How Nation-States Exploit Cryptocurrencies

TL;DR

Nation-states use cryptocurrencies to fund espionage infrastructure, raise money through cybercrime, move value across borders, and potentially evade financial sanctions. Although cryptocurrency addresses are pseudonymous, public blockchain records can connect payments, reveal common wallet control, trace funds to exchanges, and give investigators opportunities to identify the actors behind suspicious transactions.

Transcript

Um, so yes, I'm Tom Robinson, chief scientist and co-founder at Elliptic. And, uh, today we're gonna talk about nation state exploitation of cryptocurrencies. So one of the, the key features of cryptocurrency is that it is independent of any given country. It's not issued by a country's central bank, um, and no country has, uh, control over them. H... Read More

Key Insights

• Cryptocurrencies are independent of individual countries, but nation-states can still use them to project influence, support operations abroad, raise funds, and potentially evade financial sanctions because transactions do not depend on a national central bank.
• Uneven cryptocurrency regulation is a security concern because some exchanges permit anonymous conversion between fiat currency and cryptocurrency. These services can provide nation-state actors with entry and exit points that are harder to connect to verified identities.
• Bitcoin is pseudonymous rather than anonymous because users transact through addresses while every transaction between those addresses appears on the blockchain. Investigators can sometimes connect an address to a real-world entity and then monitor related payments.
• Blockchain analysis works by identifying addresses associated with known entities and following transactions among them. Law enforcement can use these links to investigate criminal proceeds, while exchanges and financial institutions can assess where incoming cryptocurrency originated.
• Cryptocurrency can support espionage by paying for VPN accounts, web domains, servers, and other external resources without using conventional bank payments. Public blockchain evidence can still reveal when apparently separate personas receive funds from common wallets.
• Precise transaction details can provide an investigative starting point because analysts can search the blockchain for a matching payment and trace its history. In the Russian intelligence example, this approach led analysts back to a cryptocurrency exchange that supported Russian rubles.
• Ransomware payment wallets reveal both incoming victim payments and the later movement of proceeds. Analysts can identify exchanges, cryptocurrency ATMs, and unidentified intermediary wallets, creating possible leads about victims and the actors controlling the collected funds.
• Customer identification at exchanges is crucial because tracing funds to a service does not automatically reveal the recipient. Investigators may reach a useful destination but remain unable to identify its customer when the service has not collected identifying information.

Questions & Answers

Q: Why do nation-states use cryptocurrencies?

Nation-states may use cryptocurrencies because they are permissionless, censorship resistant, digitally transferable across borders, and independent of any single country or central bank. These characteristics can support payments for espionage resources, fundraising through cybercrime, and potential sanctions evasion. Uneven exchange regulation can also provide anonymous ways to convert between fiat currency and cryptocurrency in some jurisdictions.

Q: How can blockchain analysis identify nation-state activity?

Blockchain analysis identifies addresses connected to known entities, then follows transactions between those addresses across the public ledger. Investigators can compare transaction timing and amounts, detect payments originating from common wallets, and trace funds toward exchanges or other services. These patterns can connect apparently separate online personas and provide leads about where cryptocurrency was acquired or ultimately received.

Q: Is Bitcoin anonymous and untraceable?

Bitcoin is pseudonymous, not fully anonymous or untraceable. Users transact through addresses that function like pseudonyms, but every transaction between those addresses is recorded on the blockchain. If investigators connect an address to an exchange, ransomware wallet, intelligence operation, or another real-world entity, they can examine its payment history and trace relationships with other addresses.

Q: How was cryptocurrency used in cyber espionage?

Cryptocurrency was used to purchase infrastructure needed for cyber operations, including VPN accounts, web domains, and servers. In the example involving alleged Russian intelligence activity connected to election disruption, investigators found that payments associated with intelligence officers and separate online personas came from common Bitcoin wallets. That shared funding pattern suggested that the supposedly unaffiliated actors were connected.

Q: How can investigators find a transaction without a wallet address?

Investigators can use clues such as the transaction date and a precise Bitcoin amount to search the blockchain for a matching payment. If the combination is sufficiently distinctive, the matching transaction can become a starting point for tracing. Analysts can then follow earlier transfers to examine the source of funds and later transfers to identify destinations or related wallets.

Q: What did blockchain analysis reveal about WannaCry payments?

Blockchain analysis showed payments entering the known WannaCry ransom addresses from cryptocurrency exchanges and a Bitcoin ATM, reflecting how victims obtained Bitcoin before paying. Analysts then followed outgoing funds through a series of unidentified wallets. The proceeds eventually reached ShapeShift and Changelly, giving investigators identifiable services that could potentially hold information about the recipients.

Q: Why are cryptocurrency exchanges important to investigations?

Cryptocurrency exchanges are important because they often connect blockchain transactions with customer accounts and fiat currencies. When traced funds reach an exchange, investigators may seek records identifying the customer who received them. Exchanges also appear as sources when users purchase cryptocurrency. However, this investigative opportunity depends on whether the exchange actually collected reliable identifying information from its customers.

Q: What limits the effectiveness of blockchain tracing?

Blockchain tracing can reveal transaction paths and show that funds reached a particular exchange, but it does not guarantee identification of the person controlling the destination account. In the WannaCry example, funds reached ShapeShift and Changelly, yet neither service was identifying its customers. Unidentified personal wallets and anonymously accessible exchanges can therefore interrupt the link between visible transactions and real-world identities.

Summary & Key Takeaways

• Cryptocurrencies appeal to nation-states because they are permissionless, censorship resistant, digitally transferable across borders, and independent of central banks. Uneven regulation also allows users in some countries to exchange fiat currency and cryptocurrency anonymously, while vulnerable exchanges and irreversible payments create opportunities for theft and other illicit activity.

• Bitcoin is pseudonymous rather than truly anonymous because its blockchain permanently records transactions between addresses. Analysts can associate addresses with exchanges, ransomware operators, and other real-world entities. These links allow law enforcement agencies and financial institutions to trace payments, investigate criminal proceeds, and assess the origins of cryptocurrency funds.

• Blockchain analysis connected payments for espionage infrastructure to common wallets and traced ransomware proceeds through unidentified wallets toward exchanges. These investigations demonstrate both the utility and limits of public transaction records. Tracing can expose useful destinations, but identification becomes difficult when exchanges do not collect information about their customers.