News

Federal prosecutors in Washington, D.C., are increasingly using a unique authority under the U.S. criminal code to restrain and permanently seize illicit digital coins and other criminal assets stashed overseas.

Since December 2016, the Threat Finance Unit of the U.S. Attorney’s Office for the District of Columbia has moved to confiscate antiquities trafficked by Islamic State terrorists, an oil tanker controlled by a U.S.-blacklisted Iranian military branch and more than $100 million in cryptocurrency from child pornography websites and North Korean hackers.

A provision of the U.S. criminal code that requires that all forfeiture proceedings against foreign-based assets be brought in the U.S. District Court in Washington, D.C. has been critical in advancing these as well as other cases, Zia Faruqui, an assistant U.S. attorney who leads the TFU, told ACAMS moneylaundering.com.

“We alone have that authority, so legally we are empowered to act where others might not,” Faruqui said.

U.S. District Judge Thomas Hogan cited Washington’s “sole” jurisdiction over such cases last year in an unprecedented ruling authorizing the forfeiture of a gold ring, a pair of gold coins, a carved stone and other artifacts allegedly sold by the Islamic State group to a trafficker of Syrian antiquities, who in turn sold them to Turkish nationals for hundreds of thousands of dollars.

In his ruling, Hogan sided with federal prosecutors’ expansive view that the provision, when applied to the overseas property of terrorists as defined under a different statute, “empowers” the U.S. government to confiscate assets that “may have never touched the U.S.”

The antiquities were allegedly in the custody of Turkish police at the time of their seizure by the U.S.

TFU

Since former U.S. Attorney Jessie Liu established the TFU more than two years ago, the unit has secured the forfeiture of approximately $650 million in illicit assets, both domestically and overseas, and nearly $1 billion in penalties for individuals and entities caught evading U.S. sanctions.

“This is the only such prosecutorial unit in the country,” Faruqui said. “The TFU works closely with law enforcement, the intelligence community, and various regulators to …. seize, forfeit and disrupt funds and assets supporting sanctioned regimes, terrorists, and other individuals and groups that pose a threat to our national security.”

TFU’s most sophisticated work has targeted cryptocurrencies, leading to three civil forfeiture complaints over a six-month period last year against hundreds of digital wallets that allegedly held tens of millions of dollars worth of proceeds from North Korean cybertheft and online pornography.

The three cases saw investigators sift through “tens of thousands, if not hundreds of thousands” of unique bitcoin addresses alone, in addition to data such as email and IP addresses, names and financial records, said Special Agent Chris Janczewski of IRS Criminal Investigation, which frequently partners with TFU.

“One of the key strategies is the management of a lot of data,” Janczewski wrote in an email to moneylaundering.com. “Often times it is the needle-in-a-haystack type of mistake that can set the course of an investigation and be a pivotal piece of evidence.”

Peel chains

TFU in March targeted nearly 150 Bitcoin, Ethereum, Litecoin and other cryptocurrency addresses and accounts through which two Chinese nationals and their co-conspirators allegedly laundered between $100 million and $200 million that the Lazarus Group, hackers sponsored by North Korea, allegedly stole from four exchanges, including three in South Korea.

An initial 38-page civil forfeiture complaint, and an amended 44-page amended complaint the prosecutors filed four days later amid evidence that the perpetrators of the scheme were quickly emptying their digital wallets, formally cite the provision, U.S.C. 28 1355(b)(2), as the basis for confiscating the cryptocurrency kept overseas.

Prosecutors charged Tian Yinyin and Li Jiadong, the pair accused of orchestrating the scheme, with conspiring to launder money and operating an unlicensed money transmitting business on March 2, the same day that the Treasury Department’s Office of Foreign Assets Control blacklisted them.

The civil forfeiture complaint describes how the perpetrators’ allegedly used “peel chains” to move the large sum of proceeds into a dozen regulated exchanges undetected.

In general terms, peel chains enable individuals to automatically break up large transfers of digital tokens into smaller transactions, including by “peeling off” change you may be due on a payment to a wallet you control.

Money launderers can use peel chains, a common feature of many blockchains, including the ledger of transactions associated with Bitcoin, to “structure” illicit transfers, said Jesse Spiro, head of policy for Chainalysis, one of two private firms that cooperated with the U.S. Attorney’s Office and IRS-CI in the investigation.

“Things can get complicated when peel chains are very long, and when new peel chains are started from bitcoins that have been peeled off, you get peel chains of peel chains,” Spiro wrote in an email. “The complexity is … in identifying when funds have actually changed hands versus simply been moved by the money launderer through a peel chain they fully control.”

Dark web pornography

In two other civil complaints, filed Oct. 16 and March 12, respectively, Faruqui’s team sought to forfeit nearly 350 cryptocurrency accounts from which hundreds of individuals across the world paid around $8 million in fees to download thousands of videos of child sexual exploitation and other violent pornography from two dark web platforms, Welcome to Video and Dark Scandals.

Prosecutors also accused a Dutch national and a South Korean citizen running the websites with selling child pornography and laundering the profits, and arrested more than three hundred users of Welcome to Video in the U.S. and a dozen other jurisdictions.

Faruqui, the assistant U.S. attorney, said the takedown of Welcome to Video was the first ever of a dark web marketplace “entirely based” on investigators tracing cryptocurrency transactions.

“It proved that the old adage, ‘follow the money,’ remains true even in the modern world of cybercrime,” Faruqui said, adding that TFU is pursuing several similar investigations.

Contact Valentina Pasquali at vpasquali@acams.org