Bitcoin stolen from FTX being converted to cash via "mixer" | Hacker News Reader

Bitcoin stolen from FTX being converted to cash via "mixer"

bbc.com

I still don't understand how crypto mixers are supposed to work. Surely if you dump stolen crypto into a mixer with other bitcoins then all of it can and should be treated as tainted.

btc's aren't real. There is no such thing as a bitcoin. It's just a ledger system, so if you can hide/ or obfuscate the wallet address the btc are pointing to, you can hide the transaction history. Now this involves transfering BTC for another asset and then purchasing clean bitcoin on the otherside with a headless transaction in the middle. A random number of different wallets, and ledger entry's but it's all the same to the user.

Sure, it's more obfuscation than money laundering, but it can still make it hard to trace given sufficient participants. One big part is also splitting up a big single wallet into lots of smaller ones, so now you need to differentiate your privacy freak from your marketplace consumer from your small time marketplace seller from people you actually want to catch. You can also repeat the process. Eventually the traces become hard to follow, especially when the person only uses relatively small fragments from the output.

plausible deniability

I don't know about bitcoin but for Ethereum, many big mixers were funded by advocates for privacy. So there is deniability if you mix your illegal proceeds with legimate ones. It's not much different from cash in a way.

It's also possible to remove the link to mixer if you bridge on the Ethereum side. So you would have a wallet with a different currency with no link back to where it came from.

It often is.

I had my PayPal personal account immediately frozen and closed without recourse just for (unintentionally) putting a few hundred dollars of bitcoin through a mixer.

1. Purchased $200 of Bitcoin via PayPal (never doing this again — took weeks to settle) 2. Created a receiving wallet address with a wallet app 3. Moved Bitcoin from PayPal to new wallet address.

This was innocuous, I wasn’t trying to cover my tracks in any way.

What I didn’t know is that the wallet had an automatic tumbling feature, so the money I put in got mixed.

And PayPal immediately closed my account. Tried every way to get it back but no dice. All funds frozen for 6 months before I could redeem them.

So yes using a mixer can get you tainted.

I wonder how often they freeze accounts, and it is the wrong person, but he is also doing something illegal or shady and can't provide proof of funds so the funds remain locked.

I don’t understand why they don’t put the money into an exchange and convert to Monero and then launder it.

For the sane reason thieves don't just hand everything over to a fence? They know better than to stick their stolen earnings on a place where other thieves can steal it.

There are p2p exchanges that are legitimate and actually decentralized. They can easily convert their traceable bitcoin to untraceable Monero over a few years and they’ll have enough to live off of for years.

the monero market is not big enough to accommodate such a large amount of $

2.8 billion market cap. So a quarter the size of bitcoin. Not sure why you think that wouldnt work.

Wikipedia article for a crypto mixer: https://en.wikipedia.org/wiki/Cryptocurrency_tumbler

Never give up an opportunity to demonize real monetary systems, the good guys.

Be venture capitalist depositing millions in uninsured capital at your VC bank while completely ignoring interest rate risk because you think your buddies can just bully the federal government:

Win infinity free insurance from the U.S. Treasury.

Store capital in the new technology receiving tacit endorsement from the establishment via institutional buy-in, super bowl ads, etc.:

Go bankrupt and then get gloated at by a bunch of midwit redditors.

Both made bad decisions and should lose their money and be mocked by midwit redditors.

The difference is FTX was criminal negligence, SVB ordinary negligence. SVB was due to bad bets the bank was legally allowed to make, FTX was due to bad bets made illegally with stolen money.

The federal reserve's plans to hike interest rates were never, at any point, a secret.

To me, Peter Thiel was "the one that got away" when it came to SVB.

Yes, it was known that SVB had some "concerns", but Thiel, like Nostradamus, laid out an amazingly specific set of instructions to companies he had a hand (or dollar) in:

Wednesday after hours he sent a missive to all his funded companies: "Every single dollar of your company accounts must be out of SVB by COB tomorrow".

Separately, to another one of his companies: "I need you to have a website setup that can accept applications for business bridge loans, I and it needs to be pushed and live by noon on Friday".

Lo and behold, regulators showed up at SVB at 9am on Friday morning and the doors were locked by 11am.

Very remarkably specific, and fortuitous timing by Thiel.

Even if he did have specific information, some might say, so what? He has a right to protect his money, and money he has invested. Sure he does.

But "withdraw all of your money from SVB and do it tomorrow by COB" caused a bank run.

And causing a bank run is a federal felony.

For which no-one will bat an eyelid.

> Wednesday after hours he sent a missive to all his funded companies: "Every single dollar of your company accounts must be out of SVB by COB tomorrow".

I can't find a reference for that quote anywhere online. Could you share your source?

The FDIC almost only does bank closures on Friday (see https://www.fdic.gov/resources/resolutions/bank-failures/fai... - there were a few non-Friday closures after the SVB failure but none before), the guess that SVB would be closed on Friday wasn't that fortuitous.

What law says that causing a bank run is a felony? And what bank are you talking about?

I stand corrected. Up until 2012, it was indeed a felony in California, but there questions of accuracy of information and freedom of speech:

> In California, there’s been an anti-bank run law on the books since 1917 prohibiting a person from spreading false information about a bank’s condition.

that the Supreme Court struck down.

> Many states have laws on the books prohibiting anyone from making disparaging comments about a particular bank’s financial condition.

Sources: https://www.csmonitor.com/Business/The-Circle-Bastiat/2012/0...

https://www.americanbanker.com/news/court-strikes-down-law-d...

This was heavily discussed yesterday. I am willing to wager it is not SBF and the culprit, if he's ever found, liekly resides in a developed country, similar to the Bitfinex case . It's not Russia or North Korea.

Its clearly not SBF himself since he’s under the lens of justice, but it could as well be someone connected to him.

What are the reasons you're confident that it isn't Russia or Best Korea?

a mixer does not convert to cash. it converts/swaps old btc to new btc by attempting to obfuscate there trail

So “mixer” quite literally as “launder”?

Seems so. I wonder how such thing can be legal…

Typically they aren't.

Unfortunately, laws are not magic spells that prevent activity from happening, they merely provide penalties for those caught breaking them.

Unfortunately? It's rather fortunate that that's not the case, as man is fallible and the law is not absolute.

It's not quite the same thing, but similar.

In money laundering you're introducing dirty money into a legal looking business. You pretend that you washed more shirts or cars than you truly did, for instance. You pay tax, and from the outside it looks like you have a fully legit, profitable business.

On BTC, all transactions are public and traceable. You see Alice pay Bob $50. You see Carol pay Dave $25. You see Eve pay Dave $25. A mixer is an intermediary that makes it less obvious who's dealing with who. Everyone puts money into the pool, the mixer at some points sends payments to the destinations, and it becomes harder to tell who's transacting with who.

A mixer can take extra steps to confuse things further, like delaying payments and doing everything in chunks of say $5 at random delays, and rounding amounts, so it's harder to tell from the outside how many transactions there were, and to correlate an input of an odd amount of $123.45 with an equal output.

Some mixers offer swapping for freshly mined coins for a higher fee.

Unlike laundering, it doesn't really make a transaction look legit. You see Alice send $50 to a mixer, but it's harder to tell who it was truly for.

Just say it.

Structuring-as-a-Service.

Things are pretty cut and dry in the finance world. And we have names for these types of things. It isn't mixer. It's Structuring.

I think structuring is splitting a transaction to evade reporting requirements?

Then it's not entirely the same thing. Mixers don't do that to avoid reaching some reporting threshold but to make transactions less identifiable. If 100 people send $1M to the mixer each, mixer sends $1M to 100 destinations, and since all the amounts are the same you can't easily tell who wanted what destination.

Someone getting arrested in a Starbucks in 3...2...1...seconds.

In all likelihood, it's possible, if not probable, that the culprit may be residing in a jurisdiction that openly refuses to cooperate with international law enforcement.

The guys on the other side of this kind of stuff being caught at all is the exception, not the norm.

Since it’s not cash the stolen bitcoins are personal goods. Stolen goods are subject to forfeiture wherever found, even from a bona fide purchaser for value.

Bitcoin is borderless, laws are not.

What about mixers (or just regular Bitcoin transactions with both stolen and non-stolen inputs), though?

Which coins remain “tainted” – none, all, or the same amount that went in tainted? But which?

I don’t know exactly how mixers work but my understanding is that that I can identify even fractions of a coin as having originated from some parent coin. All those fractions are stolen goods.

The coins are fungible, right? So the notion of a “a coin” doesn’t even make sense to me — they’re just numbers in a database.

Let’s say we send 1 clean BTC to address A and 1 dirty BTC also to address A.

Are both those coins now tainted?

If we then send 1 BTC from address A to address B, and 1 BTC from address A to address C, who has the dirty coin? Is it B, C, both, neither?

I didn’t think they were fungible but it’s a long time since I read the paper.

"Coins on the chain" (i.e. unclaimed transaction outputs) are non-fungible, but you can combine multiple of these as inputs into a single new transaction, and in that sense, all transaction inputs are fungible, and by extension their outputs will be too.

So while there are technical differences between the "account" and the "UTXO" models, I doubt it would make any sense in an enforcement context.

Interesting. I bet there’s case law on this (imagine bags of wheat instead of bitcoins) but I don’t know what the rule is.

I would imagine so too.

Intent probably matters; mixing your money through a service that has been widely known to be used to facilitate and obfuscate financial crime is probably not the best look if you end up with tainted coins and their legitimate owner comes knocking on your door.

On the other hand, I don't even know how this works in detail in the traditional banking system, i.e. whether stolen money can be clawed back even if it's already moved across several accounts/transfers, the last of which completely oblivious to its source.

So money is specifically different than goods, which was my original point. But money isn’t based on the properties of the item it’s just defined to be, well, money.

That's what I've been wondering about for a while now: I know about stolen cash having special status in many jurisdictions, but how does this work when it comes to to bank transfers and account balances? These make up almost all of modern "money".

That’s even easier because they are technically fungible as well as legally.

It is possible to say this $100 bill was once stolen so we are going to seize it from you even though you are perfectly unrelated to the crime and just happen to have ended up with it. The law treats money specially and prevents that from happening, but otherwise it could. It can happen with something like jewelry or a car.

With electronic money you don’t even have a practical option even if there was one legally. There’s no specific hundred dollar bill to seize. Banks don’t track with that kind of granularity.

Each transaction points to inputs and outputs. If you make a future transaction with part of the dirty transaction as input, then it is dirty. If you make a transaction that only has the clean one as an input, then it’s still clean.

The coins are fungible, but they don’t get mixed up until they share a transaction.

You can't have "dirty bitcoin" from a mixer, because btc only has opcode and cannot run mixers natively. The base chain for tornado is etheruem. Now the mixers can hold various wrapped assets, like (Wbtc) which i can trade back to real bitcoin at some future time. But the concept of a mixer is i go in with an assets, and i come out the otherside with a pool of other assets and the keys to a random set of wallets on the otherside.

Do you understand the amount of computation and data analysis you would have to do to determine if a coin is "Tainted" or not.

That's absolutely possible with Bitcoin, just not trustlessly: You need to trust the mixer to not run away with everybody's (or just your) coins.

But if there is a trusted mixer, the operation is simple: Every participant in a round of mixing tells the mixer (out of band) where they will be sending coins from, and where they want output coins to be sent to. Everybody then sends all of their coins to the mixer, who then takes all of these coins as inputs, and the out-of-band communicated addresses as outputs.

Now if 10 out of 100 input coins are tainted, the question is: Which of the 100 resulting coins are tainted? All of them? None of them? Or exactly 10 of them (but which ones)?

"All of them" would effectively amount to a ban of mixers (which I consider to be quite likely, if hard to enforce).

"None of them" means legitimizing mixers, and I doubt that US and European regulators have a lot of appetite for that at the moment.

now using a "Trusted mixer" is how you get your door kicked in. None of them is the answer. It's different if you are using a protocol. I am free to execute code as I wish. But an entity "pooling funds together, and distributing them" is obviously a KYC trigger. If said entity is violated KYC laws, they can be punished under international money laundering laws.

> It's different if you are using a protocol. I am free to execute code as I wish.

You're absolutely not. Intentions and outcomes matter, and courts won't care if you achieved the outcome "money laundering" via on-chain code or good old face-to-face meetings and moneys in sports bags.

Note that "writing code that can also be used to facilitate money laundering", "writing code that can reasonably only be used to facilitate money laundering", "writing code that facilitates money laundering and operating it yourself (or selling it for money or a licensing fee to somebody that does)" are all different points on a spectrum.

The main crux of my argument there was the KYC trigger. using centralized mizers, you have having a centralized wallet, without ZK-proofing the headers of the wallet, distributing funds. This can be traced, and in some miners or CIA database, all transactions from that wallet are flagged.

> "All of them" would effectively amount to a ban of mixers.

Again, centralized mixers will be banned. You can plug all the exits to your centralized currency, but you cannot stop someone from trading in the cryptosphere utilizing various "Decentralized mixers" with proper ZK proofs, and headless wallet ledgers.

They're exactly as fungible as a dollar is. A dollar with a unique serial code except every person who's had possession of this dollar has logged that serial number into a publicly visible log, even if they don't put their name next to the entry. But you can spend it like any other history tracked serialized dollar.

Mixers exchange coins without using the blockchain so you can't trace them.

As a simple example of how this is possible: imagine you and I both have 0.1 BTC. We could simply swap wallets which would exchange tokens but that wouldn't be represented on the blockchain at all.

Whoever ends up with that other coin is screwed. Because it’s traceable back to the theft and so subject to forfeiture even if he was a bona fide purchaser for value, which he isn’t in this case.

Nobody ends up with a "the other coin", it ends up as a transaction with many inputs and many outputs on the chain, but none are 1:1 mapped. The sum of inputs and outputs just has to match. So given sufficient inputs and iterations, and keeping in mind that you can split up outputs into as many wallets as you want, it becomes hard to differentiate. You can of course treat it all as tained, but you'll have a lot of small fish and privacy users in the middle to track down as well.

> We could simply swap wallets

How would you prove to me that you don’t still have the key for your old wallet?

No need to swap wallets. Create a single 2of2 multisig wallet where each party holds a key. Send your funds two to different addresses of that wallet. Then you just sign a transaction transferring from both addresses to designated other ones (outside the multisig wallet). Since a "single" signed transaction in bitcoin can have multiple input and output addresses, each party can review the full transaction for correctness (50/50 split to right addresses) before signing.

The only challenge is "filling" the wallet, but doable: one party starts sending small amount to the multisig wallet, then the other party evens out. Increase amount by the amount the other party paid in total, until the preagreed amount is in.

Is there precedent for that with crypto, which is not a physical thing but more like “the notion” of ownership?

The only surprise will be if the criminal is not linked to SBF

Everyone keeps saying this like it's obviously true, but it's not obvious to me at all, and on a betting market I'd lay down good money that it's someone totally unrelated to FTX. SBF and everyone connected to him are under very close surveillance right now; if you knew him at all it would be stupid to think you could get away with this.

To me the much more likely scenario is that somebody had a persistent backdoor into FTX because it was a shitshow with no security, but they didn't act right away because they were waiting for the prize to get even bigger. But then when it all started imploding, they realized it was now-or-never and made their move.

exactly. why would Sam need to hack his own exchange anyway when being CEO literally has the keys to every wallet?

Plausible deniability.

Yes, being hacked is an easy excuse to siphoning the funds away, laundering it with these services and cashing it out on the other side of the world.

The Dread Pirate Roberts ordered passports on his own illegal website.

Smart criminals do stupid stuff all the time.

It would not surprise me at all if this is SBF or another insider’s insurance plan in action.

Where is one supposed to get fake identification passports from? Or, like, was this with the same username he was trying to hire hitmen with, so he's linking a photo of himself to the attempted murder?

DPR ... a one-man how-to guide on how NOT to be a cybercriminal

> if you knew him at all it would be stupid to think you could get away with this.

You don't have to know him; he's made it clear that he thinks rules are for fools.

Why do you think SBF would not do something stupid?

It could go either way. I get the impression that SBF is extremely intelligent but perhaps in a way where he is naive to failure and shoots from the hip a lot.

Reply on news.ycombinator.com