(Bloomberg Markets) — One spring day in a village just west of London, residents saw a man being muscled into a car in front of a nearby house. He reappeared with cuts and bruises 13 hours later, but the cops had already discovered the house was a cannabis-growing operation. A separate search of the man’s home in a nearby town turned up something more intriguing—some of the first cryptocurrency that would ever be seized by U.K. police.
That era-defining 2017 case yielded a safety-deposit box containing jewelry, gold bars, £263,000 ($345,000) in cash, and an item that flummoxed the lead investigator, Matthew Durkin, a 19-year veteran of the Surrey police. It was a USB device found in the suspect’s study. The gadget was wrapped in a small notebook, which contained two strings of 12 random words. A young probationary officer recognized the device, a KeepKey, as a virtual currency holder and the words as seed phrases to access crypto wallets. Eventually, police discovered it held 295 Bitcoin.
“It meant nothing to me until someone said it was worth £900,000,” recalls Durkin, 51.
In recent years, police departments such as Durkin’s and law enforcement agencies around the world have had to learn quickly about how to deal with cryptocurrencies, often in amounts that eclipse traditional assets such as cash, gold, jewelry, cars, and real estate. In London, for instance, police seized almost £300 million of crypto linked to crime last year.
The U.S. Marshals Service held 22 cryptocurrencies valued at about $919 million last December, according to spokeswoman Shaunteh Kelly. In February the U.S. made its largest financial seizure ever: about $3.6 billion in Bitcoin stolen during a 2016 hack of the Bitfinex currency exchange. And cryptocurrencies made up almost all—93%—of the assets confiscated by the Internal Revenue Service’s Criminal Investigation Division in the fiscal year that ended Sept. 30.
“It’s exploded since 2017,” says Ryan Korner, head of the division in Los Angeles. “We’re at a point where it touches almost every investigation that we work in one way or another. We’re trying to make sure that all of our agents have the knowledge to work these cases.”
The qualities that make cryptocurrencies attractive to criminals—some think they’re easier to hide and transfer than many valuable assets—are challenging law enforcement.
To start, investigators have to learn to recognize a crypto wallet and then how to obtain the private key, or seed phrase, to unlock it. Months after the $10 million hack of the GateHub platform in 2019, French investigative judge Pascal Latournald and his colleagues held and interrogated a suspect for the better part of 48 hours before he gave up the code that unlocked $2 million in Bitcoin. The exhausted suspect, hoping for leniency, revealed he’d written it on a slip of paper inside a cookbook in his parents’ living room in southern France, according to an officer involved in the investigation who spoke on the condition he wasn’t named.
U.S. agents have discovered seed phrases hidden on a gum wrapper, inside a TV instruction manual, and on tiny pieces of paper stuffed in a suitcase in a closet, says Tigran Gambaryan, who was a special agent for the IRS’s criminal investigation arm for a decade before joining crypto exchange Binance in September.
In 2018, U.K. police chiefs lobbied the government for funding to equip about 250 officers—dubbed crypto tactical advisers—and train them in how to investigate, seize, and realize the value of digital currencies.
The U. S. Federal Bureau of Investigation in February formed a crypto unit to provide equipment, training, and blockchain analysis to agents. The Department of Justice appointed Eun Young Choi as the director of a team dedicated to crypto crimes. Choi says her focus will include virtual currency exchanges and services, known as mixers or tumblers, that obscure funds. Speaking at a Munich conference, Deputy Attorney General Lisa Monaco said her prosecutors will work more with European partners on crypto enforcement.
Laurel Loomis Rimon, who worked on many money laundering cases during her 17 years as a federal prosecutor, says the value of the recent seizures is “staggering” and will have a big impact on prosecutors. “There’s a facility with this type of analysis that has been growing,” says Rimon, now at the law firm Paul Hastings. “You’ve got prosecutors getting more and more comfortable with it.”
As law enforcement becomes more sophisticated in identifying and accessing a suspect’s cryptocurrency, they’ve also had to navigate the challenges of securing it and, eventually, liquidating it. In the Surrey case, police quickly bought their own KeepKey and transferred the Bitcoin to it. They put the device and seed phrase in a safe, and only two officers knew the combination. Durkin had heard about two U.S. agents who went to prison for stealing Bitcoin while investigating the now-shuttered Silk Road underground virtual drug bazaar. “I was very conscious of security—people’s heads can be turned with a million quid,” Durkin says. “But most of all, I was worried about losing it—I didn’t want to stand in front of my chief constable and say £900,000 in Bitcoin had gone.”
Durkin’s team got a court order, the first of its kind in the U.K., that enabled them to convert the crypto into sterling. They sold it directly to a trusted international exchange for £1.25 million, the market rate at the time.
Once seized, it can take years for authorities to secure a forfeiture order letting them sell crypto and return the proceeds to crime victims or governments. In the U.S., seized property is subject to claims by people who say they have a right to it.
In 2018, authorities in Monmouth County, N.J., raided two locations used by a suspected drug dealer, Giddel Gonzalez-Estrada. They seized cocaine, cash, and a handgun, as well as Bitcoin, Litecoin, and Ether valued at $57,000. Gonzalez-Estrada held the crypto in an account at Coinbase Global Inc. Monmouth authorities got a judge’s approval to seize the crypto from Coinbase, which transferred it to a wallet set up by detectives. They held it on a device in the evidence vault, says Michael Costanzo, a special deputy attorney general. Gonzalez-Estrada pleaded guilty in 2019 and was sentenced to 10 years in prison. When a judge finally approved the forfeiture in 2021, detectives transferred the crypto back to Coinbase, netting $198,237 for the county’s law enforcement trust account.
Seizing and selling crypto is becoming less daunting for prosecutors and detectives, Costanzo says. Monmouth prosecutors are preparing for trial against a former tennis teacher accused of identity theft and other crimes. In 2017 they seized crypto valued at $200,000. The value grew to $1.25 million last year. “There were a lot of questions about it in 2018,” Costanzo says. “Now, in 2022, people have if not a full understanding, at least a rudimentary understanding.”
Around the world, stashes of confiscated crypto have been auctioned alongside Ferraris, watches, diamonds, and, in one case in Germany, a harp. Wilsons Auctions, the largest independent auction house in the U.K. and Ireland, got involved in 2018 when the company realized that law enforcement didn’t have a solution for selling seized crypto at the time. In February 2019 the company auctioned 315 Bitcoin for Belgian authorities. The sale, which took place online as well as in person, attracted bidders from more than 90 countries.
One middle-aged woman purchased half a Bitcoin along with some other items, says Aidan Larkin, who ran asset recovery for Wilsons at the time. When she insisted on taking the Bitcoin home with her in a bag, the auction team had to coach her on how to set up a digital wallet instead.
The U.K.’s National Police Chiefs’ Council, the representative body for all forces, undertook a procurement process that enabled police to use a third-party custodian to store and sell its crypto. So Surrey Police and other forces now use Komainu, which is backed by Nomura Holdings, Ledger, and CoinShares. Larkin, who formerly worked as a criminal investigator for the U.K.’s tax authorities, left Wilsons to start a company called Asset Reality that aims to advise law enforcement on dealing with seized assets, including cryptocurrencies.
The U.S. Marshals Service, which disposes of assets like houses, cars, planes, boats, and artwork, has had a hard time finding a contractor to manage and sell forfeited crypto. From 2014 to 2020, the marshals auctioned crypto themselves. Billionaire venture capitalist Tim Draper was one bidder who cleared background checks and bought crypto at auction. In 2014 he picked up 30,000 Bitcoin for $632 each, before the price plunged to $180. He still holds those Bitcoin, now valued at more than $40,000 each. He says he bought fewer Bitcoin in the next auction, investing about 40 of them in startups, but would consider buying more if the government auctions them.
He may not get the chance. As seizures ballooned, the marshals sought proposals from companies to store and sell crypto. In soliciting contractors, they posted 26 pages of questions and answers in May 2020. At that point, their portfolio was valued at $145 million in more than 160 wallets, the agency said. Last April, BitGo Inc. won a $4.5 million contract. But that award fell through because it was supposed to go to a company designated as a small business, and BitGo, now part of Galaxy Digital Holdings, was too big. In July, a $6.6 million contract went to Anchorage Digital, which had received conditional approval for a national trust bank charter from the Office of the Comptroller of the Currency. The contract is on hold pending the outcome of a protest to the bid.
The U.S. Marshals Service now uses a secure online platform for selling and transferring cryptocurrency with the goal of disposing of assets “in a timely manner at fair market value,” says Kelly, the agency spokeswoman.
The Justice Department’s asset forfeiture policy manual last year spelled out how prosecutors and agents should proceed on crypto. Because multiple copies of a key may exist, “it is imperative that once authorization to seize the virtual currency is obtained, it be transferred to an agency-controlled wallet,” the manual states. Seized crypto also must be held in cold storage, or a secure offline device, until it’s transferred to a government-controlled custodial wallet.
In Germany, prosecutors in each of the country’s 16 states decide how to manage seized property. Frankfurt prosecutor Jana Ringwald’s cybercrime unit uses Bankhaus Scheich, a small investment bank, to ensure that confiscated cryptocurrency in her home state, Hesse, is legally managed and sold in a way that creates minimum volatility. Prosecutors in Cologne, by contrast, auction cryptocurrency seized in North Rhine-Westphalia like other contraband. Buyers can pick up a physical wallet with the codes in person, or apply to have the coins transferred online.
Over time, German authorities have become more efficient in handling crypto, but delays aren’t always a bad thing. In 2018, Berlin police watched the value of their cryptocurrency soar as they waited to clear bureaucratic hurdles before holding an auction.
To be sure, much of the crypto seized today stems from crimes such as the Bitfinex hack or frauds that occurred years ago. Investigators handling these cases are specially trained in crypto sleuthing, and they say it can be easier to trace money on the blockchain ledger that underlies cryptocurrencies than in the traditional banking system. “The blockchain of Bitcoin provides a lot more transparency than the legacy financial system,” says Gambaryan, the former IRS criminal investigator who’s now vice president for global intelligence and investigations at Binance. “This is coming from somebody who’s worked both. If not for Bitcoin, a lot of cases I was working wouldn’t be closed.”
For instance, in November 2020, U.S. authorities confiscated Bitcoin that had been hacked from the Silk Road digital marketplace about seven years earlier. The Bitcoin were valued at $1 billion when they were recovered from someone identified in court papers only as Individual X. The IRS cracked the case after working with Chainalysis Inc., a cryptocurrency research firm. “That’s a perfect example of the permanence and immutability of the blockchain, that crimes committed long ago remain relevant as soon as we can get some attribution,” says Gurvais Grigg, Chainalysis’s global public sector chief technology officer.
The proceeds from seized crypto sold by the U.S. government go to support law enforcement if the crypto was used to facilitate crime, according to Michael Sherwin, a former federal prosecutor. But if there were victims of the crime, they get the money as restitution, he says. For instance, the Justice Department has said it will return the Bitcoin hacked from Bitfinex to the victims—a process to be worked out in court.
The volatility of cryptocurrency can create thorny questions for courts to solve. “If you have 300 tokens stolen in 2018, what’s the court going to give you? Are you going to get the value of the tokens in 2018, or are they just going to give you back your tokens, which had an exponential increase?” asks Sherwin, who’s now at the law firm Kobre & Kim. “I think it should be the latter. You should get your property back, even if it increased in value.”
As regulators and law enforcement agencies become savvier about seizing and disposing of crypto, so do the criminals trying to evade detection. “It’s not easy for us, and it’s still an extremely volatile market,” says Durkin, the Surrey detective chief inspector. “It’s an area of criminality that we’ve had to play catch-up on really quickly. But the police play cat and mouse, that’s what we do.” —With Gaspard Sebag in Paris, Karin Matussek in Berlin, and Chris Strohm and Allyson Versprille in Washington
Milligan and Voreacos cover legal news in London and New York, respectively.
More stories like this are available on bloomberg.com
©2022 Bloomberg L.P.
