UK police have seized cryptocurrency worth £322m over the past five years, according to official figures obtained by the New Scientist publication following a freedom of information (FoI) request.

The funds were taken during multiple criminal investigations over this period, highlighting how cryptocurrencies are increasingly used in illegal activity. This is primarily due to the challenges law enforcement face in seizing digital currencies compared to cash. One of these is that cryptocurrencies are often protected by strong encryption, which is impenetrable without a key. It is also difficult for law enforcement to seize cryptocurrency under existing legislation in the UK, even if there is suspicion it has been gained from criminal activity.

The £322m worth of funds were seized by 12 of the UK’s 48 police forces, although the true figure could be much higher because 15 forces reportedly did not respond to the New Scientist’s request. In addition, the UK’s National Crime Agency, which is exempt from FoI legislation, has not revealed how much cryptocurrency it has seized.

Almost all (99%) of the seized cryptocurrencies were Bitcoin, although small amounts of Ethereum, Dash, Monero and Zcash were also confiscated.

Commenting on the story, Jake Moore, former head of digital forensics at Dorset Police and global cybersecurity advisor at ESET, said: “Police forces have come so far in digital investigations, yet the final step of confiscation is simply too difficult to examine in many situations. The key design of cryptocurrencies is to keep them secure from interception from anyone, whether that be a threat actor or law enforcement, plus they were not intended to have a back door for any reason. This naturally causes a problem for police forces wanting to seize through the original procedures they are all used to with old-fashioned finances. In some cases, criminals may be locked up without giving away access to their funds, only to see huge returns on their release from jail.

“Digital investigations still remain in their infant phase and require far more resources to improve fighting this growing criminality. Cyber-criminals are very aware of the well-documented evasion tactics available but policing is improving at a rate that will slowly catch up in time. Deploying better surveillance techniques on known suspects, increasing intelligence and improving the profiling on those who are thought to be involved all helps build stronger evidence to recover and seize funds. However, the cost of this could potentially outweigh the amount that is recoverable in many cases.”

Last year, Europol revealed it had observed the proliferation of new money laundering techniques involving cyptocurrencies, a trend exacerbated by the COVID-19 pandemic.

A Californian man has admitted his part in a $50m conspiracy to defraud scores of investors via lookalike scam websites.

Allen Giltman, 56, of Irvine, pleaded guilty to one count of conspiracy to commit wire fraud and one count of conspiracy to commit securities fraud.

For eight years up to October 2020, he’s said to have conspired with others to build and run websites to solicit funds from investors. Many were designed to look like legitimate sites run by financial institutions or non-existent but legitimate-seeming companies.

To enhance the sites’ legitimacy, the conspirators would falsely claim their ‘institutions’ were regulated by the Federal Deposit Insurance Corporation (FDIC), the Financial Industry Regulatory Authority (FINRA), the Securities Investor Protection Corporation and the New York Stock Exchange.

They claimed deposits would be protected and used real names and logos of the companies they impersonated.

Lured in by higher-than-average rates of return on their certificates of deposit (CDs), the victims usually found the sites via internet searches, according to the Department of Justice (DoJ).

Giltman typically fielded introductory calls and emails from these victims, impersonating real FINRA broker-dealers using their names and FINRA Central Registration Depository numbers. He then provided would-be investors with application forms and instructions on how to wire funds for CD purchases.

In reality, no investor ever received a CD, and their funds were apparently moved to various international bank accounts in Russia, Georgia, Hong Kong, and Turkey.  

Investigators identified around 70 victims of the nationwide scheme and as many as 150 scam sites.

Giltman faces a maximum jail term of 25 years and will be forced to pay $500,000 or twice the gross amount of gain or loss from each offense, whichever is greater. He is also facing a civil complaint filed yesterday by the SEC.

Investment fraud is among the highest-grossing cybercrimes, according to the FBI. It revealed that over $336m was lost to fraudsters in 2020, more than any other crime type bar romance scams and business email compromise.

Over 8700 victims were identified during the reporting period.

A securely vetted cryptocurrency firm appears to have scammed customers out of millions after its developers made off with their deposited funds.

Arbix Finance was a yield farming firm previously audited by decentralized finance (DeFi) security player CertiK.

However, earlier this week, CertiK tweeted news that it had performed a classic “rug pull” scam. Also known as “exit scams,” these involve project developers running off with investor funds.

The security firm explained that those in charge of the depositor contract at Arbix directed $10m of investor funds to unverified “pools” – a tool used to deposit and withdraw funds in DeFi ecosystems.

An unknown hacker then drained the assets from these pools and converted them to Ethereum through exchange AnySwap USDT.

“The exploited contract was not in the audit scope that was done for Arbix,” CertiK explained. “The project inserted eight `mint()` functions to a newly deployed ARBX ERC20 contract which allowed the owner to mint any amount of ARBX tokens to any address.”

The fact that Arbix Finance was previously certified highlights the difficulty investors face in the world of DeFi.

However, rug pulls are increasingly common. According to one report, over a third (37%) of the revenue generated from cryptocurrency fraud in 2021 came from such scams, versus just 1% the previous year.

This generated more than $2.8bn for fraudsters in 2021.

“Rug pulls are prevalent in DeFi because with the right technical know-how, it’s cheap and easy to create new tokens on the Ethereum blockchain or others and get them listed on decentralized exchanges (DEXes) without a code audit,” explained Chainalysis.

Yield farming is a particularly attractive prospect for investors, and a valuable lure for fraudsters, because it offers the promise of generating “interest” on cryptocurrency in a similar way to the annual percentage yields banks offer depositors of fiat currency.

Credential stuffers have compromised over a million customer accounts linked to 17 well-known companies, New York’s attorney general has confirmed.

Letitia James yesterday announced the results of a “sweeping” investigation into the practice, in which hackers use automated software to try breached log-ins across multiple accounts simultaneously to see if any fit.

Once inside the accounts, they look for personal and financial information to steal and/or try to buy goods with saved cards fraudulently.

As James said in her notice, the practice is made possible because many people use the same passwords across multiple online accounts.

New York’s Office of the Attorney General (OAG) has alerted the relevant companies so they can reset passwords and notify affected customers, claiming most of the malicious activity had not been detected.

It also released a guide outlining how organizations can detect, defend against and respond to credential stuffing attacks and prevent any follow-on fraud.

Bot detection services were recommended as an effective way to spot and block such attacks, as threat actors typically use these automated applications.

The OAG also urged firms to offer customers multi-factor and passwordless authentication options to foil their attackers. This means that hackers cannot access accounts even if they obtain a password.

Cyber-criminals ramped up their credential stuffing activity during the pandemic. Akamai detected 193 billion such attempts globally in 2020, including a 45% increase in attacks on the financial sector.

However, the retail, hospitality and travel sectors are most frequently hit.

In 2020, the same vendor released research claiming that 60% of attacks detected over the previous two years were aimed at these verticals, with retail accounting for over 90% of the total.

That’s because these accounts often have saved store cards which can be used in follow-on fraud and can be poorly protected compared to, say, online bank accounts.