TRM Labs

🇩🇪 This week, German authorities announced the arrest of an individual with German, Polish and Moroccan citizenship at the Cologne/Bonn airport related, in part, to his “transfer of nearly USD 1,700 in cryptocurrency to an address linked to the Islamic State Khorasan Province (ISKP). The individual, according to reports, applied for a position at the European Football Championship (held in Germany in June/July 2024). Over the last few months, ISKP has been encouraging its supporters to target sporting events including major soccer/football matches.    Following the arrest, TRM Labs observed ISKP quickly move funds on the blockchain. This is similar to ISKP’s on-chain behavior following the terrorist attacks in Moscow in March, which were attributed to the group. As TRM reported in March, ISKP continues to utilize cryptocurrency to fundraise and fund its activities around the world. TRM currently tracking dozens of fundraising campaigns associated with terrorist groups around the world. We are committed to supporting law enforcement globally who are working tirelessly to thwart terrorist attacks and continue to monitor the movement of funds.

In this week’s edition of The Weekly Roundup, Ari Redbord, Isabella Chase, and Angela Ang take a closer look at these top stories across the cryptoverse: ➡ Korean regulators report high numbers of VASP closures, with more expected ➡ Snap, crackle, pop: Elections across EMEA ➡ German authorities arrest man suspected of sending nearly 1,700 USDT to ISKP ➡ Ireland increases number of licensed VASPs ➡ Get ready for the June 30 MiCA deadline ➡ Funds returned to Nirvana after July 2022 hack ➡ Live with TRM’s policy team: Quarterly crypto policy roundtable, June 25 or 26 Read on for the full roundup ⬇️

2024 has already brought a ton of action in the global #crypto policy space. And our team of experts—Ari Redbord, Angela Ang, and Isabella Chase—are eager to dig into the details. Join us for our quarterly crypto policy roundtable on June 25 or June 26, where we’ll explore what’s changed, what’s new, and what’s on the horizon for global policy and regulation. You’ll learn about: ✅ The biggest stories that grabbed headlines in the first half of 2024 ✅ The hottest topics shaping the global policy agenda today ✅ How new regulations are shaping the industry as major deadlines loom ✅ Whether these regulations are reducing rates of crime or increasing integrity Please note that we’re offering this session in multiple time zones. Please select the session that best suits your region and time zone! Register now 👉 https://hubs.la/Q02B7kYY0

This morning, the U.S. Department of the Treasury's OFAC issued robust new sanctions against 300 individuals and entities supporting Russia's war effort. Key actions included: ☑️ Secondary Sanctions Risk: Foreign financial institutions now face a higher risk of sanctions for conducting significant transactions or providing services involving any person blocked under Executive Order (E.O.) 14024, including major Russian banks. ☑️ Expanded SDN List: The Treasury has updated the SDN List to include the foreign locations of five sanctioned Russian financial institutions. ☑️ Software and IT-Related Services Prohibitions: New restrictions on the supply of IT consultancy, design, support services, and cloud-based services to any person in Russia. ☑️ Targeting Russia’s Financial Infrastructure: Designations have been made against Russia's largest public trading markets and financial service providers. ☑️ Sanctions Evasion and Circumvention Networks: Over 90 individuals and entities involved in evading sanctions and supporting Russia's war economy through complex transnational supply chains have been designated. ☑️ Domestic War Economy: More than 100 entities within Russia’s defense, manufacturing, technology, transportation, and financial services sectors have been targeted, reflecting Russia's transformation into a war economy. Today's action targeted sanctions evasion networks. One such network involved Russian national Andrey Dmitriyevich Sudakov (Sudakov), an employee of U.S.-designated Russian state-owned gold producer Public Joint Stock Company Polyus (Polyus). According to Treasury, Sudakov engaged in a complex, multi-layered laundering scheme whereby payments from the sale of Russian-origin gold were converted into fiat currency and cryptocurrencies through numerous UAE and Hong Kong-based front companies. The scheme used numerous Hong Kong-based trading companies to route payments related to gold sales through foreign financial institutions back into the Russian financial system. The scheme also leveraged a UAE-based front company to obfuscate payments from the sale of Russian-origin gold. The laundering schemes set forth in today’s action are consistent with what TRM has been seeing for some time – that is, Chinese manufacturers of electronics being used for Russia’s war effort including Chinese companies shipping parts to Russia, the involvement of Chinese middlemen, coordination between Russian and Chinese logistics companies, and Russian cryptocurrency traders facilitating payments to companies in China. Cryptocurrencies have been used for payment of goods and services as well as for payment for the transport of goods. 📑 For more check out our full blogpost on today's designation.

Work in law enforcement? Join TRM’s LEO Labs EMEA working group on June 18 for an in-depth discussion on #ransomware. You’ll learn more about the challenge of ransomware across the United Kingdom, hear how National Crime Agency (NCA) and South West Regional Cyber Crime Unit are fighting ransomware both strategically and operationally, and get insights from TRM Labs experts on how blockchain intelligence can be used to combat ransomware. LEO Labs is a TRM-facilitated community of interest, hosting monthly meetings that bring together investigators in law enforcement with a professional interest in cases involving cryptocurrency as an enabler of criminality. Save your spot ➡️ https://hubs.la/Q02BxmC60

In our latest #TRMTalks, Financial Crimes Enforcement Network, US Treasury’s virtual assets lead Kevin O'Connor sat down with Ari Redbord to discuss the dynamic and evolving nature of #crypto regulation, and the critical role of blockchain intelligence in ensuring a secure and compliant financial ecosystem. Their conversation covered: ✅ SAR reporting—While the traditional view of SAR reporting is for individual bad activity, Kevin reflected on the ability to also understand macro trends from the use of blockchain data. ✅ Holistic approaches to illicit finance—FinCEN uses #blockchainintelligence to look at illicit finance comprehensively—making it easier to identify potential leads for investigation and understand illicit finance networks and trends. ✅ The importance of regulatory balance—Kevin highlighted the need for regulators to balance privacy for lawful users with preventing illicit activities, such as North Korea’s laundering through decentralized mixers. ✅ The future of regulation—Feedback loops established by the Anti-Money Laundering Act of 2020 help facilitate collaboration with government partners, law enforcement, and the private sector. ✅ Collaboration and best practices—How FinCEN works closely (and globally) with law enforcement, regulators, and international partners. 🎧 Listen to the full episode ➡️ https://lnkd.in/gVCbhcwZ

🚀 Our May 2024 product updates were all about efficiency, delivering more actionable insights, and improving user-friendliness. Here’s what’s new and improved: ✔️ Enhanced Wallet Screening: Easier rescreening and better bulk screening, all with a faster UI ✔️ Expanded transfer labels: Now including contract creation and destruction, providing deeper insights into blockchain transactions ✔️ Smarter search results: Improved fuzzy matching in TRM Forensics to find entities more easily ✔️ Improved accessibility: Enhanced compliance with WCAG 2.1 A/AA standards, keyboard navigation, and high-contrast readability Get all the details and learn more about how these updates can benefit your organization ➡️ https://hubs.la/Q02B7Vdm0

Cryptocurrency use is becoming increasingly prevalent in the international drug precursor trade.  In our latest report, we found that 97% of the over 120 Chinese precursor manufacturers we studied offered payment in cryptocurrencies, and received over USD 26 million in cryptocurrency in 2023. Between 2022 and 2023, the amount of cryptocurrency deposited into wallets linked to Chinese precursor manufacturers increased by over 600%—and more than doubled in the first four months of 2024 compared to the same period in 2023. Get all the details about our latest report, “Beyond Fentanyl: Cryptocurrency’s role in the international synthetic drug precursor market,” and download your copy now ➡️ https://hubs.la/Q02B8lyT0

Recently, the U.S. Department of Justice announced the takedown of the 911 S5 botnet in a coordinated international operation led by law enforcement in the US, Singapore, Thailand, and Germany. 911 S5 enabled a plethora of crimes—from cyber attacks to fraud to child exploitation—by allowing cybercriminals to disguise their digital tracks using compromised victim computers. 911 S5 compromised over 19 million unique IP addresses worldwide, making it likely the largest botnet in the world. Its alleged administrator, Chinese national Yunhe Wang, allegedly received more than USD 99 million in illicit proceeds (in both fiat and crypto), which he laundered and spent in various assets. The unsealed indictment identified a multitude of assets subject to forfeiture, including more than a dozen bank accounts and two dozen crypto addresses; as well as properties, domains, luxury cars, and watches. The Federal Bureau of Investigation (FBI) worked with international partners to dismantle botnet through several coordinated measures. Wang was arrested in Singapore, and assets worth approximately USD 30 million were seized across the various jurisdictions. The U.S. Department of the Treasury's Office of Foreign Assets Control also sanctioned Wang and two alleged collaborators for activities associated with 911 S5. Wang is currently pending extradition to the US, which he has contested. Read more here: https://hubs.la/Q02B5vH40

As #blockchain technology becomes more widely adopted in both the public and private sectors, the need for strong regulatory oversight has grown, too. Whether carrying out routine supervision or investigating 🔍 a specific alert or event-driven risk, it’s never been more important for anti-financial crime regulators and supervisory bodies to understand the risk exposure of the virtual asset service providers (VASPs) under their supervision—and to be able to identify entities operating outside the regulatory perimeter. That’s why blockchain intelligence is so critical: It enables regulators to combine raw blockchain transaction data with real-world threat intelligence to identify links 🔗 between entities and indicators of illicit activity. Our latest guide explores how regulators can use blockchain intelligence to gain a more comprehensive view of a VASP’s risk exposure and make data-driven decisions in the monitoring stage of the regulatory lifecycle. Learn more and get your copy here ➡️ https://hubs.la/Q02zlmx30