Tes�mony of Alison Jimenez

November 15, 2023

Tes�mony of Alison Jimenez
House Sub-Commitee on Digital Assets, Financial Technology, and Inclusion
Hearing: Crypto Crime in Context- Breaking Down the Illicit Ac�vity in Digital Assets
November 15, 2023
Chairman Hill, Ranking Member Lynch, and dis�nguished Members of the Sub-Commitee,
thank you for the invita�on to appear before you today to discuss illicit ac�vity in digital assets.

Introduc�on
My name is Alison Jimenez. I am an economist and the president of Dynamic Securi�esAnaly�cs, Inc., a private consul�ng ﬁrm that I founded in 2003 that focuses on compliance andli�ga�on consul�ng on issues rela�ng to ﬁnancial crime and an�-money laundering (‘AML’).
In the course of my work, I advise AML so�ware providers, conduct independent AML reviews
for ﬁnancial ins�tu�ons, serve as an expert witness on ﬁnancial crime and money laundering,
provide training, and conduct research into ﬁnancial crime and money laundering topics.
My research on money laundering has covered a range of issues from Ponzi schemes to Human
Smuggling Finance to how the U.S. border closures during the Covid-19 pandemic impacted
money laundering opera�ons of Drug Traﬃcking Organiza�ons.
Recently, much of my research has focused on the use of cryptocurrency in illicit ﬁnance. The
topics of my research on cryptocurrency crime has included unregistered cryptocurrency
exchanges, Suspicious Ac�vity Reports ﬁled by cryptocurrency exchanges, consumer complaints
about cryptocurrency frauds and scam, illicit crypto ac�vity occurring within Virtual Asset
Service Providers, and na�onal security issues rela�ng to cryptocurrency. My crypto crime
analysis has been featured in American Banker, the Wall Street Journal, and the Financial Times.

Valuable Features of Financial Products to Bad Actors
Before addressing cryptocurrency crime speciﬁcally, it is useful to understand how a bad actor
evaluates ﬁnancial products generally. When a bad actor wants to conduct a ﬁnancialtransac�on, they will assess whether a ﬁnancial product can move funds:
•
•
•
•
•
•

far,
fast,
in large amounts,
irreversibly,
anonymously,
and to a third-party.

There is no one feature that drives bad actors to a par�cular type of ﬁnancial product.
Anonymity is just one feature that bad actors weigh.
1Tes�mony of Alison Jimenez

November 15, 2023

While a truckload of nickels and dimes is anonymous, it cannot be moved far or fast. Gi� cards
are also anonymous but usually have a dollar cap and are not ideal for moving a lot of value atonce. For example, paying a $150 million dollar bribe to a foreign government oﬃcial with gi�
cards, even with a $2,000 cap, would require roughly 75,000 gi� cards.

Why do bad actors use cryptocurrency?
Cryptocurrency is atrac�ve to bad actors because it has so many of the features they value in a
ﬁnancial product.
Blockchain based cryptocurrency transac�ons move seamlessly across interna�onal borders(far) and can be setled in minutes (fast). There is no cap on the value of cryptocurrency thatcan be transferred in a transac�on (in large amounts). In most instances, a cryptocurrencytransac�on cannot be reversed once it has been added to the blockchain (irreversibly).
Cryptocurrency wallets are pseudonymous, meaning the true owner of the wallet may never belinked to a given wallet address (anonymously) and the same can be true for the recipient (to athird-party).
However, anonymity is not a priority for all bad actors using cryptocurrency. As is the case formany residing outside of the United States, especially within compe�tor na�on-states, because
it is diﬃcult for our regulatory and legal systems to hold them accountable. Addi�onally, theanonymity, or even pseudonymity, of wallet addresses makes it challenging to determine whentransac�ons are sending funds to another party or just to another wallet owned by theoriginator.
While some commentators argue that blockchain transparency makes cryptocurrency ill-suitedfor illicit ﬁnance. If we follow that logic, then:
•
•
•
•
•

The weight and bulk of currency make cash ill-suited for illicit ﬁnance.
The reversibility of wires makes it ill-suited for illicit ﬁnance.
The dollar limit on Zelle transfers makes it ill-suited for illicit ﬁnance.
The physical loca�on of real estate makes it ill-suited for illicit ﬁnance.
The names and addresses printed on checks make checks ill-suited for illicit
ﬁnance.

However, as noted above, no one factor deters bad actors from ﬁnding ways to use ﬁnancial
products. Dismissing cryptocurrency as a useful tool for illicit ﬁnance just because sometransac�ons are pseudonymously recorded on a blockchain is not wise. Nor is it borne out by
cryptocurrency Suspicious Ac�vity Reports (SAR), IC3 advisories, or CFPB consumer complaints.

2

Tes�mony of Alison Jimenez

November 15, 2023

What do we know about crypto crime?
My tes�mony focuses on three diﬀerent data sources on cryptocurrency illicit ﬁnance: (1)Suspicious Ac�vity Reports ﬁled by ﬁnancial ins�tu�ons; (2) vic�m complaints; and (3)blockchain analy�cs.
1. SUSPICIOUS ACTIVITY REPORTS (SARS) FILED BY FINANCIAL INSTITUTIONS INDICATEPREVALENCE OF CRYPTOCURRENCY IN ILLICIT FINANCE.
My analysis of publicly available informa�on regarding Suspicious Ac�vity Reports involving
cryptocurrency iden�ﬁed several insights into crypto crime.
•

•

•
•

The number of SARs ﬁled related to cryptocurrency is growing exponen�ally. 1 Over92,000 cryptocurrency SARs were ﬁled in 2021 reﬂec�ng transac�ons worth over
$96 billion dollars. 2
Bad actors prefer to use cryptocurrency over many other ﬁnancial products. 3 Whenadjusted for percentage of U.S adults using a given ﬁnancial product, crypto SAR
ﬁlings dwarf SARs ﬁled rela�ng to investment products and are gaining ground on
U.S currency SARs. For example, there were 2.74 SARs per 1,000 Users of Crypto
versus 0.18 SARS per 1,000 Users of Stocks. Even without adjus�ng for consumer
adop�on, there were more cryptocurrency SARs ﬁled in 2021 than for all
securi�es/investment products from 2014 through 2020.
The dollar value of each cryptocurrency SAR hovers near $1 million dollars which issigniﬁcantly greater than the dollar value of other products and industries. 4
Ransomware-related SARs ﬁled in the second half of 2021 exclusively demanded
payment in cryptocurrency. Ransomware SARs exempliﬁes the three prior points: thenumber of ransomware SARs is increasing drama�cally, bad actors prefer payment incryptocurrency, and the average dollar value of the bitcoin paid in ransom was over
$900,000. 5

Cryptocurrency-related SAR ﬁlings overwhelmingly contradict the thesis that bad actors don’t
use crypto.
2. THE BREADTH AND VOLUME OF VICTIM COMPLAINTS ILLUSTRATE THE MAGNITUDE OF
THE ILLICIT ACTIVITY.

htps://securi�esanaly�cs.com/cryptocurrency-sars-what-do-we-know/
Kevin O’Connor, FinCEN Sec�on Chief- Virtual Assets and Emerging Technology. Associa�on of Cer�ﬁed Financial
Crimes Specialists webinar, “Russia Sanc�ons: The US Response. Crypto and Compliance”, 4/20/202.
3
htps://securi�esanaly�cs.com/crypto-suspicious-ac�vity-reports-vs-other-products-industries/
4
Id.
5
htps://www.ﬁncen.gov/sites/default/ﬁles/202211/Financial%20Trend%20Analysis_Ransomware%20FTA%202_508%20FINAL.pdf
1
2

3

Tes�mony of Alison Jimenez

November 15, 2023

Insights from Complaints Submited to the FBI
The FBI’s Internet Crime Complaint Center’s (“IC3”) mission is to provide the public with areliable and convenient reporting mechanism to submit information to the FBI concerninginternet facilitated crime. IC3 analyzes and disseminates information for public awareness. To
that end, the FBI has issued numerous consumer alerts about cryptocurrency scams including:
•

•
•
•

•

•

DeFi Exploits: The FBI warns that cyber criminals are increasingly exploiting
vulnerabilities in decentralized finance (DeFi) platforms to steal cryptocurrency,
causing investors to lose money. The FBI reports that between January and March
2022, cyber criminals stole $1.3 billion in cryptocurrencies, almost 97% of which wasstolen from DeFi platforms.
Fake Apps: The FBI reported that fake crypto apps defrauded investors of more than
$42 million between October 2021 and July 2022.
Crypto ATMS and QR Codes: The FBI warned about scams leveraging cryptocurrency
ATMS and QR Codes to receive payments from victims in online impersonation
scams, romance scams, and lottery scams.
Liquidity Mining Scams: The FBI states that liquidity mining scams has been
responsible for over $70 million in losses since January 2019. Liquidity mining scams
are also found in CFPB consumer complaints.
Impersonation of Law Enforcement: The FBI warned ofscammers impersonating law enforcement or government officials in attempts toextort or steal personally identifiable information. The scammers often demand
payment via cryptocurrency ATMs.
Romance Scams/Pig Butchering: The FBI received over 19,000 complaints related toonline romance scams in 2022 with victims reporting over $735 million dollars inlosses.
The term “pig butchering” refers to the practice of fattening a hog before slaughter
but in this context signifies a scamming technique of creating sense of intimacy withthe victim before exploiting the victim via a cryptocurrency investment scam. Scam
victims are often contacted via social media or “errant” text messages. The scammer
on the other end of the message are often human trafficking victims who were lured
to fake call center jobs, held against their will by organized crime groups, and forced
to scam under the threat of violence.
Homeland Security Investigations describes Pig Butchering as:
an increasingly prolific financial fraud scheme, which combines elements oftraditional romance and investment fraud whilst also targeting people
trafficking and modern slavery victims. The typology generally (although not
exclusively) is controlled by organized criminal gangs operating fromSoutheast Asia, including Special Economic Zones (SEZ) in countries like4

Tes�mony of Alison Jimenez

November 15, 2023

Myanmar, Laos, Cambodia and Thailand. In 2022, U.S. based victims alone
lost approximately $3.3 billion dollars to crypto-related investment frauds. 6•

Business Email Compromise and Second Hop Transfer: The FBI reportsthat Business Email Compromise victims have unknowingly had their email hacked
and wire instructions were altered by bad actors to instead wire funds tocryptocurrency exchanges. Another disturbing pattern is the “Second Hop Transfer”
that the FBI describes as:
Second Hop Transfer uses victims of other cyber-enabled scams such as
Extortion, Tech Support, and Romance Scams. Often, these individuals
provided copies of identifying documents such as drivers’ licenses, passports,
etc., that are used to open cryptocurrency wallets in their name.

Other IC3 cryptocurrency-related advisories include:
•
•
•
•
•
•

Sextor�on
Cryptocurrency Scam Re-Vic�miza�on
Human Traﬃcking to Scam Compounds Call Centers (Pig Butchering)
Pig Butchering Cryptocurrency Scams
Cryptocurrency Mining Scams
Deepfakes and Stolen PII

Insights from CFPB Consumer Complaints
My analysis of CFPB consumer complaints iden�ﬁed tradi�onal ﬁnancial ins�tu�ons frequently
named in complaints involving digital assets, even though these ﬁrms may not oﬀer
cryptocurrency. For example, consumers alleged that their bank or ﬁntech account was hacked
and that the stolen funds were used to purchase cryptocurrency. 7
The CFPB published an analysis of consumer complaints related to crypto-assets in November
2022. 8 From October 2018 to September 2022, the CFPB received more than 8,300 complaints
related to crypto-assets with about 40% of the complaints lis�ng frauds and scams as the main
complaint.
3. INSIGHTS FROM BLOCKCHAIN ANALYTICS
Blockchain analy�cs has contributed to our understanding of crypto crime and has provenhelpful to law enforcement in tracing blockchain-based illicit transac�ons.

htps://www.ice.gov/doclib/cornerstone/pdf/cornerstoneACAMS_SpecialIssue40_Apr21_2023.pdf
htps://securi�esanaly�cs.com/cfpb-cryptocurrency-complaints/
8
htps://ﬁles.consumerﬁnance.gov/f/documents/cfpb_complaint-bulle�n_crypto-assets_2022-11.pdf
675

Tes�mony of Alison Jimenez

November 15, 2023

The eﬀorts of blockchain analy�c ﬁrms, coupled with examples of law enforcement successfully
tracing cryptocurrency across the blockchain may have even caused bad actors to change how
they use cryptocurrency. That is to be applauded. The days of publicly lis�ng a sta�c bitcoin
wallet address to receive illicit funds may be over.
However, blockchain analy�cs does not change the features of cryptocurrency that are mostatrac�ve to bad actors: namely, the ability to move value far, fast, irreversibly…in large
amounts. Addi�onally, when bad actors use the obfusca�on methods discussed below, they
may also evade atribu�on.
Limits of Blockchain Transparency
Many bad actors have changed how they transact with cryptocurrency on the blockchain tolimit exposure to blockchain analy�cs and tracing.
On-chain obfusca�on methods include:
•
•
•
•
•
•
•

Using mixers
Using De-Fi protocols as a mixer
Transac�ng on “layer 2” protocols such as the bitcoin Lightning Network
Hopping from one blockchain to anotherCrea�ng new ‘clean’ wallets or addresses for each on-chain transac�on
Using privacy-enhanced cryptocurrencies
Selec�ng blockchains with enhanced privacy features

Challenges to On-Chain Atribu�on
Atribu�on of a wallet address to a speciﬁc person or en�ty is challenging, especially for theprivate sector who lack access to oﬀ-chain data available to law enforcement or intelligenceagencies.
Addi�onally, blockchain analy�c ﬁrms do not always reach the same conclusions regarding
atribu�on even when they are working from the same blockchain data. Finally, the atribu�on
and tracing methodology used by blockchain analy�cs ﬁrms is o�en proprietary and unaudited.
Cryptocurrency Exchanges Internal Transac�ons Escape Blockchain Analy�cs
If all cryptocurrency transactions were an iceberg, the crypto transactions subject to blockchain
analytics is the small portion above the waterline.
Most cryptocurrency transactions occur within crypto exchanges. Crypto
exchanges internally match buyers and sellers. Exchanges also act as market-makers, steppingin as a counterparty when a buyer/seller is unavailable. These off-chain transactions escapetraceability and blockchain analytics.
6Tes�mony of Alison Jimenez

November 15, 2023

Researchers estimated that bitcoin transactions within exchanges to be ten times the volume oftransactions executed on the blockchain:
On-chain transactions, however, constitute only a small share of the universe of all
Bitcoin trades, most of which are “off-chain” utilizing some form of exchange, someheavily regulated, some not so much. 9
Internal Ledgers at Crypto Exchanges.
A crypto exchange’s internal transactions are not recorded on the blockchain. Instead, theseoff-chain transactions are recorded on the exchange’s internal ledger.
Bad actors can use cryptocurrency but evade creating a blockchain record of transactions bysimply conducting transactions within an exchange. As demonstrated by SAR filings by Virtual
Asset Service Providers (VASPs), IC3 and CFPB complaints, and criminal indictments, this is infact occurring.
Illicit Customer Activity Within Cryptocurrency Exchanges
My analysis of nine enforcement actions against VASPs involving Suspicious Activity Reports
found that darknet market activity was the most cited suspicious activity. 10 Other sources ofillicit funds ﬂowing through the VASPs included: funds from sanc�oned en��es/regions, Child
Sexual Assault Material (CSAM), money laundering, drug traﬃcking, ransomware, unregistered
MSBs and/or crypto mixers, terror ﬁnance, and other fraud.
Illicit Activity by Cryptocurrency Exchanges
Cryptocurrency exchanges and other types of VASPs, such as mixers and bitcoin ATMs, havealso directly engaged in illicit financial activity using cryptocurrency.
Internal exchange ledgers of cryptocurrency transactions have been sloppy or outright
fraudulent from the very beginning. Mt. Gox, one of the first cryptocurrency exchanges,
allegedly failed to accurately record internal customers transactions, and stole crypto from
customers.
Cryptocurrency exchanges have also engaged in market manipulation, wash trading, insider
trading, and a host of other crimes. 11 Perhaps even more concerning is that sanctioned
countries are operating cryptocurrency exchanges. 12

htps://www.nber.org/papers/w29337
htps://securi�esanaly�cs.com/crypto-suspicious-ac�vity-report-enforcement-ac�ons/
11
htps://securi�esanaly�cs.com/fraud-within-crypto-companies/
12
htps://securi�esanaly�cs.com/sanc�oned-countries-are-opera�ng-crypto-exchanges/
9

10

7

Tes�mony of Alison Jimenez

November 15, 2023

“We’ve got sanctioned countries setting up cryptocurrency exchanges that are being
used to facilitate the transfer of U.S. dollars over to those sanctioned countries. I’ve seen
those in the millions, and potentially in the billions.” – Jack McDonald, IRS-CI, ABA/ABA
Financial Crimes Enforcement Conference, December 2022.
Flawed comparisons of crypto crime to ﬁatPu�ng crypto crime into context is a worthwhile endeavor but making invalid comparisons only
confuses the issue.
Hopefully we can agree that the comparison below is nonsense:
Alice drinks 2% milk.
Bob puts 98% unleaded gasoline in his car.
Bob’s percentage is 49 �mes greater than Alice’s!
Yet, statements like this are rou�nely used when discussing cryptocurrency’s use in illicit ﬁnanceversus tradi�onal ﬁnancial products.
Commentators o�en erroneously compare a UN es�mate of the value of illicit proceeds ranging
2% to 5% of global GDP to numbers published by blockchain analy�cs vendors that reporttransac�ons involving illicit address are less than 1% percent of all digital asset transac�onvolume. Some commentators extrapolate from the invalid comparison to suggest that “criminals
don’t like crypto.” 13
Here are a few reasons why this comparison is ﬂawed:
•

•

•

•

Blockchain analy�cs illicit transac�ons only include “known” or “atributed” on-chaintransac�ons while the UN’s es�mate was of all illicit proceeds, not just proceeds clearly“atributed” to criminals.
The UN es�mated the proceeds of crime, not the means of payment. The means of
payment could have been real estate, oil, stock, jewelry, bartering of drugs for weapons,or government issued currency (ﬁat).
Blockchain analy�cs vendors divide their illicit crypto transac�on amount by all
cryptocurrency transac�on volume. Cryptocurrency transac�on volume is inﬂated inseveral ways including: bad actors crea�ng thousands of transac�ons to obscure fundmovement, leveraged trading, rampant wash-trading, and moving cryptocurrency
between wallets without any meaningful economic ac�vity.
Blockchain analy�cs calcula�ons divides “known” illicit transac�ons by "all”
cryptocurrency transac�ons. The denominator, “all crypto transac�ons”, includes
unidentiﬁed illicit ac�vity, licit transac�ons, and unclassiﬁed transac�on. Commentators

Couvee, Koos. “Cryptocurrency Research Firms Vastly Underes�mate Illicit Payments, Cri�cs Claim”,
ACAMSToday, 6/29/23.

13

8

Tes�mony of Alison Jimenez•

November 15, 2023

o�en incorrectly interpret this data to only include the binary op�ons of illicit or licitac�vity. Addi�onally, when transac�ons are atributed a regulated exchange, blockchain
analy�cs o�en cannot determine if illicit crypto was involved.
Global GDP and “all cryptocurrency transac�on volume” are not interchangeable and do
not measure the same thing. Global “transac�on volume” is orders of magnitude greaterthan Global GDP.

In summary, blockchain analy�cs, while helpful in certain situa�ons, cannot and does notprovide the complete picture of the use of cryptocurrency in illicit ﬁnance.
Illicit Finance by “Ancillary” Cryptocurrency Entities
One final topic worth addressing in my testimony is the issue of cryptocurrency illicit finance by
cryptocurrency miners/validators.
Cryptocurrency miners are o�en viewed as the unexci�ng plumbing behind crypto, with asimple business of earning new coins from processing transac�ons.
However, my analysis has found dozens of ways that cryptocurrency miners/validators havebeen involved in illicit ac�vity including 14:
•
•
•
•
•
•

sanc�oned en��es mining cryptocurrency to raise fundsthe� crimes (ex. stealing compu�ng power via malware)
facilita�ng money laundering or the� by others (ex. valida�ng transac�ons from known
illicit sources)
corrup�on (ex. paying bribes for electricity subsidies)
investment scams
cryptocurrency market manipula�on.

Na�onal security concerns have also risen from cryptocurrency mining. For example, theDepartment of Jus�ce reported that Russian government-backed hacking ac�vi�es werepar�ally funded via bitcoin mining. 15 Recently, the New York Times reported on na�onal security
concerns rela�ng to Chinese-owned bitcoin mining opera�ons in the United State. 16
Recommended Actions:1) FinCEN should regularly publish the number of cryptocurrency-related SARs.
2) The SAR form should be updated to include cryptocurrency as a financial
product/instrument.

htps://securi�esanaly�cs.com/cryptocurrency-miners-crime-let-me-count-the-ways/
htps://www.jus�ce.gov/archives/sco/ﬁle/1373816/download
16
htps://www.ny�mes.com/2023/10/13/us/bitcoin-mines-china-united-states.html
14
15

9

Tes�mony of Alison Jimenez

November 15, 2023

3) The SAR form should be updated to specifically categorize SARs filed by cryptocurrencyrelated institutions.
4) Proposed legislation should consider cryptocurrency illicit finance by cryptocurrency
miners, validators, and mining/validating pools.
5) Proposed legislation should not provide weaker oversight to stablecoins given theirgrowing use in illicit finance.

10