 was perhaps the most visible reminder of this fact,
but it did not stand alone. In 2021, U.S. agencies observed incidents
involving ransomware against 14 of the 16 U.S. critical infrastructure
sectors. \8\ Thousands of hospitals, school districts, city
governments, and other institutions in the U.S. have been impacted in
recent years by this modern-day hostage scheme.
---------------------------------------------------------------------------
\6\ See, e.g., Erik Schatzker, ``FBI Calls Crypto `Only Game in
Town' as Ransomware Flourishes'', Bloomberg.com (Feb. 16, 2022),
available at: https://www.bloomberg.com/news/articles/2022-02-16/fbi-
calls-crypto-only-game-intown-as-ramsonware-flourishes.
\7\ U.S. Dep't of the Treasury, Fin. Crimes Enf't Network,
Financial Trend Analysis: ``Ransomware Trends in Bank Secrecy Act Data
Between January 2021-June 2021'' (Oct. 15, 2021), at 1 (describing
ransomware as ``an increasing threat to the U.S. financial sector,
businesses, and the public''), available at: https://www.fincen.gov/
sites/default/files/2021-10/Financial%20Trend%20Analysis-
Ransomware%20508%20FINAL.pdf.
\8\ Cybersecurity & Infrastructure Security Agency, Alert (AA22-
040A): ``2021 Trends Show Increased Globalized Threat of Ransomware'',
(Feb. 9, 2022), available at: https://www.cisa.gov/uscert/ncas/alerts/
aa22-040a.
---------------------------------------------------------------------------
Cryptocurrency's primary appeal for ransomware criminals is the
same as for other cybercriminals: obscurity. Indeed, cryptocurrency's
central features make it particularly well-suited to the model of
ransomware that has emerged in recent years. Under the so-called
``Ransomware-as-a-Service'' (RaaS) model, a developer typically
licenses ransomware tools to affiliates, sometimes in exchange for a
share of ransomware payments. \9\ As is the case with other types of
illicit monetary transfers, payments in ransomware attacks often do not
travel directly from the victim to the perpetrators, but rather through
multiple layers involving different entities, each of which may or may
not be part of a regulated financial market.
---------------------------------------------------------------------------
\9\ Institute for Security and Technology, Combatting Ransomware
(Apr. 2021), at 16-17, available at: https://securityandtechnology.org/
wp-content/uploads/2021/09/IST-Ransomware-Task-Force-Report.pdf.
---------------------------------------------------------------------------
The cryptocurrency market offers multiple opportunities for
obfuscation along the path from payor to payee. One well-known
technique is the use of ``mixing'' or ``tumbling'' services, which
allow for the commingling of legitimate cryptocurrency transmissions
with those involving illicit payments, thereby making the criminal
activity harder to trace. \10\
---------------------------------------------------------------------------
\10\ See, e.g., ``DOJ Cryptocurrency Enforcement Framework'',
supra n. 1, at 41-44.
---------------------------------------------------------------------------
Another established method is ``chain hopping,'' whereby criminals
move illicit transmissions from one cryptocurrency to another using
some form of cryptocurrency exchange. By using this method, criminals
shift their digital trail from one cryptocurrency's blockchain to
another cryptocurrency's blockchain, again making the illicit assets
much harder to trace. \11\
---------------------------------------------------------------------------
\11\ See, e.g., id.
---------------------------------------------------------------------------
A final example is the use of a so-called ``privacy coin,'' such as
Monero, to obfuscate illicit transactions. Unlike a cryptocurrency like
Bitcoin, which relies on a public blockchain and reveals some
information about the transaction itself (albeit not specific
identifying information about the participants), a privacy coin
generally adds another layer of anonymity by obscuring virtually all
details of the transaction. \12\
---------------------------------------------------------------------------
\12\ See, e.g., id. at 4, 41.
---------------------------------------------------------------------------
These and other obfuscation methods make cryptocurrency attractive
not only for the actual execution of crimes like ransomware, but also
for money laundering and other efforts to conceal and promote criminal
conduct. That criminals would adopt this new tool is not surprising. As
a prosecutor, I regularly witnessed drug traffickers and corrupt
officials look for innovative methods to avoid the scrutiny of U.S.
financial authorities, particularly when they were trying to move money
across borders.
But some of cryptocurrency's features--such as decentralized
operation and control, and opportunities for anonymity--make it
particularly enticing as a money laundering instrument. Criminals
seeking to move illicit funds across borders can avoid risky
intermediaries; they may have a network of options available at the
click of a button. Their work is made easier by actors who expressly
build technologies to reduce or avoid regulatory compliance. Indeed, as
cryptocurrencies become more common and accepted, criminals could
choose to keep their profits in cryptocurrency for use in other illicit
activities.
Finally, cryptocurrency itself can create entirely new avenues for
criminal activity. As DOJ has noted, because of cryptocurrency's
features and the fact that much of its market is characterized by
opaqueness, wallets and exchanges can become attractive targets for
theft and fraud. \13\ By one estimate, last year criminals stole
approximately $3.2 billion worth of cryptocurrency and earned more than
$7.8 billion from cryptocurrency-related scams. \14\ As cryptocurrency
grows in popularity, these crimes could increasingly harm the general
public and less sophisticated investors. And the threat is not just
from ordinary criminals. Rogue Nation States have turned to
cryptocurrency theft and other crimes to finance their regimes, as
witnessed by North Korea's reported theft of hundreds of millions of
dollars in cryptocurrency. \15\
---------------------------------------------------------------------------
\13\ See, id. at 15-16.
\14\ ``Chainalysis 2022 Crypto Crime Report'', supra n. 4, at 5-6.
\15\ Kevin Collier, ``North Korea Stole a Record $400 Million in
Cryptocurrency Last Year, Researchers Say'', NBC News (Jan. 13, 2022),
available at: https://www.nbcnews.com/tech/security/north-korea-stole-
record-400-million-cryptocurrency-last-year-research-rcna12080. See
also DOJ Cryptocurrency Enforcement Framework, supra n. 1, at 1, 16
(describing the threats posed by North Korea, including through illicit
mining of cryptocurrency).
---------------------------------------------------------------------------
The Challenges Cryptocurrency Presents for Law Enforcement
The same factors that make cryptocurrency attractive to criminals
can present challenges for prosecutors and law enforcement agents
seeking to stop illicit activity.
As I mentioned previously, criminal actors are always looking for
new ways to commit crimes or hide their illicit proceeds. Some find
particularly clever methods for covering their tracks, and it is the
job of investigators and prosecutors to use the tools at their disposal
to find and assemble the pieces of the evidentiary puzzle.
When my colleagues and I investigated international money
laundering cases, dedicated investigators spent countless hours
analyzing records requested from financial entities to establish the
use of shell companies, phony accounts, and other means to conceal the
transfer and ownership of illicit funds. We were often successful
because of the cooperation of international partners and because of the
financial information made available by regulated institutions that
followed their compliance and disclosure obligations. But much of the
cryptocurrency ecosystem operates outside of the universe of resources
that prosecutors and investigators routinely rely upon to gather the
information they need to establish criminal malfeasance.
To be sure, law enforcement is getting much better at tracing
digital assets used to commit and cover up criminal activity. With
forensic blockchain analysis and access to other helpful information,
like know-your-customer (KYC) information provided by regulated
entities, law enforcement can penetrate the otherwise opaque world of
illicit cryptocurrency transfers. Last year, we witnessed DOJ recover a
substantial portion of the $4.4 million in ransomware payments made in
connection with the Colonial Pipeline attack discussed previously. \16\
And just last month, DOJ recorded its largest financial seizure ever
when it recovered $3.6 billion in cryptocurrency allegedly related to
the 2016 hack of the virtual currency exchange Bitfinex. \17\ These are
indeed promising and welcome developments.
---------------------------------------------------------------------------
\16\ ``Department of Justice Seizes $2.3 Million in Cryptocurrency
Paid to the Ransomware Extortionists Darkside'', U.S. Dep't of Justice
(Jun. 7, 2021), available at: https://www.justice.gov/opa/pr/
department-justice-seizes-23-million-cryptocurrency-paid-ransomware-
extortionists-darkside.
\17\ ``Two Arrested for Alleged Conspiracy To Launder $4.5 Billion
in Stolen Cryptocurrency'', U.S. Dep't of Justice (Feb. 8, 2022),
available at: https://www.justice.gov/opa/pr/two-arrested-alleged-
conspiracy-launder-45-billion-stolen-cryptocurrency. It should be noted
that this case is pending and the criminal charges remain allegations.
---------------------------------------------------------------------------
It would be somewhat naive, however, to conclude from these
developments that tracing and recovering cryptocurrency assets is
always easy--or even always possible. Even with the latest blockchain
analytics, investigations can take years to complete. Frequently, the
hardest part of a cyber-related prosecution is demonstrating what
investigators sometimes refer to as ``hands on the keyboard.'' Digital
breadcrumbs left by criminals can prove invaluable to investigators.
But ultimately prosecutors must demonstrate that an identifiable person
is behind the criminal activity. And in a criminal case, that identity
must be established beyond a reasonable doubt. That is, of course, as
it should be, but in cryptocurrency-related cases prosecutors will
often have the distinctive challenge of relying on a very complex
series of digital patterns and transactions to meet their burden.
That crucial connection of a criminal's identity to their criminal
conduct is one of the main challenges posed by cryptocurrency. A public
blockchain can be helpful, but often it can get one only so far.
Prosecutors can spend years trying to penetrate the layers of
obfuscation by savvy criminals. Even if they succeed, they may still
face obstacles due to the current state of the cryptocurrency market.
Criminal investigations are only as successful as the information
available. Sometimes prosecutors and investigators will get the
information they need. For example, if a cryptocurrency exchange used
by a criminal is complying with KYC and other regulatory requirements,
that may provide the information needed for learning the criminal's
identity or developing other leads. But too often this is not the case.
Not all cryptocurrency platforms comply with existing regulations, and
many operate in jurisdictions with less stringent requirements or
beyond the reach of relevant treaties.
This information gap could grow wider if more cryptocurrency
platforms move to a decentralized model or if more anonymous
instruments such as privacy coins gain wider adoption. This is a
remarkable period for technological innovation. Blockchain technology
offers fascinating possibilities for the future, and I look forward to
seeing how it might be applied to enrich our society. But we should
also recognize the serious role that cryptocurrency is playing in
criminal activity. Only then can we take the steps necessary to protect
our health, our safety, and our national security.
RESPONSES TO WRITTEN QUESTIONS OF CHAIRMAN BROWN
FROM JONATHAN LEVIN
Q.1. In your oral testimony, you noted that, with respect to
the use of digital assets in illicit finance, there is a
distinction between ``the ability to see the money versus seize
the money.'' You also noted that even when there is ``100
percent degree of transparency about where the money was
actually going,'' the ``operation . . . to recover the funds
is not always 100 percent possible.''
Please discuss the challenges involved in seizing or
recovering digital assets that are identified as illicit.
A.1. With traditional finance, if you find the funds, they are
either in tangible cash/assets you can seize or are held by a
centralized third-party financial institution who in many cases
you can require to hand over control of the assets through
appropriate legal process. This is not always the case in the
decentralized world of digital assets.
Law enforcement seizures of digital assets are generally
the result of three possible scenarios. The first involves
quality investigative work that leads law enforcement to
finding the information they need--such as a criminal's private
keys or recovery seeds--to seize their ill-gotten gains from
their private wallet. The second involves serving legal
process, such as a seizure warrant, on a service or financial
institution where the funds may be located--like a digital
asset exchange--that has custody of a criminal's illicit funds.
And the third involves the criminal, coconspirators, or
accomplices agreeing to turn over the funds, usually as a form
of cooperation.
Save for these scenarios, it can be quite difficult to
seize and recover funds. This means if you track the funds and
they are in a private wallet, exercising control over those
funds to recover them requires you to obtain the access
credentials for the private wallet yourself.
In spite of these challenges, we have seen law enforcement
demonstrate success in this regard, leading to significant
asset seizures, such as the recent DOJ seizure of $3.6 billion
in stolen digital assets directly linked to the 2016 hack of
Bitfinex, a digital asset exchange. There will be some cases in
which illicit wallets may have been identified, but do not
produce immediately actionable results.
There are two scenarios we outline below: challenges in
seizing funds held in private, or noncustodial wallets, and
challenges in seizing funds held by digital asset exchanges.
Seizing Funds Held in Private Wallets
If digital assets are held in a private wallet controlled
by private keys known only by the owner of that wallet, there
is generally no third party (such as a bank or financial
institution like in traditional finance) that you can require
to provide control of those funds/assets to you. This is true
even if you know where the funds are located (e.g., digital
asset wallet address). That said, if law enforcement obtains
the private keys or recovery seeds for a criminal's personal
wallet, or if they are able to obtain cooperation from them or
their collaborators, they may be able to seize the funds.
There are potential exceptions. For example, Tether has
some centralized aspects to it. The Tether white paper suggests
they can freeze and even burn Tether stored on an address and
reissue equivalent value tokens to, say, the victim of stolen
funds or seizing Government agency.
If you can't access the private wallet to move the funds,
regardless of being able to see them or knowing where those
funds are stored (in which addresses) you have no way to exert
control over them to seize them. It is, however, possible to
``watch'' these wallets using blockchain analysis tools to see
if they move in the future. Eventually criminals will want
access to their funds and will need to move them to an off
ramp, such as a digital asset exchange. The November 2020
seizure of $1 billion of bitcoin seized in relation to the Silk
Road case is a great example of law enforcement being able to
watch and seize funds years later.
Seizing Funds Held by Digital Asset Exchanges
In addition, it will not always be possible to seize funds
which have been tracked to a custodial wallet. Legal challenges
may frustrate seizure orders from one jurisdiction from being
exercised or executed in another jurisdiction. Some
jurisdictions or exchange services are cooperative, and others
are not, either because they are not yet regulated, or because
they are noncompliant. Some digital asset exchanges have
detailed contact information and instructions for serving legal
process and others have limited contact information, are
nonresponsive, or may be engaged or controlled by an illicit
service. These enforcement issues are not unique to digital
assets as similar challenges exist with traditional finance.
However, they can be amplified given the decentralized and
cross-border nature of some of these services which may or may
not be registered in the jurisdictions in which they operate.
Q.2. Approximately how frequently is law enforcement able to
convert the identifications of illicit wallets into successful
investigations? In other words, please discuss your
understanding of the proportion of known illicit wallet
addresses that are ultimately implicated in indictments or
illicit asset seizures.
A.2. There have been a number of seizures that have been
publicized recently, including in the Silk Road, Colonial
Pipeline, and Bitfinex cases. While we work with a number of
Government agencies, including law enforcement agencies, we do
not have statistics on the number of cases involving digital
assets they are working or what percentage of wallet addresses
Chainalysis has identified as associated with illicit activity
are being actively investigated, leading to indictments or
seizures. We would defer to the Department of Justice, the
Department of Homeland Security, the Department of Treasury,
the U.S. Postal Inspection Service, and the many State and
local law enforcement agencies who conduct investigations into
the illicit use of digital assets.
It may also be of interest that we are able to account for
both the sum amount of cryptocurrency holdings that can be
traced back to illicit sources, as well as the total balances
of criminal whales, meaning criminals holding $1 million or
more in cryptocurrency. We outline this in this blog post:
``Criminal Whales Hold over $25 Billion in Cryptocurrency From
Multitude of Illicit Sources'' from February 2022: https://
blog.chainalysis.com/reports/2022-crypto-crime-report-preview-
criminal-balances-criminal-whales/.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR REED
FROM JONATHAN LEVIN
Q.1. The Chainalysis 2022 ``Crypto Crime Report'' finds that
``[t]ransactions involving illicit addresses represented just
0.15 percent of cryptocurrency transaction volume in 2021
despite the raw value of illicit transaction volume reaching
its highest level ever.''
Please describe the caveats and qualifications with relying
on this statistic as an indicator of illicit finance activity
conducted using cryptocurrency.
A.1. In our research for the ``Crypto Crime Report'', and for
our research more broadly, we only count criminal wallets that
we have attribution on. This means that we are missing wallets
we don't know to be related to crime. Considering we are always
learning about new wallets and clustering new services, our
data improves with time. For example, at the time of writing
last year's Crypto Crime Report, we reported 2020's illicit
share of cryptocurrency activity to be 0.34 percent. But a year
later, when we recalculated that metric based on additional
intelligence, that number rose to 0.62 percent. The reason for
the change is the identification of more addresses associated
with illicit activity that were active in 2020.
In addition, we don't include in our high-level estimates
crime that is conducted off-chain, or not ``cryptocurrency
native''. When we refer to something as ``cryptocurrency
native'', we mean that the crime is practically dependent on
cryptocurrency, or inherently intertwined with it. For example,
darknet markets run entirely using cryptocurrency. It is easy
to identify their customers and vendors by examining the flow
of funds going into and out of those wallets. However,
investigators sometimes encounter criminals engaged in
traditional, non-cryptocurrency native crimes, such as
traditional drug trafficking that occurs on the streets but
uses cryptocurrency to pay distributors or launder illicit
proceeds. In these cases, the funds on-ramp (likely through a
VASP) from fiat, rather than moving from an identified illicit
service, so it may be more difficult to determine that the
funds are illicit proceeds. However, once investigators
determine that someone they are investigating is using
cryptocurrency to launder their illicit proceeds--perhaps via
bank records they have obtained via legal process showing fund
transfers to cryptocurrency exchanges--they can serve legal
process to any VASPs shown on the bank records, obtain
associated cryptocurrency addresses, and conduct blockchain
analysis to determine how the cryptocurrency is being used.
Q.2. Please provide Chainalysis' most recent available figure
regarding cryptocurrency transaction volume involving illicit
addresses.
A.2. According to a calculation done on April 14, 2022, total
illicit transaction volume for 2022 YTD is $8.69B, compared to
$2.5T in total economic activity. This means that the illicit
share is 0.35 percent of all transaction volume in 2022 YTD.
This figure includes the seized funds associated with the
Bitfinex hack, which totaled $3.65 billion. The percentage of
all transaction volume associated with illicit wallets is
approximately 0.2 percent without the funds associated with
that one incident.
------
RESPONSES TO WRITTEN QUESTIONS OF CHAIRMAN BROWN
FROM MICHAEL MOSIER
Q.1. At the hearing, you discussed how a public blockchain
ledger provides certain advantages for law enforcement with
respect to tracing illicit transactions, as compared to cash.
Do digital assets also provide illicit actors advantages as
compared to cash, specifically in illicit actors' ability to
quickly make large, cross-border transactions? What are they,
if so?
A.1. In thinking about the advantages of digital assets over
cash--whether for illicit or licit actors--it is helpful first
to recognize that we have had digital versions of cash for many
years, in the form of wire transfers, ACH, and digital payments
through banks and money services businesses (MoneyGram, Western
Union, Venmo, Zelle). For clarity in my response, I will refer
to ``cryptocurrency,'' to distinguish from long-existing
``digital payments,'' since the cryptographic security that
allows for a public ledger is a distinguishing feature. In the
same way that digital payments over the last several decades
provide speed and volume advantages to carrying physical cash,
so do recent evolutions in cryptocurrency that are based on a
cryptographically secure, public digital ledger. Like wire
transfers, each cryptocurrency transaction is pseudonymous,
with cryptographically determined alphanumeric identifiers. In
contrast to prior/existing digital payments, cryptocurrency
transactions are on a public ledger, so can be traced nearly
indefinitely forward and backward, whereas a traditional
financial institution can only see a transaction as far as the
next recipient financial institution--or less, in the instance
of cash.
In traditional finance and prior digital payments,
pseudonymous wire transfer identifiers are connected to
``identities'' that are spoofed, bought, created out of shell
companies, or hidden behind several layers. Likewise, there are
challenges in the cryptocurrency space with concretely
connecting the alphanumeric identifiers of an address. However,
it is important to note that, in contrast to the opacity of
wire transfers that use pseudonymous identifiers within an
interbank messaging system that is not publicly visible--and
certainly not visible beyond the next recipient--cryptocurrency
on the public ledger can be viewed for many, many transactions
forward and backward. Therefore, cryptocurrency's theoretical
benefits to illicit actors in terms of speed and volume are
also undercut by the public visibility through blockchain
analytics and even saavy public watchers of block explorers to
identify activity that indicates suspicious transactions. That
makes it very difficult to move substantial sums through
cryptocurrency without being detected as major money movements.
Indeed, there are multiple ``whale watchers'' in the public who
call out significant cryptocurrency movements for public notice
of either potential market-impacting transactions or suspicious
activity, such as positioning for an exploit or trying to cash
out hack proceeds at an exchange.
The cash-out point highlights that the ability to buy real
world goods and services with cryptocurrency remains quite
limited. It would be difficult to pay your mortgage, tuition,
car payments, fuel, groceries, utilities, etc., using
cryptocurrency. Therefore, users generally need to exchange
their cryptocurrency for fiat currency through a registered
virtual asset service provider (VASP), which, at least in the
United States, requires Know Your Customer (KYC) practices,
like traditional money services businesses. Therefore, the
identity risk level in cryptocurrency is not greater than fiat
digital payments money services businesses transactions. In
fact, there is much greater public transparency in
cryptocurrency, including for VASPs to monitor transaction
activity far beyond the next hop, compared to the opacity of
fiat digital payments and limited visibility to one ``hop,''
therefore lending greater ability to assess direct and indirect
risk in cryptocurrency.
In addition, distinct from the opacity of fiat digital
payments, in virtual assets, the entire public sees transfers
on the blockchain. We have seen repeatedly that the broader
public collectively detects suspicious activity even before the
more limited law enforcement resources and calls out the
activity publicly. Indeed, in multiple instances the public
exposure and collective action has led attackers to return the
money. That collective vigilance is not possible with opaque
fiat digital transfers. Further, the immutable, publicly
visible ledger for cryptocurrency provides a long term,
reliable record that cannot be unilaterally changed. Therefore,
for law enforcement purposes, evidence is effectively
preserved, while investigations can continue. That provides
more time for law enforcement to investigate before trails run
cold. For example, in February 2022, the Department of Justice
solved a prior cyber hacking case where approximately $4.5
billion (in today's value) was stolen from a hacked exchange
that occurred in 2016. \1\ The persistant visibility of the
hacked funds on a public ledger enabled something that would be
almost unheard of in fiat currency to solve so many years later
with so much of it still in place, rather than largely spent,
due to the need to off-ramp cryptocurrency but difficulty of
doing so, when the public funds have been determined to be
tainted. Indeed, the couple was arresting while still trying to
cash out to fiat, 6 years later.
---------------------------------------------------------------------------
\1\ https://guardian.ng/news/american-couple-arrested-for-planing-
to-launder-4-5-billion-stolen-bitcoin/
---------------------------------------------------------------------------
Therefore, while there are speed advantages to
cryptocurrency over cash--just like there have long been speed
advantages to fiat digital payments for many years--
cryptocurrency has far more traceability, with a permanent
trail and public visibility. In light of that, an illicit actor
choosing pragmatically is more likely to prefer the limited
visibility of fiat digital payments over cryptocurrency, or
stick with the true anonymity of cash, precious metals, or
other trade-based laundering like oil or coal. Indeed, the lack
of transactional privacy from every public eye has been a
limitation on the use of cryptocurrency in the business
payments space.
Q.2. On cross-border activity, do you think a new cross-border
rule from FinCEN would help law enforcement by providing them
with more information to address those problems? Please
explain.
A.2. I encourage you to contact FinCEN for the latest
assessment of law enforcement's needs and whether reporting of
cross-border electronic funds transfer information would be
helpful to their efforts. Such a rule would need to be
carefully considered, and balance the benefits to law
enforcement with the substantial costs it would likely impose
on both the public and on FinCEN. As you know, FinCEN is
currently developing the beneficial ownership database required
by the Corporate Transparency Act despite not receiving the
promised funding from Congress, as noted in my written
testimony, so I am hesitant to add unfunded mandates without
their buy-in.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR REED
FROM MICHAEL CHOBANIAN
Q.1. During an interview on March 19 with CoinDesk TV, you
stated that ``[t]he problem with Binance is not just that they
still continue working on both sides, it's that they showed
cooperation with the Russian Government before the war, and as
far as I know, they still continue cooperating with the Russian
Government.'' Please describe your understanding of how
Binance, one of the largest cryptocurrency exchange in the
world, is ``cooperating with the Russian Government.''
A.1. At the time of the publication on Coindesk, my statement
was based on the information that I received from the
``market''. Now we have a research by Reuters that sheds light
on the operations of Binance in Russia. https://
www.reuters.com/technology/how-crypto-giant-binance-built-ties-
russian-fsb-linked-agency-2022-04-22/
------
RESPONSES TO WRITTEN QUESTIONS OF CHAIRMAN BROWN
FROM SHANE STANSBURY
Q.1. As discussed at the hearing, blockchain technology can
enable the tracing of illicit transactions to specific wallets.
What challenges does law enforcement face in using tracing data
to seize illicit assets or arrest illicit actors?
A.1. Even when investigators are equipped with blockchain
tracing information, they face the challenge of linking illicit
transactions to specific individuals or entities. That
challenge is made more difficult in today's regulatory
environment because part of the cryptocurrency market remains
opaque. If a bad actor uses a cryptocurrency platform that is
complying with know-your-customer (KYC) and other regulatory
requirements, the information gained can help bridge the gap
between illegal activity and a person's identity. Too often,
however, bad actors are able to use services that do not comply
with--or are not subject to--existing regulations and/or
operate in jurisdictions with less stringent requirements. \1\
As a result, criminal conduct can go undetected by law
enforcement, and even illicit transactions identified through
blockchain analysis can remain unattributed. Law enforcement
may face even greater information gaps in the future if, for
example, more cryptocurrency services move toward a
decentralized model not run by a single entity or if anonymity-
enhancing instruments such as so-called ``privacy coins'' gain
wider adoption.
---------------------------------------------------------------------------
\1\ See, e.g., Financial Action Task Force (FATF), ``Second 12-
Month Review of Revised FATF Standards--Virtual Assets and VASPs''
(July 5, 2021), at 2 (finding that 70 of 128 reporting jurisdictions
had not yet implemented FATF's revised standards for virtual assets,
and that the ``lack of regulation or the lack of enforcement of
regulation in jurisdictions is allowing for jurisdictional arbitrage
and the raising of [money laundering and terrorist financing] risks''),
available for download at: https://www.fatf-gafi.org/publications/
fatfrecommendations/documents/second-12-month-review-virtual-assets-
vasps.html. See also U.S. Dep't of the Treasury, ``National Money
Laundering Assessment'' (Feb. 2022), at 41 (observing that a ``large
number'' of virtual asset service providers operating abroad, including
those interfacing with the U.S. financial system, have ``substantially
deficient'' anti-money laundering programs), available at: https://
home.treasury.gov/system/files/136/2022-National-Money-Laundering-Risk-
Assessment.pdf.
---------------------------------------------------------------------------
Jurisdictional issues also can pose challenges for law
enforcement. Cryptocurrency moves quickly and easily across
borders, without the need for centralized intermediaries, and
illicit assets may be hosted in wallets or accounts that are
beyond the reach of U.S. authorities or their international
partners. For example, illicit assets located in an
``unhosted'' wallet (i.e., a digital wallet not hosted by a
third-party institution, and which the user independently
controls) that is stored locally in an uncooperative
jurisdiction may be difficult to seize even with the assistance
of tracing data. Likewise, a criminal defendant may reside in a
jurisdiction where extradition or removal is unlikely, making
arrest and prosecution more challenging.
Law enforcement authorities can face a variety of other
hurdles, particularly given the range of increasingly
sophisticated obfuscation methods available to criminals.
However, one of the main challenges they face is one of
resources. Cryptocurrency-related crime continues to rise, with
growing implications for everyday Americans, and bad actors
continue to find new, complex ways to obscure their illegal
activity. Although private-sector firms can provide needed
assistance to investigators in tracing illicit activity, that
assistance is insufficient. More agents and prosecutors with
relevant expertise and training are required, and they need to
be equipped with the tools and support needed to develop
evidence for successful prosecutions. The Department of Justice
(DOJ) and investigating agencies have made important strides
recently in prioritizing cryptocurrency-related crime, but
Congress should ensure that they are given the funding and
resources needed to keep pace with the scale and severity of
the threat.
Q.2. After a wallet involved in an illicit transaction is
identified, based on your experiences or observations, how long
have investigations into illicit financial activity typically
taken to conclude? How much time does law enforcement usually
require to seize illicit assets held at a wallet known to be
illicit? What are the impediments to seizing illicit assets
from known wallets?
A.2. Investigations into illicit financial activity can vary in
length depending on a range of factors such as the complexity
and sophistication of the criminal activity, the geographic
scope of the conduct, and the resources available to law
enforcement. Criminal investigations also are sometimes
accelerated based on law enforcement priorities, a defendant's
decision to travel, or other considerations.
In some cases, investigations can move rapidly. For
example, in March 2022, the U.S. Attorney's Office for the
Southern District of New York charged two individuals in
connection with a so-called ``rug pull'' involving nonfungible
tokens (NFTs). According to the Government's allegations, the
investigation began in January 2022, when law enforcement
received reports from investors in the scam, and the defendants
were arrested approximately 2 months later. \2\
---------------------------------------------------------------------------
\2\ ``Two Defendants Charged In Non-Fungible Token (NFT) Fraud And
Money Laundering Scheme'', U.S. Dept. of Justice (Mar. 24, 2022),
available at: https://www.justice.gov/usao-sdny/pr/two-defendants-
charged-non-fungible-token-nft-fraud-and-money-laundering-scheme-0. In
considering the length of any investigation, it is worth noting that
many criminal investigations continue after an individual defendant is
arrested or assets are seized.
---------------------------------------------------------------------------
Other investigations progress more slowly. For example, in
2016, U.S. law enforcement began investigating the hack of
Bitfinex, a virtual currency exchange. In February 2022, almost
6 years later, law enforcement recovered some of the stolen
funds and arrested two individuals accused of laundering
cryptocurrency stolen in the hack. \3\
---------------------------------------------------------------------------
\3\ See Complaint (Statement of Facts), United States v.
Lichtenstein, No. 22-mj-00022-RMM (Feb. 7, 2022), available at: https:/
/www.justice.gov/opa/press-release/file/1470211/download; ``Two
Arrested for Alleged Conspiracy To Launder $4.5 Billion in Stolen
Cryptocurrency'', U.S. Dep't of Justice (Feb. 8, 2022), available at:
https://www.justice.gov/opa/pr/two-arrested-alleged-conspiracy-launder-
45-billion-stolen-cryptocurrency. The two defendants are not charged in
connection with the Bitfinex hack itself. It should also be emphasized
that both cases described here remain pending, and the facts discussed
remain allegations.
---------------------------------------------------------------------------
Whether and how quickly law enforcement can seize
cryptocurrency from accounts known to contain illicit proceeds
is fact dependent. In the Bitfinex case, for example,
investigators seized a large portion of the stolen
cryptocurrency shortly after gaining access to one of the
relevant wallets. However, the case was exceedingly complex and
took years to reach that stage. Investigators also were aided
by favorable facts that helped them access the wallet and
allegedly link it to the defendants. The defendants, for
example, resided in New York and allegedly used email and cloud
storage accounts that could be reached through U.S. process. In
2021, agents were able to obtain a search warrant for one of
the cloud storage accounts, which contained a file listing
2,000 virtual currency addresses--almost all of which were
linked to the 2016 hack--along with corresponding private keys.
According to investigators, that information allowed them
ultimately to seize, via a court order, the remaining illicit
assets from the digital wallet that contained the addresses.
\4\
---------------------------------------------------------------------------
\4\ See Complaint (Statement of Facts), United States v.
Lichtenstein, supra n. 3.
---------------------------------------------------------------------------
Seizures in other circumstances can be even more
challenging. Even if investigators can link a particular
digital wallet to criminal conduct by a specific person or
entity--which can be a difficult task in itself, given the
types of obfuscation often employed--they may ultimately face
jurisdictional or technical obstacles. For example, as
described previously in response to Question 1, an unhosted
wallet could be stored locally (and potentially offline) in a
foreign jurisdiction. \5\ A seizure in such circumstances could
prove difficult, particularly if the relevant jurisdiction does
not have a cooperative relationship with U.S. law enforcement.
---------------------------------------------------------------------------
\5\ In the example given above from the Bitfinex case, the wallet
described was unhosted, but it was within the reach of U.S. law
enforcement authorities, and investigators allegedly were able to link
it to identifiable U.S.-based individuals.
Q.3. Based on your observation, approximately how frequently is
law enforcement able to convert identifications of illicit
wallets into successful investigations? Relatedly, do you know
of any law enforcement agency, or market research organization,
that has identified or estimated the proportion of known
illicit wallet addresses that are ultimately implicated in
---------------------------------------------------------------------------
indictments or illicit asset seizures?
A.3. In part because of the confidential nature of law
enforcement investigations, I do not know what proportion of
the digital wallets that have been linked to illicit activity
have been implicated in investigations or prosecutions at the
federal or other levels. Nor am I currently aware of publicly
available reports detailing such information, although some
blockchain analytics firms publish their own estimates of
various statistics relating to cryptocurrency-related crime,
and other parties have begun to track cryptocurrency-related
enforcement actions. \6\ It should be noted that the amount of
illegal conduct is likely higher than industry-reported
estimates for a given year. Blockchain analytics firms
routinely revise upward their own estimates of illicit
transaction volume as more addresses linked to criminal
activity are found. \7\
---------------------------------------------------------------------------
\6\ See, e.g., Chainalysis, ``The 2022 Crypto Crime Report'' (Feb.
2022), available for download at: https://go.chainalysis.com/2022-
Crypto-Crime-Report; Morrison Cohen LLP, ``The Morrison Cohen
Cryptocurrency Litigation Tracker'' (May 3, 2022), available for
download at: https://www.morrisoncohen.com/news-page?itemid=471.
\7\ See, e.g., ``Chainalysis 2022 Crypto Crime Report'', supra n.
6, at 4.
Q.4. Illicit finance investigations are complex, and often
involve an array of law enforcement entities and officials.
Please describe the agencies and actors typically involved in
an illicit finance investigation involving digital assets. For
example, the recent recovery of $4.5 billion in cryptocurrency
involved several federal agencies and multiple U.S. Attorney
---------------------------------------------------------------------------
offices.
A.4. At the Federal level, a criminal investigation of illicit
activity involving cryptocurrency can include, among others:
Prosecutors from one or more U.S. Attorneys'
Offices and, depending on the nature of the case,
potentially other components of DOJ (e.g., the Money
Laundering and Asset Recovery Section (MLARS); the
Computer Crime and Intellectual Property Section
(CCIPS); the National Security Division (NSD));
Agents from various investigative agencies,
including, but not limited to, the Federal Bureau of
Investigations (FBI), the Internal Revenue Service--
Criminal Investigations (IRS-CI), and/or Homeland
Security Investigations (HSI);
State and local law enforcement agencies; and
International law enforcement agencies and other
partners.
In addition, in Federal criminal investigations, it is
common for prosecutors and agents to coordinate with regulatory
bodies such as the Securities and Exchange Commission (SEC) and
the Commodity Futures Trading Commission (CFTC), as well as
components of the U.S. Department of the Treasury (including,
for example, the Financial Crimes Enforcement Network (FinCEN),
the Office of Foreign Assets Control (OFAC), and the IRS).
Q.5. The Justice Department's recent enforcement report on
crypto crimes notes that the illicit use of cryptocurrency
falls into three broad categories. Bad actors may exploit
crypto to: (1) engage in financial transactions associated with
crimes, such as buying and selling drugs or weapons on the dark
web, leasing servers to commit cybercrimes, or soliciting funds
to support terrorist activity; (2) engage in money laundering
or shield otherwise legitimate activity from tax, reporting, or
other legal requirements; or (3) commit crimes directly
implicating the cryptocurrency marketplace itself, like
stealing cryptocurrency from exchanges through hacking or using
the promise of cryptocurrency to defraud unwitting investors.
From your experience as a prosecutor and your general knowledge
of the industry, which of these three categories do you think
Congress should be most concerned about, and what other
categories of illicit activity involving crypto should Treasury
and the Justice Department prioritize in their enforcement
efforts?
A.5. The Justice Department's report provides a useful
framework for understanding the variety of ways cryptocurrency
can be used by bad actors. However, I am not in a position to
prioritize one category of cryptocurrency-related crime over
others. Each type of crime can pose threats to U.S. citizens in
different and important ways, and in fact the categories
frequently overlap and reinforce one another. For example,
criminals engaged in ransomware attacks or the defrauding of
unwitting investors regularly rely on money laundering to
further their illicit activities. Moreover, a range of
dangerous threat actors--rogue Nation States, terrorists, and
criminal networks--have proven that they will engage in harmful
conduct that spans multiple categories.
Some threats, of course, do affect a broader set of victims
or interests. For example, ransomware attacks, which rely
almost exclusively on cryptocurrency as a means of payment,
pose a serious and ongoing threat not only to U.S. businesses,
but also to our national security. I trust my former colleagues
at DOJ and their regulatory counterparts to identify the most
serious threats based on the latest intelligence, and to set
enforcement priorities accordingly. Congress should provide law
enforcement and regulators with the resources necessary to act
on those priorities.
Additional Material Supplied for the Record
LETTER SUBMITTED BY NAFCU
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
STATEMENT SUBMITTED BY AEI HOUSING CENTER
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
[all]