By Matisse Maker
Head of Estonia Financial Information Division
Cryptocurrency (1) is increasingly used in both legal and illegal activities. In Eastern Europe, particularly in Latin America, such as Ukraine and Russia, and Venezuela, cryptocurrency use is increasing to provide a more stable alternative to challenge the economic situation.
In many Asian and African countries, this is because there is no access to traditional financial services for many people. The global ranking of cryptocurrency use is dominated by central and South Asian countries and maritime countries, with India, Nigeria, Indonesia, the US and Vietnam at the top. (2)
Blockchain Data Platform Chain Analysis, which was estimated to have been moved to accounts related to illegal activities in 2023, was (3) a year later, $46.1 billion in 2023 and $40.9 billion in 2024.
Crypto is used to enable a variety of crimes and to wash the revenue from them. This includes drug crimes, human trafficking, child pornography, various types of fraud, disinformation campaigns, ransomware attacks, and more. Proceeds are used to commit new crimes. Given that over half of the assets stolen by crypto hackers last year were stolen by North Korean hackers (5), we can assume that North Korea’s weapons of mass destruction are also funding.
However, we must thank the unknown Nakamoto for inventing Bitcoin, the first known decentralized cryptocurrency that fits today’s definition of cryptocurrency, and for inventing Bitcoin, which brought cryptocurrency to the masses. Of course, we can only be grateful if we use all the methods and tools available to take advantage of the benefits that metadata associated with this new type of asset offers law enforcement. It also requires the proper functioning and capabilities of criminal litigation elements.
Until now, most money laundering has been through payment channels, either through credit institutions or payment service providers. If a person commits a crime and derives assets from it, they deposit these assets into their own account or a third party account before transferring them to B.
We have seen cases where the same funds circulate within the same credit institution through almost 10 different accounts in a day. In many cases, the same funds travel in a similar way through several other banks and countries within a day or a few days.
Tracking such funds is difficult for law enforcement and financial information units. If a criminal makes dozens of transfers or “asset hops” per day in an ideal scenario, it can take law enforcement agencies days or weeks, sometimes even months, to solve each transaction when dealing with international transfers. This is due to the slow pace of international cooperation through mutual legal support requests, which we have witnessed and heard, have worsened year-on-year. And at some point, the assets are moved by mistake or not by chance to a country that is not engaged in judicial cooperation, and therefore limits are reached to track assets.
In many cases, accounts are open under the frontal wing or a company registered under that name, so there is little difference whether the account owner is A or B. Tracking and recovering such assets is not necessarily impossible. It simply takes time. But in such cases, time is not the greatest ally of law enforcement. It will decrease with each passing as the funds could eventually be recovered and seized.
However, cryptocurrencies are a blessing from a crime detection perspective, as all transactions are recorded in blocks or records that cannot be modified or manipulated.
Additionally, all blocks are open to the public. Go online to see where your assets have been transferred from, who and for what amount. This means that you no longer have to spend months getting information about the fate of a single transaction and stepping through the transaction chain. The entire transaction chain will appear in law enforcement within seconds.
The technological advances in viewing these blocks are progressing so quickly that in the “next second” you can see if someone else is using a similar transaction chain or pattern, and look for clues as to where these individuals are in the world. Garantex (6), one of the world’s most infamous service providers today, is looking for other ways to continuously develop new business models, open new accounts, change the associated infrastructure, and hide its activities.
Its activities have been revealed, and all linked accounts are flagged faster than most European Union countries, let alone people outside the EU, but can respond to mutual legal support requests. If dyes were marked in the past, the cryptocurrency tool can tag crypto wallets with markers that send alerts whenever a transaction occurs on the assets they hold, indicating that the funds have been moved to a new wallet.
Yes, law enforcement doesn’t immediately see the whole block or anyone behind a particular crypto wallet, but even payment intermediaries can’t be entirely certain of this. Furthermore, the block or crypto wallet behind a person’s identity is not that important. Because the main thing is to limit further use of criminal property, seize assets, and later confiscate them as a result of court proceedings. Like any other currencies, you should not make a profit with crime or crypto. Just leave people A and B at the start of the investigation.
Therefore, law enforcement may actually hope that crime will shift further to cryptocurrencies and intermediaries within this asset class. This makes such crimes easier to detect and track. At the same time, there is still a long way to go, considering that the $24.2 billion mentioned above is a gift only 1.2-3% of the amount of actual criminal activity that is washed a year, taking into account the UN Drug Dispatch (UNODC) estimates.
That being said, I would like to transfer property derived from criminal activity outside of service providers in Estonia. Otherwise, we will assume all the negative consequences of money laundering, related crimes and terrorist financing. (8)
Headed towards innovation and the open economy, Estonia took on the risks associated with cryptocurrency without taking into account risk mitigation measures in depth. This also characterized the growth-focused innovators themselves, blindly admiring codes in that way, leaving risk management behind. However, the initial regulations provided supervisory authorities with an overly limited legal basis to refuse to issue approvals or to revoke existing ones.
Territorial principles apply to criminal litigation, but cryptocurrencies are global business. In the past, the individuals behind crypto companies were not based in Estonia and could not be held accountable. The same is often the case in many countries today.
Therefore, cryptocurrencies can help you catch criminals and seize assets if your forfeiture toolkit is up to date, but it is more difficult to hold money laundering enablers accountable. We can only fight these professional criminals and deterrent real punishments. The corporation must be able to be fined. And supporting that support should be punished under criminal law. Otherwise, no cryptocurrency will be used.
When it comes to Bitcoin creators, let’s hope that law enforcement will give us a “statue” and that criminal assets will make our work easier, so we’ll continue to flow in even more massive amounts of money into cryptocurrency!
Author: Matisse Maker is Head of the Estonia Financial Intelligence Unit (FIU) and Vice-Chair of the Moneyval Bureau. Mäeker is a member of Moneyval’s Estonian Deligation, a member of the FIU head of the Egmont Group and an alternative member of the AML Standing Committee of European bank AUHTORITY. Mäeker is the evaluator and review entree of many mutual evaluation reports conducted by MoneyVal. In nearly a decade of experience with the Financial Supervisory Bureau in Estonia, Matisse Maker has written the authorities’ AML/CTF publishing guidelines, internal guidelines and risk-based approach models. He co-authored the book “AML Compliance Book: 150 Golden Rules.”
This article was first published in 2024 Yearbook of the Public Prosecutor’s Office in the Republic of Estonia (Estonia) on February 18, 2025.
(1) In this article, the terms encryption, cryptocurrency, and cryptocurrency are used synonymously for simplicity.
(2) Geography of the 2024 Cryptocurrency Report. Available online: https://go.chainalysis.com/2024-Geography-of-cryptocurrency-report.html (January 10, 2025).
(3) Chainalysis 2024 Crypto Crime Report. Available online: https://go.chainalysis.com/crypto-crime-2024.html (January 10, 2025).
(4) 2025 Crypto Crime Report. Chain analysis. Available online: https://go.chainalysis.com/2025-crypto-crime-report.html (March 4, 2025).
(5) $2.2 billion stolen from crypto platforms in 2024, but as DPRK slows down activity since July, hacked volumes stagnate towards the end of the year. Chain analysis. Available online: https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/ (January 10, 2025).
(6) What is Garantex? Available online: https://www.chainalysis.com/blog/hydra-garantex-ofac-sanctions-russia/ (January 10, 2025).
(7) United Nations Office on Drugs and Crimes Related to Money Laundering. Available online: https://www.unodc.org/unodc/en/money-lundering/overview.html (January 10, 2025).
(8) For example, for information on damages caused by money laundering (https://www.imf.org/en/topics/financial-integrity/amlcft (January 10, 2025) or financial-integrity/amlcft (https://www.imf.org/en/blogs/articles/2023/12/07/financial-crimes-hurt-economies-and-must-be-be-be-be-ununtood-curbed (January 10, 2025)).
I hope you enjoy reading this article
Become a subscriber by choosing one of our subscription options, including unlimited access to AML Intelligence Premium articles, newsletters are delivered twice a week, access to the Global Bank’s fines and penalties database, and free access to Boardroom Series events!
