Sure, you can steal bitcoins. But good luck laundering them

  • 28 Aug 2013
Ariel Zambelich/WIRED

In April 2012, the web site Betcoin lost 3,171 bitcoins when someone hacked into three separate computers to rob the online gambling destination. With just a few mouse clicks, the thief made off with a load of digital currency that's now worth close to $400,000 (£258,000).

But the money wasn't exactly gone. After the heist, it sat for a year in a Bitcoin wallet, visible to the entire world, yet controlled only by the criminals. Then, this year, on 15 March, the thief started to cash it out. He'd take small chunks of bitcoins, known as "peels," and move them from one wallet to the next.

Eventually, about 375 bitcoins (that's $45,000 [£29,000] at today's exchange rates) went to known Bitcoin exchanges such as Mt. Gox where they could be converted into US dollars.

Whoever pulled off the Betcoin heist hasn't been caught, but once stolen bitcoins pass into an exchange or they're used in some other transaction, law enforcement has many ways of tracking down a culprit. You need to provide proof of identity to trade on Mt. Gox.

Exchanges can also hand over information such as IP addresses and bank account numbers to investigators.

The feds are still concerned about such thefts, and about Bitcoin's role in money laundering and illicit commerce. Last year, a leaked FBI Intelligence Assessment warned that the private nature of the digital currency could make it hard for law enforcement to track criminals. You don't need any ID to create a Bitcoin wallet, but the Bitcoin network is built in a way that can make it awfully difficult for criminals to spend the digital currency once they steal it.

Bitcoin is a bit of a paradox. It can be used nearly anonymously: any two people can easily set up brand new Bitcoin wallets, meet in a park, and exchange cash for bitcoins. But at the same time, Bitcoin trades are public: all transactions are shared in a publicly available file called the Blockchain that's posted to the Bitcoin peer-to-peer network.

That public ledger makes it pretty tough for big-time criminals to launder money through the network. At least that's what researchers at the University of California and George Mason University found when they studied the Bitcoin network by developing sophisticated tools to track how money was moving around it.

The researchers argue that it's often possible, when paired with current law enforcement tools, to learn a lot of information about people who are moving bitcoins. "Laundering money -- moving around illicitly obtained Bitcoin at scale -- seems very difficult," says Sarah Meiklejohn, the University of California, San Diego, graduate student who co-authored the study, which is set to be presented at a technical conference in October.

The feds don't seem to realise this just yet. They want new ways to track criminals who are using bitcoins. And that's why the Bitcoin Foundation went to Washington on 26 August, to explain itself before more than 50 representatives from agencies such as the Treasury Department, the Secret Service, and the Federal Bureau of Investigation. The Foundation -- the group that oversees development of the core Bitcoin software -- wants to see if it can come to an understanding with government authorities.

While small-scale money laundering "seems quite possible," admits Meiklejohn, the big fish -- people who might want to move a million dollars through the network -- will have problems. There simply aren't enough places to exchange large amounts of money in an anonymous way. "The money that's moving around the system every day is just not enough to disguise large quantities of Bitcoin," Meiklejohn notes.

Any criminal who wanted to quickly unload a large number of bitcoins would likely have to move it through a Bitcoin exchange at some point -- and those exchange companies are working hard to stick to federal anti-money laundering regulations.

Jerry Brito, senior research fellow at the Mercatus Center at George Mason University, believes the feds aren't as far from grasping this as it may seem. He was at the meeting in Washington, held at the Treasury Department, and he thinks that the Bitcoin Foundation "got a fair hearing, and people there were very interested and very tuned in. They asked a lot of good questions. I wouldn't say it was hostile."

In theory, a law enforcement agency could even recover the Betcoin money -- at least as it moved through legitimate exchanges.

But Betcoin's owner, who goes by the online nickname "Hippich," isn't optimistic. He says the thief who stole from him was sophisticated: they hacked three machines running three different operating systems. So he's "99.99 percent" certain that he'll never see his bitcoins again. Today, he has shuttered the site, and is trying to sell the domain to recoup some of the money he lost.

But if the Betcoin thief tries to use online money laundering services, he may find himself the victim. Meiklejohn and her fellow researchers tried some of those services out -- sites with names like Bitcoin Laundry and Bitmix -- and they report some pretty rough experiences. One service didn't work. It simply returned the same bitcoins, un-laundered.

Another service stole their money. As Meiklejohn observes, "If someone comes to you and says, 'I have a million dollars worth of Bitcoin. Can you mix it to me?,' I don't know what your incentive is to do it rather than just steal it."

This story originally appeared on