jakiro
Source: Chainalysis; Compilation: Baishui, bitchain vision
In 2024, the cryptocurrency ecosystem has made many positive developments.Cryptocurrencies continue to gain mainstream acceptance in many ways after the U.S. approved the Spot Bitcoin and Ethereum Exchange Trading Products (ETPs) and the U.S. Financial Accounting Standards Board (FASB) fair accounting rules revisions.In addition, the inflow of legal services from year to date is the highest since 2021 (the peak of the last bull market).In fact, the total amount of illegal activity has dropped by 19.6% year to date, from $20.9B to $16.7B, indicating that legal activity is growing faster than illegal activity on chain.This encouraging sign shows the continued adoption of cryptocurrencies worldwide.
These global trends are also reflected in Japan’s crypto ecosystem.Overall, Japanese services are generally less exposed to illegal entities around the world, such as sanctioned entities, dark web market (DNM), and ransomware services, as most Japanese services are primarily targeted at Japanese users.However, this does not mean that Japan is completely immune to crimes related to cryptocurrencies.Public reports, including the Japan Financial Intelligence Agency (FIU) Japan Financial Intelligence Center (JAFIC), emphasized that cryptocurrencies pose significant money laundering risks.Although Japan may have limited contact with internationally illegal entities, the country is not without its own local challenges.Off-chain criminal entities that utilize cryptocurrencies are common.
In this article, we will explore two key cryptocurrency crime issues that Japan deserves close attention: money laundering and scams.
Money laundering and cryptocurrency
First, let’s explore the relationship between money laundering and cryptocurrency.Money laundering in the context of cryptocurrencies is often associated with hiding the proceeds of on-chain crimes such as DNM and ransomware.But as the world continues to embrace cryptocurrencies, illegal actors are eager to take advantage of powerful new technologies.With the right tools and knowledge, investigators can leverage the transparency of blockchain to discover and disintegrate illegal activities on and off-chain.
Cryptocurrency native money laundering
The process of money laundering on-chain funds is often complicated, as cybercriminals use various services to conceal the source and movement of funds.Cryptocurrency native money laundering presents ongoing challenges to cryptocurrency services and law enforcement agencies.
The first phase of cryptocurrency native money laundering—the placement—always involve cryptocurrencies.Despite the transparency of blockchain, criminals often choose cryptocurrencies for money laundering, as it is often easier to create a private wallet that does not require knowledge of the customer (KYC) information than to launder money through traditional placement strategies.The intermediate stages (hierarchical) of money laundering can take many forms.In traditional statutory money laundering activities, this may involve sending funds through multiple bank accounts and/or shell companies.In cryptocurrencies, this may involve:
-
Middle wallet or jump:Using multiple personal wallets complicates tracking, often accounting for more than 80% of the total value of these money laundering channels.It can be relatively simple for investigators and compliance professionals using Chainalysis to detect illegal activities and track them through intermediate wallets.
-
Encryption obfuscation service:Obfuscation services can take many different forms, such as mixers, cross-chain bridges, and privacy coins.While these services are widely used by money launderers, they also have legitimate privacy use cases that are not illegal in nature.
-
Mixer: These services mix cryptocurrencies from different users to confuse the source and ownership of funds.In line with the general rebound in market activity, the mixer will begin to recover in 2024.
-
Cross-chain bridge: These services and protocols facilitate asset transfers between different blockchain networks and create complex transaction networks.
-
Privacy Coins: Tokens like Monero and Zcash use advanced crypto technology to hide transaction details, which makes them attractive to illegal actors.
-
Stablecoin:It is increasingly becoming the preferred carrier for illegal capital transfers, reflecting the overall growth in global stablecoin adoption over the past few years.But the use of stablecoins also increases the risk of money launderers, as many stablecoin issuers react to the authorities and have the ability to freeze funds.
-
OTC Brokers:OTC brokers are spread all over the world and can facilitate large transactions with minimal review, often bypassing public order book and KYC requirements.
While some cybercriminals may keep their ill-gotten gains in their personal wallets for years (presumably hoping that authorities will turn their attention elsewhere), most bad actors want to turn their funds from cryptocurrency to cash.After using obfuscation technology, more than 50% of illegal funds flow directly or indirectly into centralized exchanges.Illegal actors may turn to centralized exchanges for money laundering because of their high liquidity, ease of conversion of cryptocurrencies to fiat currency, and integration with traditional financial services helps to integrate illicit funds with legal activities.Hundreds of centralized service agencies currently receive over $1 million in illegal funding every year.
Non-cryptographic native money laundering
Traditional money launderers are using methods similar to those based on fiat strategies to enter cryptocurrencies.Unlike cryptocurrency native money laundering, non-cryptocurrency native money laundering begins with the resettlement phase involving fiat currencies.Typically, criminals first use bank accounts to deposit fiat funds and then convert them into cryptocurrency.Criminals can then layer their funds, just like cryptocurrencies are native to laundering money.
Non-cryptocurrency native money laundering involves off-chain criminal activities such as drug trafficking and fraud.Identifying novel on-chain money laundering patterns often reflects detection of abnormal transactions and patterns based on fiat currency.In non-crypto-native money laundering, on-chain analysis usually starts with centralized exchanges, so it is difficult to identify illegal transactions without other background information.Although tracking the flow of these funds can be challenging due to lack of evidence, data science technology can mark indicators of potential non-cryptocurrencies native to money laundering.
One way to identify money laundering in non-cryptocurrencies is to make duplicate transfers below the reporting threshold, which we discussed in more detail in the 2024 Cryptocurrency Money Laundering Report.While these thresholds vary by country, the Financial Action Task Force (FATF)—the international body that develops AML/CFT standards—recommends that cryptocurrency transactions over USD 1,000/euro should comply with travel rules.Authorities set this threshold at $3,000.Additionally, the U.S. Bank Secrecy Act (BSA) requires reporting cash transactions over $10,000.
Trades above these values will trigger additional scrutiny, while trades below these thresholds, even if they are only one dollar, will not face the same level of check.
The figure below shows the value of funds transferred to centralized exchanges from 2024 to the present year-to-date.It shows a significant surge in transfer amounts, just below the reported thresholds of $1,000, $3,000 and $10,000, and slightly above that threshold.Transfers slightly above these thresholds may be attributed to rounding differences in exchange rates.This surge is typical of bad actors who avoid triggering reporting requirements by adjusting payment methods.Transactions slightly below the reporting requirements are one of the red flag indicators highlighted by the FATF in the Virtual Asset Service Provider (VASP) guidelines to help identify suspicious behavior.
Integrate funds
Exchanges may also benefit from monitoring merged wallets that interact with their services.When money launderers stratify funds through many intermediate wallets, the transaction process is often not simple and linear.Instead, money launderers may split the funds into many different wallets and then reintegrate the funds after multiple transactions.
Merge wallets receive and merge funds from multiple wallets or sources.If funds are transferred through multiple independent intermediate wallets and then merged at one address, this may indicate an attempt to avoid detection.
The Chainalysis cryptocurrency survey chart below shows such behavior in a known fraud gang targeting older people.In this case, the scammer may instruct the victim to purchase crypto assets using a specific service Exchange 1.Each victim is then instructed to send the funds to a different wallet controlled by the scammer.The scammer then merges the funds into a wallet and cashes them in Exchange 2.
Exchange 1’s compliance team has a hard time connecting victims directly to scammers, especially if the intermediate address is one-off and has no previous illegal relationship unless they trace the transaction back to the merged wallet.Using many intermediaries before integration is a well-known strategy that prevents Exchange 1’s compliance team from understanding the connection between all victims who send funds.
While the example above is relatively simple, the more complex money laundering network has the ability to integrate wallets and can aggregate funds from dozens or even hundreds of intermediate wallets.Querying Chainalysis data allows investigators to find primary integrated wallets that can often serve as useful clues.For example, the top 100 Bitcoin integrated wallets in 2024-date year-to-date – all of which have double-hop transactions from exchanges – received nearly $1 billion ($968 million) worth of bits from more than 14,970 different addressescurrency.
Further expanding the scope, we found that over 1,500 consolidated wallets received a total value of $2.6B of Bitcoin in 2024; each of them received funds from at least ten different wallets.Again, we cannot say for sure that this represents money laundering—in fact, most of it may represent legal inflows.But this activity may require additional review.
Illegal Activities in Japan: Money Laundering and Scam
In Japan, based on our conversations with major industry players and statistics and documents released by local authorities, we have been observing that the most common illegal use of cryptocurrencies is money laundering from non-cryptocurrencies indigenous crimes and scams.We will discuss how Japan recognizes these issues and explore how to estimate the extent of damage caused by such crimes.
Money laundering for non-cryptocurrency crimes
As mentioned earlier, it is difficult to track non-crypto-native criminal cases on a large scale without background—usually only law enforcement, financial institutions, crypto services and/or victims know.Nevertheless, some of our clients provide us with information to address the attribution issues, allowing us to better understand the situation of money laundering in Japan without cryptocurrencies.According to the information we have received so far, many illegal accounts in centralized exchanges are designed to receive legal funds from traditional forms of fraudulent activities and phishing activities, stealing funds from online bank accounts.We published a blog last year discussing an on-chain analysis of a Japanese money laundering case starting with non-cryptocurrency native crimes.
According to statistics for 2023 released by the Japan Police Agency (JNPA), in 2023, Japan reported a total of 19,038 fraud cases, with a total loss of 4.526B yen (about 300 million US dollars).These figures surpass the 2022 figures, indicating that such fraudulent activity is still growing and remains a serious problem.Although these statistics do not address the amount of fiat currencies converted to cryptocurrencies, as we explore later, a large portion of our assessment is money laundering activities based on cryptocurrencies.
In this case, nearly half of the reported stolen funds (total of 8.73B yen ($57.89 million)) were sent to banks in cryptocurrency exchanges, according to a report released by the JNPA Cyber Affairs Bureau.Account.These funding flows suggest that cryptocurrencies are now used as a common tool for fraudsters to launder money.
Fraud trends that affect Japan
As stated in our Cryptocurrency Crime Report, scams are one of the most serious illegal categories in cryptocurrencies.We have previously discovered a well-known cryptocurrency fraud cluster with touchpoints in Japan, but today, Japanese law enforcement agencies are also closely following new trends in scams – investment scams and love scams based on social media.
Recent investment scams have frequently slew investment-hunting ads on major social media platforms to attract the attention of potential victims.Scammers impersonate famous economists or celebrities to attract more followers and guide them into the group channel of popular messaging apps through URLs on the ads, many of whom are proactive in commenting and applauding channel hosts.Victims are attracted to talk to scammers (who usually call themselves channel owners or assistants) and are eventually instructed to trade on fake investment sites.
Romantic scams, also known as “pig killing scams,” because bad actors call them “fattening” victims to get the most possible value, a major and growing problem with cryptocurrencies.Pig killer scammers first establish a relationship with the victim for a period of time (usually romantic, as the name suggests), usually by pretending to send the wrong number text message or through a dating app.As the relationship deepens, the scammers will eventually prompt the victim to invest funds (sometimes cryptocurrency, sometimes fiat currency) into a fake investment opportunity and continue to do so until finally severing the connection.
The latest statistics from JNPA against such scams show that the figures from January to August this year are as follows, significantly higher than last year:
-
Investment fraud:6,868 cases have been reported, totaling 64.14 billion yen (USD 424.97 million) – 9.9% of which are cryptocurrencies
-
Romantic scam:4,639 cases have been reported, totaling 23.65 billion yen (USD 156.7 million) – 17.7% of which are cryptocurrencies
After the Japanese government recognized this as a major threat to Japanese citizens, the cabinet held a meeting to discuss countermeasures and policies, including strengthening the investigation of cryptocurrencies, preventing illegal bank withdrawals, and establishing a legal framework to fully support asset seizure and recovery.
Our on-chain analysis of fraud and fraud cases in Japan
While it is difficult to track off-chain money laundering on a large scale, we can track the flow of funds when our customers remind us of this activity and provide the address and transaction involved, just like we did last year.As we continue to work closely with our customers and partners in Japan to strengthen our data, especially on off-chain money laundering activities, we can also analyze the fraud and fraud situations involved in cryptocurrencies in Japan.
Here are the total received value for clusters reported as fraudulent accounts and frauds in 2023 and 2024 (as of June).
Reported as fraudulent (non-cryptographic native) (total value received from Japanese exchanges) – USD
Reported as a scam (total value received from the Japanese exchange) – USD
As always, we must remind us that these numbers are the lower limits for estimates, especially for off-chain crimes, as many frauds and frauds are not reported.
Nevertheless, these activities share a common pattern: using integrated wallets.Although the initial addresses of funds received directly from the exchange are distributed and transient, funds from these addresses are eventually sent to a much smaller number of private wallets and/or deposit addresses in the exchange.
When we narrowed down the case involving ETH, we found that integrated wallets often use decentralized exchanges (DEXs) or bridges to exchange ETH for USDT.
How to read this image:
– Blue: Funds flow from Japanese exchange to suspicious fraud address
– Red: Funds from the initial address to the first consolidation point
– Green: Funds from the first consolidation point to the second consolidation point
– Purple: Funding from the second integration point to DEX (ETH<->USDT)
Given how fast money launderers can use new wallet addresses, it is not easy to track them individually in real time, but we can still identify common points of integration from our identified clusters to estimate the scale of these illegal activities.In this case, we estimated the amount of potentially illegal funds related to the Japanese case following the following process:
-
Track funds that have been classified as illegal clusters in Japan to find points of integration;
-
At the merge point, the received exposure amounts from the Japanese tag cluster and the Japanese exchange cluster are summarized.
Here is what we found:
Estimated Value of Money Laundering Activities in Non-Cryptocurrency Native – USD
Estimated Value of Japanese Scam – USD
As mentioned earlier, these estimates are consistent with those published by the Japanese authorities.
The changes in money laundering strategies we see from numerous threat actors remind us that the most experienced illegal actors are constantly adjusting their money laundering strategies and leveraging new crypto services.By studying these new on-chain money laundering methods and models and learning how to undermine them, law enforcement and compliance teams can be more effective.
