How crypto forensics traced $32 million worth of ‘lost’ bitcoin

Full Transcript

Angie Lau: What happens when you lose your bitcoin, or worse, if it’s stolen from you? Do you lose it forever? How is the law starting to regulate digital assets and ownership? 

Welcome to Word on the Block, the series that takes a deeper dive into blockchain and the emerging technologies that shape our world at the intersection of business, politics and economy. It’s what we cover right here on Forkast.News. I’m Angie Lau, editor-in-chief. 

We’re focusing on a three-year-old cyber theft case where close to US$32 million went missing at Dooga — this is a U.K.-based crypto exchange. Now, that theft led to the exchange’s bankruptcy. The stolen crypto traced to two accounts held in the U.S. and now returned to its rightful owner, the now bankrupt firm’s liquidator, trying to get those funds back. In this month, January 2021, a U.S. federal bankruptcy judge ordered that the digital assets held in those two accounts at two U.S.-based exchanges be returned to those U.S. liquidators. 

Well, joining me today is the legal representative of Dooga. The man who helped track down the lost digital assets — one of the leading minds in the legalities surrounding blockchain and crypto, and some forensic skills to boot — Kobre & Kim partner Ben Sauter. 

Ben, welcome back to the show. 

Benjamin Sauter: Thank you. It’s great to be back. I appreciate it.

Lau: Now, one always assumed that once it got hacked, once you lose it, you can’t get it back. Walk us through this case. How were you forensically able to trace these funds to the perpetrators? 

Sauter: The idea that lost bitcoin is lost for good is a common misperception. And depending on how it’s taken and where it’s sent, you actually have some different ways and different remedies to get it back. It could depend on the particular circumstances but in this particular case and other matters I’ve been involved in, you’d be surprised how often you’re actually able to trace bitcoin through forensic techniques to exchanges and other points of intersection where KYC is conducted, where assets are exchanged for other types of assets, and when that happens, there actually are opportunities and increasingly well-accepted ways to get assets back.

Lau: Not to give up any kind of proprietary forensic investigative tools that you have, but a lot of people would just assume that this is blockchain, this is anonymous, and that’s the whole point. How are you able to trace the series of numbers and letters around cyberspace?

Sauter: Well, maybe an example would be helpful. An example I can share is at a high level, what happened in the Cubits matter. 

So Cubits was an exchange like others that the audience may be familiar with, Coinbase, etc. 

Lau: So Cubits is Dooga, the U.K. exchange we’re talking about here. 

Sauter: Yes, it used to do business as Cubits. Cubits was an actual exchange. After the fraud in question it went out of business and became known as Dooga. But at the time, and some viewers may be familiar with it, that it was doing business as Cubits. And one thing is common for exchanges like this to do, particularly when they’re working in certain Asian jurisdictions as to work with payment processors who actually take in funds from customers and have a contractual relationship with the exchange. So in this particular fraud Cubits opened accounts for [those] who turned out to be the wrongdoers. Those wrongdoers purchased bitcoin through Cubits and then tried to withdraw. And Cubits was told by its payment processor — who turned out to be part of the fraud — that it had received funds as one end of this transaction. So the exchange allowed the bitcoin to leave its wallet to the account holders. 

The problem is it never got the other end of that transaction, never got paid for the bitcoin that it allowed to leave. So it was out — as you mentioned at the intro — US$32 million dollars, which caused the exchange to go out of business — this was in early 2018. What we were able to do when we were engaged was really two things. One, we knew — because we’d conducted some KYC ourselves — who the wrongdoers were, which allowed us to pursue a strategy of government enforcement and government contact and local jurisdictions. 

But because we had sent the bitcoin from our own addresses, we were able to see on the blockchain the addresses that received those funds. So some people who are sophisticated at conducting frauds will run bitcoin through mixers and tumblers and ways to conceal and obfuscate the nature of those transactions. And some of that happened here and we were actually able to link the proceeds of this fraud to some well-known money laundering rings. 

But the state of forensics and blockchain right now is getting so good that you can actually see through quite a bit of that. And we were able to see through and trace from one wallet to the next where those transactions went. And what happens is when those wallets send to a known exchange that will appear in a commonly used forensic software. So we were able to see transfer after transfer. 

Eventually, the assets hit some exchanges in the United States and also exchanges elsewhere in the world that we’ve been able to identify. And once you see funds land at an exchange, you have a degree of hope that the exchanges did their job and kept KYC and also that they can freeze those accounts and can and often do respond to court orders, directing them to freeze and ultimately turn over those assets. And that’s exactly what we did and what happened in the Dooga case.

Lau: And that’s exactly what happened. As you said, the U.S. federal bankruptcy judge ordered that these assets that you were able to trace back to those U.S. exchanges be returned to the rightful owner, Dooga. Now, this sets some pretty interesting precedents. It essentially allows — in the United States — a judge has essentially set a new precedent that is able for somebody who’s been victimized to retrieve your own stolen funds.

Sauter: That’s right, I’ve actually been involved in a few different cases — to my knowledge were first of their kind — availing themselves of different procedures to get to that type of order.

What was interesting about the Dooga matter is it was a legal procedure, seeking to recognize a foreign bankruptcy. So when Dooga went out of business, it went out of business in the U.K., which is where it was based. But there is a procedure to recognize that bankruptcy in the United States. Once you do that, you can consolidate all of the other people who may be holding assets into one proceeding. So it becomes a very efficient way to resolve ownership rights in assets that you can identify in the United States. Essentially, any exchange [and] its holding asset that we could connect to that fraud becomes an asset of the estate. And once you can call an asset an asset at that estate, the bankruptcy court can issue an order awarding property rights effectively over that asset and that results in exchanges transferring those assets to us.

So this particular matter had the benefit of there being a foreign bankruptcy proceeding that we could incorporate into the United States. I think that was the first time, to my knowledge, that particular technique had been done to successfully recover assets from the United States. But I’ve also pursued similar orders, other ways by filing what’s called John Doe lawsuits, where you get subpoena power and eventually court orders that can issue orders as to assets that may be held by exchanges as well, even if you don’t have a bankruptcy proceeding to piggyback off of. So there are some different ways to get the same result.

Lau: So this is actually really interesting for a lot of people who still have the impression that it’s anonymous, you can’t track it down, that it’s untraceable, and it really also runs counter to a lot of even high level regulators who say that there’s a level of opaqueness that criminals can hide behind when, in fact, forensically, it has been very clear [that] it’s elevated to the point where you can actually see where this money or these assets are going right down to the fifth or sixth layer of the next exchange. It runs counter to so many of these impressions. What’s the reality of how traceable cryptocurrency actually is? 

Sauter: The reality is somewhere in between. From one transaction to the next, you may not know who is behind a particular wallet address and if digital assets are sent to cold storage wallets, you’ll be able to see that transfer on the blockchain or most blockchains, but you won’t necessarily know who is behind or who controls those wallets. The way you get that information is by tracing it from wallet to wallet until it hits a known entity or a known person. And there are lots of lists and there are companies that sell proprietary software that will tell you who is behind known wallets or clusters of wallets. And so if those transfers, you don’t necessarily know. But if you do see that it hits in exchange, then at that point you have the ability to get any information that exchange has about who controls that wallet. So if the exchanges are doing their job and conducting KYC and have accurate KYC about their account holders, then you can learn the identity of that person who controls that wallet from the exchange or from other businesses that operate in this space.

Lau: It’s kind of like AML, anti-money laundering techniques where you’re looking for that big windfall or that big withdrawal. And that’s a huge clue that connects back to: ‘Okay, when was this?’ If you watch any Hollywood film on bank robbers, you can see that you don’t want to spend [the] proceeds of your crime all in one time. And you certainly want to escape to the jurisdiction where it’s a little bit more opaque. So that’s essentially harder to do when everything can be digitally traced. What does this mean for all of those future victims that fall to cybercrime? 

Does this mean that, in fact, there are actually techniques and strategies to get you whole again? 

Sauter: In a lot of ways, this makes it easier, not harder, easier for victims of fraud to figure out who the perpetrators are and ultimately recover their funds. In traditional asset recovery matters, you serve subpoenas to a bank, then you learn who was at that bank. You take another month and you send a subpoena to another bank, and you unwind a series of transactions to a series of subpoenas that often take you overseas. Just that process of learning who’s behind one transfer to the next can take months, if not more. Whereas the blockchain, you can see all of that in real-time. And issue one subpoena to the endpoint in the chain, the exchange that received the funds. So there is a very, very real sense.

The process of tracing the money to a known entity can be quite a bit easier in blockchain. And the linchpin is that somebody out there is collecting know-your-customer (KYC) information, which is why the Bank Secrecy Act and KYC requirements have been taken very seriously by governments around the world and increasingly in the United States, because that KYC is what enables governments and victims of fraud to be able to use the blockchain but actually connect  it to the real world.

Lau: What other developments can we expect from this case that has a wider impact on the entire crypto industry, in your view?

Sauter: Well, I think it is a great reminder to the industry of creative options that are available to you to identify perpetrators of fraud, to hold them to account, and ultimately recover assets. And I have seen personally an uptick in interest in doing exactly this with the rise in the price of bitcoin and other digital assets recently. Asset recovery efforts that may not have been economic just a month or two ago all of a sudden seem like they may be worth devoting resources to. And I think this case came at a good time for the industry as a reminder of what they can accomplish if they do devote some resources to a recovery campaign.

Lau: It certainly wasn’t necessarily worth it when you once upon a time buy pizza with bitcoin, but it certainly is worth it. Now, to your point, having hit a number of all-time highs, although this case could be seen as a precedent for centralized exchanges. What do you think this could mean for decentralized exchanges? Could this be a benchmark? Would it even have an impact at all? What are your thoughts there?

Sauter: So this particular procedure, it’s a creature of United States law trying to get back assets in the United States. 

So decentralized exchanges will present different issues if assets that are going through them are not held in the United States. So this particular procedure may not be the way that you would want to trace or recover assets potentially if you’re trying to get them out of account holders or entities or persons who are not located in the United States. But nonetheless, it is a reminder of how you can link different strategies together as part of an asset recovery campaign and be it a decentralized exchange or a centralized exchange. There’s always some real person at the end of the trail. And the trick, from my perspective, is putting together a plan across borders, to figure out who that person is and what the best way is to get money back. And it’s maybe some combination of law enforcement of that person’s personal assets and actually tracing assets through the blockchain.

Lau: Do you think there’s enough global cooperation right now among regulators and law enforcement?

Sauter: From the perspective of an attorney who’s trying to recover funds on behalf of victims of fraud, I think there could be more. But over the past few years, I think governments around the world have just been trying to get their heads around the technology and understand it. 

I think we’re there now in many parts of the world, and hopefully, the impetus to begin sharing that knowledge and cooperating to set up a regime where victims of fraud have recourse is sort of the next step in that evolution.

Lau: So on one hand, you recovered the funds. It’s been returned to the U.K. liquidators of Dooga. The perpetrators are understood to be three Chinese nationals and a Malta-based transaction company. What happens there? You’ve got an order signed by the northern district of California. Are there efforts trying to extend the law to these jurisdictions? Malta? China?

Sauter: So I can only get into this so much, but the bankruptcy effort that resulted in this turnover of assets is only one of the multiple things that we are trying to do across the world to bring assets back to the estate. So you’re right, there are many jurisdictions that are involved in this particular matter. And we have developed strategic options to sort of leverage different jurisdictions.

Lau: For all of those watching and thinking: “Okay, does this mean if I lost my bitcoin, I can get it back?” What are the basic things that a retail investor can do? 

Case number one, you lost your password, you lost your key. I’m thinking of that one guy who has only a couple of chances left on guessing is his code to get to his bitcoin or it’s lost forever. Where has the level of forensics risen to help people like that? There’s no malicious actor. It’s that: “I don’t even know where my key is.”

Sauter: Yeah, that’s a very unfortunate scenario, and I think one that happens more often than we like to hear. Frankly, those people may be out of luck. The promise of blockchain technology is that it’s cryptographically secure. And many of them, especially the cold storage, wallet solutions that are out there, are specifically designed to not work anymore after a certain number of incorrect passwords. And maybe supercomputers will change this one day but for the time being, you don’t want to lose those passwords. And there’s not much from a legal perspective we can do to help you. Where we can, from a legal perspective, come in to help you is when you need information from somebody who doesn’t want to give it to you or you need assets back from somebody who controls them but doesn’t want to give them to you. And that’s really where the interaction from the legal system comes into play.

Lau: And finally, for those regulators and government officials who believe that, forensically, there’s still enough opaqueness to hide ‘funny business.’  What in actuality are regulators or government officials be assured about in the ability to actually trace malicious actors?

Sauter: Well, in the United States, for example, the FBI in many cases [have] become very sophisticated at it and it’s not that rare to find press releases issued by the U.S. government of them having seized hardware servers, cold storage wallets, and used their ability to find passwords and actually take into their control bitcoin or other digital assets that could be accessed through those passwords. So it’s become something that in particular the U.S. government has focused on cases of cybercrime.

There are a lot of examples of the FBI seizing and taking control of bitcoin and sometimes returning those to victims as well. So I do expect [that] you’ll see more of that, particularly as it becomes more and more mainstream for people to hold their assets in a digital form. It will become increasingly important not just for law enforcement, but for trustees of the companies and liquidators of companies and really anybody who comes in to control a company to understand how to marshal those assets and get them to the right people.

Lau: I know that you are increasingly busy, so I appreciate the time that you’ve spent with us and informing and educating a global audience to understand that it can be traced truly around the world. Ben, just one last question, real quick. I know that you’re fielding a lot more calls as the price of bitcoin and cryptocurrency has risen. How much more busy are you, would you say, in terms of your office? 20, 30, 40 percent? What’s the percentage increase you’ve experienced?

Sauter: That’s probably a good estimate. My practice and my firm’s practice focuses exclusively on disputes and investigations. We tend to see an increased volume of calls when people are involved in disputes. And we tend to see more disputes when volatility hits the market either because it’s worth a lot more and people realize there’s value in getting their fair share of it. Or when prices fall, then people tend to fight over what remains. With the volatility comes, I think more interest in litigation.

Lau: You’re going to be one of those markers for me, that’s for sure. Ben Sauter, as usual, always a pleasure to speak with you. And I know you’re going to be headed for a busy year, but we always appreciate the time that you spend educating us all about the latest thing in this industry. Ben Sauter there, partner of Kobre & Kim. Thanks for joining us.

Ben Sauter: Thank you, Angie. Thank you for having me.

Lau: And thank you, everyone for joining us on this latest episode of Word on the Block. I’m Angie Lau, editor-in-chief of Forkast.News. Until the next time.