How The FBI Tracks Bitcoin ($3.6B Seized)

[00:00:00]Bitcoin isn't anonymous. It's one of the most traceable assets ever created. And criminals keep finding that out the hard way. [music] Every transaction it's ever made lives in a public ledger anyone can open right now on a block explorer on their phone, and it never gets deleted. In 2022, [music] the FBI reached into one wallet and pulled out $3.5 billion in stolen [music] crypto without cracking a single password. So, here's the whole game. how they trace the coins, cluster the wallets, unmask the owner, [music] and seize the keys. Four steps. The reason they could pull that off comes down to one thing almost everyone [music] gets wrong about crypto. People hear the word and picture a numbered Swiss bank account. Money goes in, nobody knows it's yours. Done. Bitcoin is almost the opposite of that. Every Bitcoin transaction ever made is recorded on the blockchain, which is really just a giant public ledger [music] copied across thousands of computers around the world. You can open a Live Block Explorer right now and watch coins [music] move between wallets in real time. Someone in Tokyo, someone in Berlin, a hacker three [music] hops deep into a laundering scheme. All of it live. What you don't see is names. A wallet isn't Bob Smith. It's a long string of random letters and numbers.

[00:01:14]That gap, addresses on one side and real people on the other, is the only privacy Bitcoin actually [music] gives you. The technical word for it is pseudonymous, not anonymous. Think of it like this.

[00:01:25]Cash really is anonymous. [music] You hand someone a 20 in a dim parking lot and there's no record it ever happened.

[00:01:31][music] Bitcoin is the reverse. Picture a glass wall where every payment ever made is painted on the outside, permanent in the open [music] for anyone walking past to read. The only thing standing between that wall and your front door is the fact that your name isn't printed [music] on it yet and yet is doing a lot of work in that sentence because closing that [music] gap is the FBI's entire job. And it's not only criminals this touches. If you've ever bought crypto on an exchange and sent it to your [music] own wallet, your name is already attached to that first address, and anyone who can see the chain can follow it forward from there. Real [music] privacy on Bitcoin takes deliberate effort, and hardly anyone bothers. So, how do investigators actually crack it open? [music] Four steps. Step one is the boring one, and it also does most of the work. [music] When a crime happens, investigators usually start with one known address. A ransomware victim paid up. [music] Great. They have the exact wallet the ransom went to a hacked exchange. They have the address the stolen coins landed in. From [music] that single starting point, they just follow the coins.

[00:02:32]Picture a transaction graph. Arrows hopping from wallet to wallet. [music] Because the ledger is public, every hop the money makes is right there. Coins [music] go from wallet A to wallet B to wallet C. And an investigator can trace the whole chain without a warrant, [music] without asking anyone's permission, without the suspect ever knowing they're being watched. This is exactly what happened with Colonial Pipeline. [music] In 2021, a ransomware crew called Dark Side locked up the largest fuel pipeline on the US East Coast. Gas stations ran dry. You had lines around the block and [music] people panic filling trash bags with fuel. And Colonial paid roughly 75 Bitcoin to [music] get their systems back, around $4.5 million at the time.

[00:03:13]The Justice Department's own affidavit describes [music] what agents did next in the plainest possible terms. They reviewed the Bitcoin public [music] ledger and tracked the transfers until most of the ransom landed at one specific address. [music] No hacking.

[00:03:25]They read the receipt. A few weeks later, they had clawed back 63.7 [music] of those 75 coins. Here's a fun wrinkle.

[00:03:32]The piece they couldn't grab lines [music] up almost exactly with the roughly 10% cut Dark Side skims off the top for its affiliates. So, the only money that got away was basically the middleman's [music] commission. And the reason it worked so fast is that Colonial called the FBI within hours of the attack before the trail had time to go cold. That speed [music] is half the game. The ledger is permanent, but the sooner investigators start following it, the easier the money is to [music] catch before it gets buried under laundering.

[00:04:00]The gang thought they'd hidden the ransom by moving it around. But on Bitcoin, moving money is like fleeing a crime scene while leaving a trail of glowing footprints the [music] whole way home. Now, smart criminals know they're being followed, so they don't use one wallet. [music] They spread the money across dozens, hundreds, sometimes thousands of addresses to muddy the [music] trail. And this is where it gets good because the way Bitcoin works actually turns them in. Here's the trick. It's [music] called the common input ownership heristic, which is a mouthful. So, watch what it means. When you spend Bitcoin, you often have to combine coins from several of your own addresses into one transaction to [music] cover the amount. the same way you'd hand over three fives and two ones to pay 11 bucks. But the second you do that, you've quietly proven [music] something. Whoever built that transaction had to control all of those addresses at once. Picture several input arrows merging into a single transaction. [music] An analyst can now glue those addresses together into one cluster and say with real confidence, one person owns this entire group. Funny detail. [music] This exact weakness was spelled out in Bitcoin's original white paper back in 2008. It [music] has been baked into the design since day one.

[00:05:08]There's a second tell, too. Every time you spend part of [music] a wallet's balance, the leftover change comes back to a fresh address you control. [music] And by following that change from hop to hop, analysts can chase one stash of money down a whole peel chain, like watching [music] someone peel bills off a roll one at a time. Stack those two tricks together and thousands of decoy addresses collapse back into a handful of real wallets. [music] and the labels.

[00:05:32]An analyst can figure out that a wallet belongs to, say, a specific exchange [music] by literally sending it a small payment and watching where it lands on the ledger. [music] Companies like Chain Analysis have turned all of this into off-the-shelf software. You load a suspect address and get a visual money map [music] with wallets already tagged as ransomware or darknet markets or sanctioned groups. The maze the criminal built ends up as a labeled diagram the analyst [music] just reads off a screen and it snowballs. One wallet you can confirm belongs to a real person can validate thousands of connected transactions around it. [music] One label unlocks the next. So a single confirmed identity dropped [music] into the middle of a laundering network lights up huge chunks of it at once.

[00:06:14]Okay. So the FBI can follow the money and clump the [music] wallets together.

[00:06:18]But a cluster of addresses still isn't a person. At some point the map has to turn into a name. And that happens at one unavoidable spot. [music] Cashing out. Stolen Bitcoin is only worth anything once it becomes real money.

[00:06:30][music] A bank transfer, a car, a house.

[00:06:33]And to convert crypto into dollars at any serious scale, you almost always have to [music] pass through a regulated exchange, a Coinbase or a Binance. Every one of those exchanges is legally required to run KYC, which [music] stands for know your customer. Picture the signup screen uploading your ID, your face, sometimes a selfie holding your passport. [music] So, here's the whole trap snapping shut. Investigators follow the coins across the public ledger, [music] watch them get clustered, and then watch them flow into an exchange. Now, they don't [music] need to break anything at all. They send that exchange a subpoena, a legal order that basically says, "Tell us who owns the [music] account that received these exact coins." And the exchange, which has all your documents on file, tells them that single subpoena is usually enough to strip away whatever anonymity Bitcoin [music] ever gave you. Picture it end to end. An analyst starts on a wallet [music] that got five coins from a known ransomware address, watches it forward two of those coins into a bigname exchange, and now that exchange gets a letter asking [music] who owns the receiving account. The public blockchain walks the FBI right up to the front door, and the exchange's own paperwork hands over the name. And cashing out isn't even the [music] only leak. The moment your wallet software broadcasts a transaction, it announces it to nodes all over the network. And anyone running enough of those nodes can sometimes tie the transaction [music] back to the IP address it came from. So the trail can start forming before a single dollar is ever withdrawn. [music] This is also why criminals get so frantic at the cash out stage. They [music] chain hop between different coins. They buy gold. They run funds through smaller sketchier platforms. All to dodge that one moment where [music] crypto touches the regulated world and a real identity gets stapled to a wallet.

[00:08:15][music] Finding the money and naming the suspect is most of the fight. The last step is actually taking the coins. And here, Bitcoin's own [music] design flips from the criminal's best friend into their biggest problem. A Bitcoin wallet is controlled by a private key.

[00:08:29]Basically, a secret password that proves ownership. Whoever holds the key controls the money. [music] End of story. So, once the FBI has a suspect, they go get that key. Sometimes it's on a seized laptop, agents bagging [music] devices in an apartment. Sometimes it's sitting in a cloud account they've pulled a warrant for. [music] Back to Colonial Pipeline. The reason the Justice Department recovered those 63.7 coins is that agents [music] had the private key to the wallet the ransom flowed into so they could just move the money to a government address and it was over. And the $3.5 billion seizure from the start of this video, same [music] move at an insane scale. First, understand what the couple did. Back in 2016, a hacker named Ilia [music] Likenstein broke into a crypto exchange called Bitfinex and pushed through more than 2,000 transactions, moving over 119,000 Bitcoin [music] into a wallet he controlled, then deleted the lock files to cover his tracks. And here's a detail you can't make up. Morgan moonlighted as a rapper called Razelcon, who put out music videos calling [music] herself a crocodile of Wall Street, while the two of them were quietly sitting on billions in stolen crypto. Their laundering methods were a greatest hits list [music] of everything from steps two and three. Fake identities, software that automated thousands of tiny transactions to slip under the radar, running coins through a darknet market as a makeshift mixer. [music] Chain hopping into privacy coins. And when they finally cashed some out, part of it went to, and this [music] is real, a Walmart gift card they used to pay for Ubers and a PlayStation. Here's the punch line. All that effort, all those layers, and the thing that ended it was simple.

[00:10:07]Investigators got [music] a warrant for their online accounts, and inside one of them, they found a file. That file held the private keys to the wallet [music] still holding over 94,000 of the stolen Bitcoin, worth about $3.5 billion.

[00:10:19][music] Agents decrypted the file, copied the keys, moved the coins to their own wallet, and that was the largest financial seizure in the history of [music] the Justice Department at the time. Sit with the irony for a second.

[00:10:30]These two ran worldclass laundering for 6 years [music] and the whole thing was undone by a list of passwords they'd saved to the cloud. Likenstein eventually got 5 years in prison. Morgan got 18 months [music] and because Bitcoin's price had exploded while the case ground on, the total pile of connected funds the government ended up recovering came [music] to something like $10 billion. As the Justice Department put it, they can follow money through the blockchain and crypto is not a safe haven for laundering. Now, if you know a bit about crypto, you're probably yelling at your screen, [music] "What about mixers? What about privacy coins?"

[00:11:04]And you're right. This is the real counter move. A mixer or a coin join is a service that throws lots [music] of people's coins into one big pot and hands everyone back different coins of the same value, specifically to break that common [music] input trick from step two. Picture coins pouring into a swirling pool and [music] coming out shuffled. If a 100 people mix together, an analyst can't cleanly say which coins [music] came out belonging to whom. But a mixer only slows investigators down.

[00:11:29]The coins still exist. They [music] still leave patterns of their own.

[00:11:32]Investigators have gotten good at matching funds going in one side to funds [music] coming out the other. And the coins usually still have to touch a regulated exchange eventually [music] to become spendable, which drops you right back at step three. On top of that, the big mixers keep getting seized or sanctioned. [music] And when one goes down, its records can go straight into the next investigation. So the safe tool you laundered through last [music] year can become evidence this year. Remember the Bitfinex couple used Mixers. They used darknet markets. They even converted some funds into Monero, the one privacy coin that genuinely hides amounts and addresses at the protocol level. Morgan [music] even took some of the profits, bought physical gold coins, and buried them in the ground, which is about as analog as laundering [music] gets. It didn't matter. They still got caught because you only have to slip up once and the ledger keeps that slip up forever. [music] That's the quietly brutal part. The evidence never expires and the investigators are patient. A laundering job that looks clean [music] today can get unwound 5 years from now when the tools improve because the [music] trail is still sitting right there. The Bitfinex coins were stolen in 2016 and seized in [music] 2022. When they were taken, they were worth $71 million. 6 years later, that same untouched [music] pile was worth over three and a half billion. For basically everyone using Bitcoin, the ledger remembers everything. [music] And this isn't some secret government lab. Tracing crypto is a whole private [music] industry now. Firms like Chain Analysis build the software, sell it on contract, and their biggest customers are [music] exactly who you'd guess. The FBI, the IRS, and law enforcement agencies around the world. [music] The blockchain being public means anyone can audit it. And it turns out anyone very much includes the people trying to arrest you. [music] So the four steps, follow the money across the public ledger, cluster the addresses back into real wallets, wait [music] for the cash out, and subpoena the exchange for a name. Then seize the private keys, and [music] take the coins. The strange part is that none of it requires beating cryptography. It works because of how Bitcoin is built, not in spite of it.

[00:13:34][music] The whole pitch of crypto was cutting out the trusted middleman, the bank that watches every move you make.

[00:13:40]But the blockchain didn't delete that ledger. [music] >> [music]