E L L I P T I C M E TAV E R S E R E P O R T 2 0 2 2

The Future of
Financial Crimein the Metaverse
Fighting Crypto-crime in Web3.0

1

The Future of Financial Crime in the Metaverse

What is the metaverse?

03

Components of the Metaverse
Land
Wearables
Native Assets

Potential Metaverse Financial Crime Typologies

14

Money Laundering

18

Protecting Against Money Laundering

21

Wash Trading
Protecting Against Wash Trading Risks

23

Scams
Protecting Against Scam Risks

Sanctions and Terrorism Funding

31

Protecting Against Sanctions Risks

35

Code Exploits
Protecting Against Code Exploit Risks

Illegal Shops and Services

38

Sex-related Crimes

40

Child sexual Abuse Material
Non-Consensual Porn
Sexual Harassment

2

Preventing Financial Crime in the Metaverse

42

Glossary

43

Citations47

About the Author

50

The Future of Financial Crime in the Metaverse

What is the Metaverse?
The metaverse is a term which applies to the broad range of technologies that aim to merge the social
connections of the real world with the innovations of the digital age. Where this blend occurs withtraditional companies such as Snapchat’s augmented reality filters, the proliferation of social media apps on
our mobile devices, or giant multiplayer gaming worlds such as Fortnite, this is considered to be the web2.0
metaverse. Meanwhile, where the metaverse has decentralized ownership and control, this is known as theweb3.0 metaverse.
The phrase “metaverse” was first coined in Neal Stephenson’s 1992 novel Snow Crash. The book describes
a world where governments have been replaced by corporations, the global economy has collapsed, andcitizens escape from this bleak reality by accessing a virtual world through headsets. Here, their avatars canroam the digital street, own a virtual property and socialize with others.
This dystopian future isn’t the backdrop for the growth of the metaverse in our world. Instead, it has evolved
through the increase in digitalization and emergence of new technologies, with the introduction of theweb3.0 metaverse coming in the wake of multiple cryptoasset and blockchain innovations.
An online survey of 100 Elliptic customers and crypto and finance professionals – carried out in May 2022
– found that at least 58% of respondents expected the metaverse to deliver some commercial opportunity
for their business within the next five years. This suggests significant potential for involvement from both
crypto-native and more traditional financial institutions.
Tellingly, at least 66% of respondents are already in the process of, or have an intention to assess their risk ofmetaverse-related fincrime vectors, many of which we will outline in our typologies section.

Components of the Metaverse
There are a number of foundational concepts to explain in order to understand what a metaverse is:

How you access it
With the release of Meta’s Oculus Rift and Google’s Daydream, virtual reality headsets are now an entry pointof choice to access metaverse services – just as predicted in Stephenson’s book. However, improvements in
hardware will offer the ability to wear haptic suits to physically experience the metaverse and 360 treadmills
will allow for more realistic mobility through the digital world. Therefore, while much of the web2.0 metaverse isaccessed through mobile devices, laptops and gaming consoles, the web3.0 metaverse is expected to be much
more immersive.
Coupled with this – and since they’re not constrained by physical capacity limitations – is the ability formetaverses to host vast numbers of people simultaneously. Demonstrating this, gaming metaverse Fortnite
hosted over 10 million virtual attendees at the Marshmello concert in 2019 and Travis Scott’s gig in April 2020
saw over 12 million, with many connecting through their mobile devices.

3

The Future of Financial Crime in the Metaverse

A 360 treadmill being used with a virtual reality headset

There are often no barriers to entry for a metaverse, with a device or cryptoasset address serving as agateway into the world and no identity checks being required. As such, the expectation is that the tech savvy
generation z and generation alpha will embrace the metaverse’s open door policy in much the same way thatmillennials adopted social media apps.

What’s Available to See and Do
While the jury is still out on whether any metaverse-related apps have truly gone mainstream, there are plentyof options to explore. Meta’s Horizon Worlds offers virtual meeting rooms and social spaces, Decentralandbrings virtual land and wearables, and gaming platforms like Roblox or Minecraft offer massive multiplayer
experiences. In addition, we’ve seen significant institutional investment and adoption from tier-one banks
looking to embrace the metaverse. HSBC announced a metaverse partnership in March 20221 and JP Morgan
opened up a metaverse space – complete with virtual tiger – in February 20222. There have also been moves
by governments and regulators, such as the Barbados government announcing its plans for the world’s
first metaverse embassy3 and Dubai’s digital asset regulator revealing that it intends to create a virtual HQ4.
Furthermore, there are interactive art exhibitions such as Philip Colbert’s Lobsteropolis5 where users must
locate hidden objects within the lobster-themed space, NFT art galleries with VIP spaces only admitting thosewith certain blockchain-based tokens in their wallet, and virtual sandwich delis where your creation can beentered into a real life sandwich competition6.
In line with this growing number of metaverse-based services and businesses, technology research firm
Gartner predicts that by 2026, 30% of organizations from the real world will be ready to offer metaverserelated goods and services7, and that 25% of people will spend at least one hour a day immersed in it8. The
metaverse therefore goes beyond a mirroring of goods and services available in the real world to become an
extension of what’s possible.

4

The Future of Financial Crime in the Metaverse

I happily played World of Warcraft during
2007-2010, but one day Blizzard removed thedamage component from my beloved warlock’s
Siphon Life spell. I cried myself to sleep, and onthat day I realized what horrors centralized
services can bring. I soon decided to quit.
Vitalik Buterin, Co-founder ofthe Ethereum blockchain.

5

The Future of Financial Crime in the Metaverse

Who “Owns” it
Another key consideration for metaverse creation is whether the space is centralized – and therefore created,
owned and controlled by an organization – or decentralized and owned by members of the metaverse
community. Typically, centralized metaverses are usually referred to as web2.0 metaverses, while thedecentralized versions are web3.0 metaverses.

•

Centralized Metaverses
One of the first metaverses – although it predates the use of the term – was Second Life, which launchedin 2003. This giant multiplayer game saw people create avatars and live their virtual lives, with over 8
million monthly users at its peak in 20169, tapering to a still-impressive 30,000 active users per month10 in
2022. More recently was the millennial obsession with The Sims – a game originally released in the year
2000 and now on its fourth iteration – which sees players control the lives of virtual characters. However,the long-term popularity of The Sims has been eclipsed by generation z’s interest in newer massive
multiplayer games such as Fortnite, Roblox and Minecraft. Notably, in these metaverses, you can own landand purchase wearables such as clothing and accessories, although these remain in the control of thecompanies who develop and operate the virtual world and for whom these have emerged as significant
revenue drivers. This model of in-game purchases led Fortnite to deliver $5.1 billion in revenue in 202011.
Under the control of a single entity, these centralized metaverses retain the ability to unilaterally makechanges to the environment or prohibit players from entering the space. While this can have many
benefits – such as protecting players from potential harm – centralization has led to some unforeseen
consequences, such as being the original inspiration for the Ethereum blockchain:“I happily played World of Warcraft during 2007-2010, but one day Blizzard removed the damage
component from my beloved warlock’s Siphon Life spell. I cried myself to sleep, and on that day I realized
what horrors centralized services can bring. I soon decided to quit.” Vitalik Buterin – Co-founder of the
Ethereum blockchain12.

•

Decentralized Metaverses
Buoyed by the success of centralized metaverses yet intent on placing user-ownership and control at
the fore, decentralized web3.0 metaverses offer users the ability to own and trade goods within the
metaverse, but utilize cryptoassets as the underlying mechanism. This prevents any one entity from having
unilateral control over the metaverse.
The possibility for ownership and control stems from the creation of metaverse assets as tokens basedon a blockchain. The most popular token standard is ERC721 – also known as non-fungible tokens (NFTs).
These tokens have unique properties which allow them to represent a host of different and unique objects
in the metaverse.
In addition to the ERC721 token standard, there has also been the adoption of other blockchain-based
technologies such as Proof of Attendance Protocol (POAP), which acts as a digital wristband to
immutably show that you attended a metaverse event – such as a conference, festival or a wedding. Thiscan bring both social status as well as exclusive access into other events and areas within the metaverse.

6

The Future of Financial Crime in the Metaverse

Within many decentralized metaverses, it’s also possible to buy a unique blockchain-based name for youravatar rather than the auto-generated default option. This offers the potential to showcase your personalbrand across the different web3.0 products and services, since the same immutable name can be usedthroughout.
In addition, the metaverse also makes use of ERC20 tokens, which are fungible assets and more closely
represent a digital form of money.
Decentraland – created in 2017 with a public launch in February 2020 – is perhaps the most well known
decentralized metaverse with 300,00013 monthly active users. Players can connect their MetaMask wallet(a cryptoasset wallet used to interact with Ethereum-compatible blockchains) to roam around the virtualworld and interact with other players and estates (plots of land which have been built on). Land can bebought with the native currency MANA and then developed into whatever the imagination can concoct.
Users can also dress their avatar in a myriad of different fashion options ranging from banana suits, todigital reproductions of luxury real-world fashion garments and custom-made metaverse designer wear.

Example of Proof of Attendance Protocol (POAP) with Vitalik’s public wallet

7

The Future of Financial Crime in the Metaverse

Source: https://www.cbinsights.com/research/metaverse-market-map/

8

The Future of Financial Crime in the Metaverse

The report author at Genesis Plaza within Decentraland

There are a number of challengers for the decentralized metaverse top-spot, with The Sandbox, Illuvium,
and Otherside among others looking to replace Decentraland as the go-to-metaverse. They are all seeing
growing user numbers and more active markets for land and wearables.

Trading activity on Decentraland 2022
160

50
40

120

30

80

20

40

10

0

0

18 May22 May26 May30 May03 Jun07 Jun11 Jun 14 Jun

150

300

Trading activity on Sandbox 2022

120
90

180

60

120

30

60

0

0

18 May22 May26 May30 May

Users

9

240

03 Jun07 JunTransactions

The Future of Financial Crime in the Metaverse

11 Jun15 JunWithin the web3.0 metaverse – which is what this report will focus on – there are a number of key assets.

Land
In the majority of metaverses, it’s possible to buy virtual plots of land and either hold it in the hope of future
price rises or use it to build on. Users can create virtual art galleries to showcase their owned NFT artworks,
build visitor centers for company marketing, create games which can be playable for cryptoassets, and amyriad of other constructions.
Land is represented by an NFT, which provides immutable ownership for the user since this is stored
on a blockchain.

The image above shows an estate onsale in the Decentraland metaverse
and at the time of writing, it is priced at
almost $37,00014.

Meanwhile, the image below shows this report’s author standing on some undeveloped land which is on salefor over $1.6 million15.

10

The Future of Financial Crime in the Metaverse

These eye-watering prices for virtual land are not atypical, with one estate in The Sandbox selling for$450,000 – due to having Snoop Dogg as a virtual neighbor – and the average land sale in Decentraland isaround $6,00016. While there is no universal pricing model for metaverse land, factors in Decentraland which
can impact price are: proximity to a road (the light gray areas on the map); proximity to a plaza (an area forcommon use often featuring general crypto information and learning opportunities); being located within a
district (large purple areas in the map) and proximity to a “Place of Interest” (denoted by a yellow star on the
map and therefore easier to find). There are already a small number of metaverse estate agents and brokers
who will help prospective land owners secure their desired estate for the most favorable price and ensure
they are buying in an up-and-coming area.
The majority of metaverses have a limited amount of land for sale, either released in bulk at the launch of
the project or via tranches as the metaverse grows in popularity. The Sandbox initially released land in a
discount presale and then a number of public sales which will continue to happen over the next few years.
However, there is an active secondary market on NFT marketplaces such as OpenSea, where users canpurchase land directly from other owners. This is usually in ETH, WETH or an ERC20 asset specific to themetaverse.

Wearables
Wearables – also referred to as “skins” – are clothing and accessories for avatars in the metaverse. There are
now many metaverse fashion houses which develop wearables and even some traditional fashion houses
are making moves into the space. These include Nike and RTFKT’s metaverse sneaker partnership17, Gucci’s
continued play into the space18, Balenciaga’s wearable drop in Fortnite19 and even Snoop Dogg creating
virtual wearable collections20. As with metaverse land, wearables are NFTs with data stored on a blockchain.
Therefore, creation, ownership and transference information is all stored immutably on the network.

Some wearables available to purchase on Decentraland

11

The Future of Financial Crime in the Metaverse

In line with much of the cryptoasset market – such as the growth of profile picture project (PFP) NFTs where
NFTs are used as profile pictures across social media – elaborate and creative wearables are a statementof wealth and a display of social standing within the crypto crowd. Certain wearables can show you belong
to particular crypto factions, have attended various events of note or show that you work for a specificcompany, for instance.
Similar to metaverse land, there is an active primary and secondary market for metaverse wearables, withmany metaverses hosting their own on-platform marketplaces. Over the last year, wearable sales on the
Decentraland market have seen steady growth and over 71,00021 wearable items have been created.
Some of this growth is likely driven by an increase in people accessing the metaverse, but there is also asignificant expectation that the metaverse will provide plentiful commercial opportunities. As a result, moredevelopers are entering the wearable space and starting to design luxury and custom wearables to sell at apremium. An additional driver has likely been the first ever Metaverse Fashion Week (MVFW). This took placein March 2022 in Decentraland and hosted virtual shops from luxury fashion houses such as Tommy Hilfiger,
catwalks shows by Dolce & Gabbana and a host of events offering access to limited-edition wearables.
As with virtual land, there is no universal pricing model for wearables. Instead, aspects such as rarity (howmany pieces have been created), the creator (whether they are a notable creator or company in the space),
and whether it is following a real world or metaverse trend help to set the price for a wearable.

12

The Future of Financial Crime in the Metaverse

Native Assets
With metaverses looking to provide a virtual world with goods and services, there needs to be a currency tofacilitate trading. As such, many metaverses will have their own native asset which users make use of to buy
land, wearables and any services and applications.
For Decentraland this is MANA, for The Sandbox it’s SAND, and for the recently announced but yet to launch
Otherside – from Bored Ape Yacht Club – it will be APE. We refer to these as the native currencies of themetaverses and all currently exist as ERC20 tokens on the Ethereum blockchain, with MANA also available
on the popular layer-two scaling solution Polygon.
However, as with any new innovation, there are already those who are exploring what role land, wearables
and native metaverse cryptoassets can play in their illicit activities.

Top Metaverse Tokens by Market Capitalization June, 2022

Source: https://coinmarketcap.com/view/metaverse/

13

The Future of Financial Crime in the Metaverse

Potential
Metaverse
Financial
Crime
Typologies
14

The Future of Financial Crime in the Metaverse

Wherever there are concentrations of value, there will be crime – and the metaverse is no exception.
Citibank predicts that the metaverse will be worth up to $13 trillion22 by 2030. At the time of writing, the top
five metaverse native assets are seeing 24-hour volumes of almost $4 billion23 and seven-day virtual land sales
total $2.94 million24 across just Decentraland alone (although market volatility since the creation of this report
has now led to reduced figures across the board). Google searches for “metaverse” have also seen a notable
uplift since the tail end of 202125.
While the reality for many businesses is that the precise opportunities offered by the metaverse have yet tobecome clear, when Elliptic surveyed our own customer base and members of the crypto community we foundthat just 14% of respondents saw no commercial opportunities for their business within the next five years fromthe metaverse.

Google Searches for “Metaverse“
100%

75%

50%

25%

0%

23 May 2021

12 Sept 2021

2 Jan 2022

24 Apr 2022

While there is still much discovery to be done, there is a clear indication of significant interest and expectationin the metaverse as a revenue driver and as an investment opportunity for crypto-friendy businesses.
We therefore believe that the metaverse could be an attractive liquidity pool for money launderers and apotential new vector for scammers.
From analysis of Elliptic’s data set, we can already see that there is illicit activity linked to the metaverse-related
assets MANA and SAND. Of this illicit activity, 99.5% is linked to cryptoasset thefts – highlighting the mostcommon criminal activity at present. This mirrors wider criminal activity across NFTs where social engineering,fake giveaways and MetaMask browser wallet attacks can create a dangerous environment for those buying,selling and transferring NFTs. We have also observed illicit metaverse native asset-related activity linked toscams, phishing and malware.

15

The Future of Financial Crime in the Metaverse

In addition, we have detected a number of Decentraland land sales linked to scams and thefts, which are split
almost evenly across the NFT marketplaces OpenSea and LooksRare. These were driven by land stolen from
MetaMask and phishing attacks on the popular NFT marketplace OpenSea.

Decentraland Land Scams by Marketplace

OpenSea
42.8%

LooksRare
57.2%

One such example is26 :16

The Future of Financial Crime in the Metaverse

In the second section – “Potential Metaverse Crime Typologies” – we explore what avenues illicit actors mightlook to leverage in order to conduct financial crime, as well as exploring case studies of existing metaverserelated crimes. We will provide guidance on what individuals and businesses in the crypto ecosystem can do toprotect from these emerging risks. This is especially relevant since Elliptic’s survey on metaverse crime foundthat 66% of respondents are actively assessing metaverse-related risks as of May 2022, or plan to in the future,but only 36% of respondents are currently comfortable or very familiar with the concept of the metaverse. In
addition whilst there are early efforts for industry players to collaborate on interoperability and technology
standards - such as the newly formed Metaverse Standards Forum including tech giants Meta, Sony, Unity,
and the World Wide Web Consortium, there is currently no regulation or standards for protecting against
metaverse-based crimes26.
This guide deep dives into financial crime typologies using metaverse-related cryptoassets, in order to arm
compliance teams with a comprehensive set of warning signs and case studies on:• Illicit activity involving cryptoassets in the metaverse.
• Examples of how these indicators fit into broader criminal behaviors.
• Context on how criminals engaged in these activities are working to clean their illicit funds.

Red Flags & Warning Signals
Warnings describe significant issues and trends in criminal behavior that are worth highlighting and
can indicate suspicious activity, while red flags are indicators of risk that might not clearly pinpoint
illicit activity as a standalone.

Diagrams and Flowcharts
Illustrations, diagrams, graphs and charts are included throughout to help you visualize a typology
and, where possible, give a relative view.

Case Studies
Wherever possible, real-life examples of how criminals are exploiting the typologies Elliptic has
examined are included to evidence how the typology is played out.

Key Controls
These summarize solutions that compliance officers in Elliiptic’s network have devised to manage
exposure to certain risks to demonstrate mitigating actions that have been effective.

17

The Future of Financial Crime in the Metaverse

Money Laundering
As we have seen with decentralized finance (DeFi) and NFTs, it is likely that as awareness and adoption of themetaverse continues to grow, illicit actors will look to leverage it as a channel to launder illicit funds. Theseassets may come from real-world activities or from other crypto-based crimes, and criminals could look tohide their source by exchanging them for metaverse based-assets such as land, wearables or native metaverse
cryptoassets.
In 2021, total sales of all cryptoassets – including land – across Decentraland, Cryptovoxels, The Sandbox andSomnium Space surpassed $500 million27, and this is expected to double in 2022. Therefore, the metaverse islooking like an increasingly attractive liquidity venue for criminals looking to launder assets.
With plots of land selling for millions of dollars28, average land prices in Decentraland reaching tens of
thousands of dollars through 2021 and The Sandbox seeing weekly volume since December 2021 of over $70
million29, we can see a potential route for significant volumes of illicit funds to be moved.

Average Value of Daily Transactions on Decentraland

Source: https://nonfungible.com/market-tracker/decentralandAn additional risk factor is that unlike in the real world – where purchasing a property or land involves reams
of documentation and solicitor-led checks – purchasing metaverse land can be done with little more than acryptoasset address and some funds. Unlike mainstream cryptoasset exchanges, know-your-customer (KYC)
checks are not typically required to purchase products on metaverse marketplaces, and the same applies
to secondary marketplaces, which in some cases facilitate multi-million pound transfers of virtual property.
However, a notable exception to this was the Otherside metaverse land launch from Yuga Labs, which required
prospective land buyers to complete KYC checks ahead of the public land sale.
An illicit actor looking to launder funds through metaverse land would be able to purchase plots or developed
estates and re-sell through a secondary market or directly to another actor, in order to then demonstrate thatthe source of their income was through a metaverse land sale.30

18

The Future of Financial Crime in the Metaverse

It’s also possible that illicit actors may look to use wearables to launder the proceeds of crime. That said,
there is a less liquid market for these assets due to the infinite number of wearables which can be created andmany items being an identical piece from a 10,000 batch – therefore lacking scarcity. Furthermore, similar
to NFTs, it’s challenging to predict which pieces will resell at a profit. At Elliptic, we have already conducted
research31 into the impact of rarity on NFT resale prices and continue to build out our expertise as NFT trends
in the metaverse take shape. In addition, the volume of wearable sales is much smaller than land with less than
$5,000 worth of wearables sold in Decentraland in the last seven days at the time of writing, and the average
wearable price being under $10032. That said, there have been standout pieces such as a Decentraland bloody
knife which sold for nearly $12,00033, Coca Cola’s Bubble Jacket which is on sale for almost $1.5 million34, anda super yacht on The Sandbox which sold for over $650,00035. Therefore, the average price of wearables

currently makes them limited in use for large-scale money laundering. Though this may all change, as themetaverse wearable market is predicted to reach $3 trillion by the end of 202336.
A risk factor with wearables – which doesn’t exist with metaverse land – is interoperability, whereby
collection creators are making wearables which can exist across multiple metaverses. The opportunity
here is that a bad actor can purchase a wearable in one metaverse, and then move it to another where they
cash out via a secondary sale and thus make the flow of funds harder to trace, since it’s across multiple
blockchains.
Finally, when considering money laundering risks in the metaverse, it is worth considering the risk that an
illicit actor may use the metaverse’s native asset. This can be done using the same techniques as money
laundering through non-metaverse related cryptoassets. Bad actors could look to deposit metaverse native

19

The Future of Financial Crime in the Metaverse

assets into an exchange, often using obfuscation techniques such as sending from a mixer, utilizing CoinJointransactions to mix inputs with other transactions, or attempting to move the funds through multiple “hops”
in order to try to hide the source of the funds. They could also look to leverage decentralized exchanges,
which largely do not require any KYC information or apply compliance checks to transactions.

Protecting Against Money Laundering Risks
Red Flags and Warning Signals
In order to mitigate risks of money laundering through metaverse-related assets, secondary marketplaces,
exchanges and others can perform compliance screening on the accounts sending/receiving funds toascertain any money laundering risks.
This will ensure that any attempt to use an obfuscation technique or service is flagged, and any other money
laundering risks can be found.
This is possible since the underlying assets are predominantly ERC20 and ERC721/ERC1155 (NFT) tokens
on the Ethereum blockchain, so you can use blockchain analytics solutions to understand the source anddestination of the funds.
However, as illicit actors will often look to operate across many different assets – and interoperability acrosschains grows – it is also important to have a holistic view of the risks of a single metaverse as well as acrossmultiple metaverses. This can ensure that a nefarious actor is not trying to hide “dirty” money in one asset or
metaverse and “clean” it through another. As such, when screening metaverse-related assets or transactions,being able to see the results across multiple blockchains and/or metaverses can help to build up this picture.

20

The Future of Financial Crime in the Metaverse

Wash Trading
Wash trading is the action of selling an item to yourself or a collaborating actor with the intention of inflating
the price or making the perceived volumes look larger. This type of illicit activity has been seen across thecrypto markets for a number of years. Indeed, many exchanges have been accused of inflating their volumes
via wash trading, with a reported 95%37 of all activity on NFT marketplace LooksRare being attributed to it andan estimated wash trading volume of up to $8 trillion globally in 202138.
With rampant wash trading in other crypto markets, it’s clear that this could be a growing avenue for illicit
actors to leverage with metaverse-based assets – whether in an attempt to bolster market sentiment of native
metaverse assets or to try to secure a higher sale price for wearable and land sales.
Exploring a number of land trades for Decentraland parcels and estates, there appears to be somequestionable activity which looks like it could be wash trading. However, it is very challenging to definitively
give a figure for wash trading across metaverses.
When looking at the top 250 NFT projects by 30-day sales39 and filtering for metaverse-related projects, there
is a reported $29.9 million worth of wash trading activities. Though this represents just 3.33% of total monthly
sales on these platforms.

Wash trading as identified by crypto data aggregator CryptoSlam
Project

30 dayTrade $

30-dayWash Trade $30-dayTrade Number

30-day Wash
Trade Number

Crypto Unicorns
Land Market$3,906,976

$ 208

4521

1

Arcade land

$11,909

$974

14

2

Otherdeed$892,094,915$29,942,300

38162

302

Metamon$45,918$3,521

154

12

Link
https://cryptoslam.io/cryptounicorns-land-market
https://cryptoslam.io/
arcade-land
https://cryptoslam.io/
otherdeedhttps://cryptoslam.io/
metamon

Pixlemon$2,317,947

$0.00

2091

0

https://cryptoslam.io/
pixelmon21$898,377,655$29,947,003

44.94

317

Wash trade %3.33

Wash trade % 0.70

The Future of Financial Crime in the Metaverse

Protecting Against Wash Trading Risks
Red Flags and Warning Signals
When assessing the risks of wash trading in metaverse-related assets, it is important to review the trading
volumes against historical trends and compare against wider cryptoasset-related activity.
For example, a new metaverse which is seeing millions of dollars in asset volume but has limited marketingand industry attention is likely to be encountering wash trading activity. Therefore, where there is limited trade
history, one should attempt to understand the fundamentals of a price – whether it be land, a wearable or ametaverse native asset. As noted above, there are certain aspects of land and wearables which are alreadybeginning to become universally acknowledged as price drivers – such as proximity to key locations or
notability of the collection creator. As such, when assessing whether something appears to be at a fair market
price or an elevated one which may be the result of wash trading, assessing these price drivers can be useful.
Mirroring the traditional markets as well as protections for DeFi and wider NFT-related activity, many virtual
asset services providers (VASPs) are also putting statistical models and implementing monitoring to help drawout signals for wash trading. This could be building out activity monitoring around the Pareto principle and
Benford’s law, as well as monitoring trade cadence and counterparties.
The Pareto Principle
The Pareto principle states that for many outcomes, approximately 80% of consequences come from 20%
of causes. In other words, a small percentage of causes have an outsized effect. Using this and metrics
such as the volume-weighted cap40, it’s possible to explore expected and reported market dominance fora cryptoasset.
Benford’s Law
Benford’s law – also known as the Newcomb-Benford law – is an observation that in many real-life setsof numerical data, the leading digit is likely to be small. This can be applied to statistically search for wash
trading activity as well as so-called “pump and dump” projects41.
However, one of the challenges with analyzing metaverse-related activity for suspected wash trading is
the boom-and-bust nature of some of these platforms and associated assets. A celebrity land purchaseor luxury fashion house wearable drop can drive elevated traffic to the metaverse or secondary market –thus moving trading volume outside of normal market levels. As noted above, the pseudonymous natureof blockchains also means it is difficult to ascertain whether actors involved in a trade are distinct. Thoughusing cluster-based blockchain analysis where actors can be grouped together based on high confidence
pattern analysis and transaction history, it is possible to discover any actors masquerading as individual
entities but who are actually the same person.

22

The Future of Financial Crime in the Metaverse

ScamsUnfortunately, a steady stream of scams have emerged thanks to the amount of retail and institutional
capital coming into the crypto space – coupled with limited education about keeping funds safe and being
able to identify red flags for illicit activity. These range from rug pulls where projects will raise capital andthen disappear before delivering any roadmap promises, investment scams which promise guaranteed
returns but do not deliver on this or return the invested capital, and giveaway scams where users are falsely
promised a multiplied return if they send funds to an address.
In 2021, it was reported that over $14 billion worth of cryptoassets were stolen due to scams42. The assets
involved are usually bitcoin and Ethereum-based tokens, since they are the most well known and readilyavailable assets – especially for those new to the space. From examining our dataset, we have alreadyidentified a number of metaverse-related transactions linked to MANA and SAND which have connections
to scammers and phishing attempts. These figures are relatively small, especially when compared to illicit
activity in the DeFi sector. However, as the concept of the metaverse continues to grow across both thecrypto and non-crypto community, it’s likely we’ll see scammers switch their focus from DeFi and NFTrelated scams to more metaverse-specific assets.
Some scam typologies which we may see are:Giveaway scams: Illicit actors may look to piggyback off the growing interest in native metaverse
crypto assets and run giveaway scams for assets such as LAND, SAND and APE.

Fake metaverses: Illicit actors may announce the launch of a new metaverse, likely with social
media and marketing to match. Yet no such metaverse will exist, and when users attempt toconnect via their MetaMask they will see their account wiped.

Phishing attacks: There has already been evidence of illicit actors attempting to phish
unsuspecting users into clicking nefarious links which purport to be from well-known metaverses.
As with many other scam types, the danger is a nefarious connection to your MetaMask accountand a swiping of your assets.

Wearable minting scam: With the growing popularity of wearables and the fear of missing out
on exclusive collections, we may see a similar trend to NFT minting scams, whereby intentionally
buggy smart contracts are created which do not distribute a new wearable and instead the minting
costs go to the bad actor. This would mirror the Big Daddy Ape Club NFT scam, which saw over $1.2
million taken from over 9,000 investors43.

Technical support scams: Metaverses – as with any new app, game or software-based product –can require some technical knowledge to set up and use successfully. We may, therefore, see bad
actors posing as support staff for metaverses in order to try to trick new users into sharing private
keys or connecting their MetaMask wallets to nefarious websites.

23

The Future of Financial Crime in the Metaverse

ICO/fundraising scams: Over $1.3 billion in capital was scammed from crypto investors during the2017/18 initial coin offering (ICO) boom and bust44. With new metaverse projects launching andcrypto investors looking for their next profitable venture, we will likely see fake projects trying toraise funds through ICOs and various derivatives of them.

Fake land expansions/drops: The majority of metaverses have a limited land supply in order tohold value and create a more exclusive community/ownership model. For Decentraland, this is90,601 plots of land, with some reserved for community owned spaces, Meanwhile, The Sandbox
has 166,464 pieces of land, and Shiba Inu’s yet-to-launch metaverse is expected to have 100,000
plots. Though as some of the main metaverses fill up and secondary land sales become more
expensive due to scarcity, we may see nefarious actors look to launch fake land expansions of newareas in these principal worlds. In addition, bad actors may try to deceive users into buying fakeversions of prominent metaverse land launches.

3D social engineering: Instead of a criminal spoofing a colleague’s email address or reaching out
via a closely-resembled domain, social engineering in the metaverse will likely take the form of 3D
avatars made up to impersonate your co-workers with the aim of getting you to share sensitive
information and access.

Rug pulls: As we have seen in some NFT projects, the team will raise funds – often through a
traditional token sale or via an early minting process – but then either deliver a lower quality projector run away with the money. As more metaverse-related projects start to be advertised, there will
be a risk that malicious actors intend to rug pull investors rather than deliver on the promises of the
project and roadmap.

24

The Future of Financial Crime in the Metaverse

C A S E ST U DY A

There have already been examples of fake airdrops and giveaway scams for metaverse-related
assets. In March 2022, when the Yuga Labs team announced the launch of MetaRPG and thenative cryptoasset ApeCoin (APE), a number of bad actors on social media platforms tried to trickusers into clicking malicious links or sending funds for fraudulent giveaways. Unfortunately, they
managed to raise around $900,000.

25

The Future of Financial Crime in the Metaverse

C A S E ST U DY B

There have already been attempts to mislead Decentraland users into clicking on phishing links
instead of the official domain. The danger of this is because the majority of users will connect via
their MetaMask – since it gives an enhanced experience with a persistent avatar – using a nefarious
link could allow an illicit actor to steal funds via this connection.
A promising step by Google has been to disable ads on Decentraland-based searches. However,other search engines may not do the same, and attackers will likely look to leverage fake ads onother platforms such as social media and other crypto/investment-based websites.
In response to this, the company behind Decentraland has been working with a number of IP
protection firms and has already taken down two websites, 24 domains, and five social media
accounts45.

26

The Future of Financial Crime in the Metaverse

C A S E ST U DY C

The Sandbox has already been hit with a number of fraudulent websites purporting to sell land forthe season two release46, as well as fake airdrops of the native LAND token for active users47. As
such, bad actors look to leverage excitement about project developments and tap into the loyal
community, who are keen to benefit from their gameplay.

27

The Future of Financial Crime in the Metaverse

C A S E ST U DY D

In February 2022, an NFT project named Pixelmon raised $68 million in a series of auctions anda minting campaign. The project claimed to be a 3D online game where holders of NFTs could
interact with the creatures within those NFTs. After the assets were unveiled in late February,
they were revealed to be of significantly lower quality than what was previously advertised on
the project’s social media. Their floor price crashed instantly from 1.3 ETH to 0.3 ETH, with many
investors accusing the project of a rug pull.
The project’s development team released an apology on its Discord channel, claiming that the“reality is that we weren’t ready to push the artwork”. Around the same time, 400 ETH was sentfrom the Pixelmon contract to a developer’s wallet, which then began purchasing several blue chip
NFTs with the funds. The Pixelmon Twitter account, while still online, ceased all activity following
the botched unveiling. Overall, $13 million of the raised $68 million has been sent out from the
project’s contract at the time of writing, though the project’s Discord server remains active and has
not been confirmed as a rug pull.

The pre-released trailer showing what the
Pixelmon project would look

The eventually released NFTs (right)

28

The Future of Financial Crime in the Metaverse

C A S E ST U DY E

Trying to capitalize on the popular Otherside land sale, some bad actors created and promoted
fake Otherside contracts in an effort to trick users into minting land. They also minted land andsent it to prominent NFT collectors such as SnoopDogg’s Cozomo de’ Medici account, Pranksy
and Ethereum merge coordinator Tim Beiko in an effort to appear legitimate. This is a tactic often
deployed by projects in an attempt to boost awareness and trick community members into thinking
that popular crypto personalities have endorsed the project.

29

The Future of Financial Crime in the Metaverse

C A S E ST U DY F

The image 149 above shows a copycat Decentraland project attempting to mislead users into
thinking that it is the official platform. You’ll note that it uses the same banner and individual land
images. But by checking the collection name matches the official name of the project – Decentraland vs Decentraland – making sure the verified checkmark is present and ensuring any volume andprice stats are in line with expectations and wider market values can help protect you from fallingprey to these scams. In addition, in May 202250, OpenSea announced a number of planned actions
to help remove copycat projects from the marketplace. Such checks included AI and human-based
checks for copyminting – where a project makes small modifications like changing colors or flipping
the image – and increasing the requirements for the blue check verification mark.

30

The Future of Financial Crime in the Metaverse

Sanctions and Terrorism Funding
There has, understandably, been much concern about whether cryptoassets in general have been or will be
used to help nation states and bad actors evade sanctions or fund terrorism. Therefore, as metaverse related
activity grows, there will be concern about its potential use for this illicit activity. There could be a number ofchannels which these types of actors look to explore:

Using Metaverse-related Cryptoassets to Fundraise for Terrorism
or Evade Sanctions
One potential avenue which sanctioned actors – especially those linked to terrorism – may look to
explore is fundraising via metaverse-related assets. However, the likelihood of this appears limited, as all
terrorist crypto-fundraising efforts Elliptic has observed so far have been primarily in bitcoin (BTC), with acomparatively small amount being in other cryptoassets. This is likely due to wider familiarity with bitcoin
versus other cryptoassets, and the widest support on fiat on-and-off ramps like crypto exchanges –therefore making it the easiest cryptoasset for sympathizers to buy and send.
An additional concern is sanctioned actors or nation states using metaverse-related assets in an attempt toevade sanctions. However, with the top five metaverse native assets seeing 24-hour volumes of $1.6 billion51
and Russia’s banking sector alone being worth $1.4 trillion, it’s clear that metaverse-related assets simply
don’t have the liquidity to support a nation state’s required volume52.
Also, when assessing accounts on the Ethereum blockchain which have been OFAC-designated as relating
to terrorism or sanctions activity, Elliptic has found no evidence to suggest that these actors have sentor received the metaverse-related assets MANA or SAND. This suggests that terrorist fundraisers andsanctioned nation states have not started to use to these specific metaverse related assets – despite theirgrowing popularity.

Sanctioned Actors Purchasing Metaverse Land
Another concern is that sanctioned actors may look to purchase land in the metaverse in order to store ortransfer illicit wealth. They could potentially seek to use the higher price tag for land versus other metaverse
related assets such as wearables and native cryptoassets, as well as the ease at which it – like otherblockchain-based assets – can be transferred globally.
However, when assessing the Decentraland LAND contract, there is no evidence to suggest that sanctioned
actors are buying native land assets in the metaverse. So, while there is plenty of evidence that sanctioned
actors use physical real estate to move and store their money, it appears that this has not translated into
metaverse activity yet.
A non-financial risk – but one worth noting – is the potential ability for sanctioned entities and broader
illicit actors to use the metaverse as a meeting point to communicate in. Many metaverses have chatfunctionalities that allow users to “follow” or “befriend” others. Therefore, this could allow groups ofillicit actors to share information outside the view of law enforcement, which may be only watching the31

The Future of Financial Crime in the Metaverse

traditional communication channels. This could be potentially attractive to sanctioned actors, since law
enforcement spends significant time trying to intercept communication channels on social media platforms,
web messaging services and mobile messaging apps, but they may not yet be following metaverse-related
activity.
As noted above, there is no evidence yet to suggest that sanctioned actors are directly interacting withsome of the high-profile metaverse-related assets. However, there are a number of examples where
sanctioned related addresses have interacted with other metaverse-linked assets.

C A S E ST U DY G

One account which we suspect to be connected to the Ryuk ransomware hack holds a metaverserelated NFT and has interacted with Ether and a number of ERC20 tokens. Ryuk is ransomware
attributed to the hacker group WIZARD SPIDER, which likely netted a total of $150m by the end of202053. While not sanctioned itself, Ryuk and other ransomware activities are often operated bysanctioned entities and nation states – bringing heightened sanctions risks.
This NFT provides the holder with the ability to access Digitible, an office in Decentraland whichapparently contains a petition to free the controversial Silk Road darknet marketplace founderRoss Ulbright. However, access into the building is restricted only to holders of these NFTs, so it
isn’t possible to go inside. It’s unclear why this account received the NFT and if they have used it togain access into the Digitible space.

32

The Future of Financial Crime in the Metaverse

When assessing accounts on the Ethereum
blockchain which have been OFAC-designatedas relating to terrorism or sanctions activity,
Elliptic has found no evidence to suggest thatthese actors have sent or received themetaverse-related assets MANA or SAND since theassets were created. This suggests that terrorist
fundraisers and sanctioned nation states have notstarted to use these specific metaverse related
assets – despite their growing popularity.
Tara Annison, Head of Technical
Crypto Advisory, Elliptic

33

The Future of Financial Crime in the Metaverse

C A S E ST U DY H

An account linked to the ransomware group REvil54, a hacker collective thought to be based in
Russia and responsible for the Colonial Pipeline hack, bought a LandVoucher55 for land in the
Matrix metaverse. This is not for the native metaverse currency, but a certificate for the digital land
you can buy and build on in the Matrix metaverse. They bought this for 0.35 ETH – worth around$1,500 – before transferring it over to a new owner around one month after purchase. It is notclear why they purchased the LandVoucher, or if the person they transferred it to was connectedto them or not, but it does indicate activity from a known sanctioned and high-profile entity in a
metaverse.

C A S E ST U DY I

In May 2022, regulators across five US states – Alabama, New Jersey, Texas, Kentucky andWisconsin – issued an emergency order for the Flamingo Casino Club (FCC) to halt the sale of its
NFT collection. The regulatory action is not just citing security registration violations, it also alleges
deceit and fraud with obscured ties to a Russian organization. NFT holders were being promised
access to a share of profits from a planned metaverse casino in The Sandbox. Other offers included
entry into a lottery with prizes of cash, iPhones, Tesla cars and access to a metaverse space it
claimed would have a cinema, bowling alley and online horse racing with their own horses.

The 33 holders of the FCC NFTs are therefore exposed to a potential sanctions violation with theongoing actions against Russia for the war in Ukraine and international scrutiny in financial dealings
with Russian citizens and businesses. But this exposure is minimal, with a total of just over $2,000
being spent on minting the NFTs and no contributing addresses having illicit links themselves. The
project’s Twitter account has not tweeted since April 14th56, and since being uncovered, OpenSea
has delisted the NFTs57 and the FCC’s Discord has been taken offline.

34

The Future of Financial Crime in the Metaverse

Protecting Against Sanctions Risks
Red Flags and Warning Signals
While it’s unlikely but not infeasible that sanctioned nation states or actors would look to leveragedevelopments in the metaverse in any significant way, it is of course a risk that should be monitored.
It is, therefore, important to be screening metaverse assets for sanctions-related activity – whether it is land,
wearable purchases, metaverse-native assets or related assets which brands may be using or developing forthe metaverse. This will help ascertain whether any sanctioned actors are attempting to violate restrictions
and allow further mitigating or reporting actions to be taken. The Elliptic Navigator and Lens tools allow you
to screen transactions and wallets for sanctions-related risks and support a number of metaverse related
cryptoassets in order to help manage your compliance risks in the space.
For an in-depth report and guidance on effectively managing sanctions-related risks, we published the 2022
report “Sanctions Compliance in Cryptocurrencies: Using Blockchain Analysis to Mitigate Risk”58.

Click to watch the Elliptic explainer video on the role of crypto in sanctions evasion

Code Exploits
Many of these metaverses exist as a complex web of smart contracts – self-executing code on a blockchain.
As such, the assets represent non-fungible token standards such as ERC721 and ERC1155 and native assets
may be ERC20s. The interactions between these assets and the services in the metaverse may be facilitatedby any number of bespoke smart contracts governing how these interactions can take place.
Yet as we have seen across the DeFi space, bad actors will look to exploit poorly-constructed contracts
or weaknesses between contracts in order to steal funds. This will likely be no different in the world of
metaverses made up of smart contracts, and there are already examples of code exploits in metaverserelated projects.

35

The Future of Financial Crime in the Metaverse

C A S E ST U DY J

In September 2020, a Yearn Finance developer began working on an NFT game called Eminence
Finance, which also came with its own token (EMN). Despite no information on the project,
investors spotted the token and minted $15 million worth of EMN in a matter of hours. They did thisusing a smart contract intended to allow players to swap DAI – a stablecoin – for EMN to fund ingame purchases.
However, an exploiter then identified a way of draining the contract of the funds using a flash loan,
which sent the token’s price plunging. A flash loan is a means of borrowing funds – typically used
for arbitrage – that must be repaid within the same block. The hacker refunded $8 million of thestolen funds back to Eminence’s developer. The game has still not been released at the time ofwriting.

In other cases, scammers may use technical bypasses – similar to code exploits – to override
private key checks in smart contracts. These allow hackers to utilize administrative privileges
despite not being developers.

36

The Future of Financial Crime in the Metaverse

C A S E ST U DY K

On August 21st 2021, exploiters managed to gain access to the NFT minting contract of the NFT
Gods metaverse gaming protocol on the Binance Smart Chain (BSC). They managed to bypass
private key checks using technical means to steal almost nine million LG tokens – the platform’s
native asset. They were then able to sell these tokens for $1.45 million through cryptoasset
exchange services which don’t require KYC checks. Due to the devaluation of LG tokens, theprotocol abandoned them as their native asset and created a new token contract.

C A S E ST U DY L

Wanaka Farms is an NFT-based metaverse gaming platform on the Binance Smart Chain (BSC).
Launched on 29 October 2021, its backend API was exploited on November 11th.
The exploiter began by depositing WANA – the platform’s native token – to the game’s smart
contract and then initiated a withdrawal. Since the API was too slow in checking whether awithdrawal had already been made, the exploiter was able to withdraw the same deposit six times
before the site would give an error. The exploiter essentially multiplied their WANA by a factor offive before repeating the process with a new wallet. The exploiter had created 1,000 wallets –though it is unknown if they were all used59.
The exploiter accumulated at least 431,000 stolen WANA and began selling some to make over
$300,000 before the token price collapsed.

Images taken from official twitter account promo video:
https://twitter.com/eminencefi/status/1493276351364669444

37

The Future of Financial Crime in the Metaverse

Protecting Against Code Exploits
Red Flags and Warning Signals
In order to protect against code exploits, it’s best to utilize metaverse-related projects where any smart
contract code has been audited and any centralized services can provide evidence that it provides security
testing and follows security best practices.
In addition, a metaverse with a technically strong and reputable development team behind it could help toreduce the risk of code exploits. However, if the team are anonymous then this may be considered as a redflag from a code safety perspective, as well as for various scam risks such as rug pulls. It’s also importantthat the team has a good level of decentralization in terms of project ownership and any private key
management and funds. Otherwise, this could make them susceptible to insider attacks or vulnerable tooutside pressure to access any of the project’s metaverse-related assets.
Outside of the more traditional financial crime typologies, there are further risks for illicit behavior in the
metaverse which we could see develop.

Illegal Shops and Services
It comes as no surprise that the metaverse is first used by early adopters and technology curious businesses,
since this mirrors other technology developments in both the crypto and non-crypto ecosystems. Alreadythere are common trends for the types of experiences these pioneers are creating in the metaverse with NFT
art galleries, topic-based museums and project social spaces being popular, as well as hybrid shops allowing
users to purchase in the metaverse and receive in the real world. This was further popularised in the recent
Decentraland Fashion Week during March 2022 where digital rendering of clothes and accessories in Boson
Protocol’s marketplace could be bought and delivered to your home in the real world. However where theseearly metaverse shops are primarily being used for virtual sneakers and dresses, bad actors in the space may
look to leverage them to sell illicit goods and services.

The author by a sneaker department in the shopping mall
Decentraland location: (-84,11)

38

The Future of Financial Crime in the Metaverse

Some early examples of metaverse shops which operate in goods and services with differing jurisdictional
legalities are a virtual shop in the CryptoVoxels metaverse where visitors can buy CBD products and havethem delivered to various US locations and a shop in The Sandbox metaverse which is planning to host
psychedelic therapy sessions in the metaverse61.
However, while HigherLife’s CBD metaverse shop and PSLY.COM’s psychedelic retreat limit their sales only
to jurisdictions where their products and services are legal, it’s possible that other actors could look to
exploit the lack of a real-world geographic location that the metaverse has and offer product and services
to jurisdictions where they are not legal. These could take the form of explicitly-branded dark markets selling
illegal products and services or they may take inspiration from front businesses like the launderettes which
inspired the term “money laundering”, and purport to sell a perfectly legal service or products, though inreality users may be directed to a Telegram or Discord chat to pay – potentially through cryptoassets – andthe items in the metaverse shop are cover items for the real-world illicit goods.
From our exploration of dark net market places and forums it appears that illicit actors do not see metaverse
shops as a primary expansion opportunity for them right now and instead are focussing on other darkmarket activities such as new marketplaces and a move to decentralization.

C A S E ST U DY M

A 30-second Youtube video62 shows a
Snapchat screen capture with robotic voiceoverlay offering a service for buying items
such as narcotics and guns and more, which
will have a metaverse storefront. The location
isn’t revealed within the video, so whether
such a service is or was ever intended to becreated cannot be verified. Yet it illustrates
that some bad actors are already looking at
the retail opportunities of the metaverse to
sell illicit products and services. This could
open up a new potential income avenue
from customers who are not familiar with orconfident in using dark markets.

39

The Future of Financial Crime in the Metaverse

Sex-related Crimes
There is a theory called Time to Penis63, which predicts how long it will take for a representation of a penis tofind its way into a game or online community. This applies whether it is Lego, SecondLife or Minecraft, andthe metaverse will not be immune to this trend. Indeed, a lewd picture even made its way to the moon64.
Therefore, while there may be many instances of ethical sex practices within the metaverse andopportunities for sex-based businesses to open up within metaverse red-light districts65, there are alreadyconcerns about how the space could be used for more sinister content such as child sexual abuse materials(CSAM), revenge porn and sexual harassment.

Child Sexual Abuse Material Risks
In 2007, it was discovered66 that some individuals on the prominent web2.0 metaverse SecondLife had
designed avatars that looked like children and were presenting them in pornographic images as well as using
them for in-game sex parties. Fast forward to the web3.0 metaverse, and sadly there remains a problem withbad actors looking to utilize new technology for CSAM.
In Decentraland, it’s possible to create interactions for a building on your owned land which links out toexternal sources such as web pages and documents. You can also host videos on TV screens within abuilding or auditorium.
The majority of this usage is perfectly legal, though it does carry the risk that malicious actors could
use these interactions to link to files which contain CSAM material67 or show explicit videos within their
metaverse space. Compounding this is the ability for land owners to restrict view access inside theirbuilding to specific addresses or token holders. This is usually in place to create member-only areas such as
for viewing rare NFT art, avatar-related gameplay such as leaderboard-led mini golf or exclusive entry forevents. However, it could also be used by illicit actors to make CSAM content viewable only to those withspecific NFTs and therefore hidden for anyone else who stumbles upon or attempts to find the building.
In addition to hosting or providing access to CSAM through the metaverse, there have also been
documented cases of children being abused directly in the metaverse. Meta’s Horizon Worlds metaverse isreported to already have a child predator problem due to the presence of those under 18 sneaking into thespace and limited age verification protections68. Furthermore, South Korea has already noted a number of
metaverse-based criminal acts relating to children:“The national police disclosed in April 2021 that an adult allegedly induced a minor to send revealing photos
in exchange for in-game items in another metaverse. The adult then used the photos to create sexually
exploitative content, said the police, without revealing whether a suspect has been charged.”“South Korea’s Ministry of Gender Equality and Family said in September 2021 that a 14-year-old girl had
been coerced into taking off her avatar’s clothes in a metaverse and then told to have her avatar performsexual acts.”
https://forkast.news/south-korea-sexual-harassment-minors-metaverse/

40

The Future of Financial Crime in the Metaverse

When analyzing the Elliptic data set, we can see that there has been no interaction of CSAM-linked accounts
with the metaverse assets MANA and SAND at the time of writing. Though ongoing monitoring and analysis
is required to ensure that these types of actors do not start to utilize metaverse-related assets in the future.
In addition, more protections will be needed to protect children from direct harm in the metaverse as well as
indirect harm facilitated by the space.

Non-Consensual Porn
Virtual porn is a growing phenomenon, with virtual reality headset-driven games like Holodexxx, ImagineVR,
and Captain Hardcore as well as VR porn aggregator websites like LewdVRGames. There is a risk that nonconsensual virtual porn could become a category within this space69 and proliferated or watched within the
metaverse.
There are already services available which can create DeepFake-esque VR porn from images of celebrities
or ex-partners and this can be used for virtual reality non-consensual sex acts.
“I use it to fulfill my sexual fantasies or replicate sexual encounters with my ex-girlfriends,” one usercommented on a subreddit dedicated to creating 3D adult content with Virt-A-Mate70
There is an added risk here that nefarious actors could apply this same technology to CSAM and also stream
this from the metaverse.

Sexual Harassment
Before there was the metaverse, there were multi-user domains (MUDs) – virtual text based worlds whereusers navigated through using text commands. One of the most popular MUDs was LambdaMOO, which hada layout that was based on a California mansion. One evening a number of users were in the “living room”
talking with one another when a user named Mr. Bungle suddenly deployed a “voodoo doll”. This was a tool
which produced text such as “John kicks Bill” – therefore making users appear to perform actions. However,
the text deployed made one user appear to perform sexual and violent acts toward two others. Over thefollowing days, there was much debate about how to respond within the virtual world, and eventually a“wizard” eliminated Mr. Bungle from the MUD71.
This was a text-based sexual harassement case within an early form of the metaverse, though unfortunately
there have already been a number of well-documented examples of modern metaverse-related sexual
harassment.
Notably, one of the beta testers for Horizon Worlds was accosted and virtually harassed, while a player
within the zombie battling game Quivr was virtually molested72. Game makers and metaverse creators
responded with various protections to push back players who get too close, and SafeZones which act asa bubble around your avatar to block unwanted advances. However, as with the risks around CSAM andsex-based crimes, further efforts will be required to better protect metaverse users from unwanted sexual
advances, and ensure that the metaverse can be a safe and enjoyable space for all.

41

The Future of Financial Crime in the Metaverse

SU M M A RY

Preventing Financial Crime in the Metaverse
Key Controls
What’s clear is that while the metaverse provides a host of new opportunities and innovation springboards,
it is already a space that is being explored by bad actors. Individuals and businesses should therefore ensure
they are adequately protected when dealing – both directly and indirectly – with metaverse-related assets.
Protections should include:
Screening: In order to protect against money laundering, wash trading and sanctions risks, it is importantthat any metaverse-related transactions and wallets are screened for illicit connections. This will help toidentify any direct or indirect exposure, and ensure that any mitigating steps can be taken. These include
conducting further investigations, blocking withdrawals, segregating funds or alerting the relevant
authorities. Elliptic’s Navigator and Lens tools can help you to manage financial crime risks relating tocryptoasset transactions and wallets.
Conduct due diligence: Before adding support for a metaverse project and related assets, ensure thatyou have conducted due diligence on the project and team behind it. This can help to ensure that it is not ascam, or has any obvious code exploit risks which could later result in the loss of funds for users holding or
trading the metaverse related assets.
Use best In class technology and innovation: Criminals will always seek to use new innovations to try
to stay ahead of law enforcement and regulators. As such, it’s important that businesses and individuals
within the crypto space use best-in-class products and services to catch illicit activity and are aware of
emerging risks. Here at Elliptic, we have dedicated teams evolving our products, data set and compliancemethodologies to ensure that our products are prepared for the new techniques and technologies which
illicit actors may look to leverage.

42

The Future of Financial Crime in the Metaverse

Glossary
Address: A cryptoasset address is a unique identifier that serves as a virtual location where a digital asset
can be sent. The address can be freely shared with others to facilitate transactions.
Airdrop: An airdrop is where a project will gift tokens – most often directly related to the project – tomembers in the community in order to entice them to use the project’s product/service. The amount oftokens someone receives may be proportional to their other activity on the project or everyone may receive
the same amount.
Augmented Reality: A technology which superimposes a computer-generated image over a user’s view of
the real world.
Blockchain: A blockchain is the transaction database shared by all nodes participating in a specificcryptoasset network. A full copy of a network’s blockchain contains every transaction ever executed in theasset. It was first introduced in the Bitcoin whitepaper published in October 2008 as the underlying protocol
to allow truly peer-to-peer transactions.
CoinJoin: A privacy-preserving transaction where the inputs of a Bitcoin transaction belong to more than
one person, but are intended to look as if they are from one person – thus trying to make on-chain analysis
less reliable.
Cryptoasset: A cryptoasset is a digital asset that is secured with cryptography and where transactions are
distributed and validated by a decentralized set of participants, and recorded on a public ledger known as a
blockchain.
Cryptocurrency: The term “cryptocurrency” can be used as an umbrella term for virtual forms of money,
but is generally used when talking about assets which are supported by a blockchain like Bitcoin (BTC)
and Ethereum (ETH). Cryptocurrencies are not issued or controlled by any government or other central
authority. They exist on peer-to-peer networks of computers running free, open-source software. Generally,anyone who wants to participate by owning, sending or spending can do so. The abbreviation “crypto” isoften used when speaking and writing.
Dark Market: Dark markets are marketplaces available on the dark web which allow users to sell a range ofgoods and services. However, due to the largely anonymous nature of the dark web, many of the items forsale are illicit.
Decentralized: Where no central counterparty has unilateral control of a system and consensus acrossparticipants is required to effect changes.
Decentralized Finance (DeFi): Decentralized finance (DeFi) is a peer-to-peer, decentralized, censorshipresistant financial system. Common DeFi applications include crypto wallets, lending, borrowing, spot
trading, margin trading, interest-earning, market-making, derivatives, options and more.

43

The Future of Financial Crime in the Metaverse

Digital Land: A virtual representation of real estate in the metaverse. This can be undeveloped or built on,
and it’s possible to own a single piece of land, multiple pieces or a space of land together.
Discord: A mobile and web-based messaging platform which offers enhanced security and end-to-end
encryption.
Ethereum: The Ethereum blockchain is a network with the ambition of being a decentralized world
computer. As such, it offers a more function-rich protocol than the Bitcoin blockchain and allows users
to transfer the native asset Ether (ETH) as well as creating smart contracts and tokens, or creating more
complex decentralized applications (DApps). Ethereum was launched in 2015 and its co-creator Vitalik
Buterin is a well known individual in the blockchain world – often speaking at conferences and being activein the space.
ERC20: ERC-20 is a technical standard for the implementation of tokens on the Ethereum blockchain,although it has also been adopted by other compatible blockchains. The rules within the standard include
how tokens are transferred between addresses and how data within each token is accessed. Tether (USDT)
is a well-known example of an ERC-20 token, and many more can be tracked online.
Flash Loan: A flash loan is a means of borrowing funds – typically used for arbitrage – that must be repaid
within the same block. However, there have been recent examples where flash loans have been usednefariously to steal funds and exploit smart contracts.
Giveaway Scam: A type of scam where the bad actor pretends that they will send crypoassets to anyone
who sends a small amount to them. The offer is usually that the person will receive a multiple of the amountthey send.
Initial Coin Offering (ICO): A fundraising technique popular in 2017 and ’18 where crypto projects raised
money by selling tokens relating to their project.
Know Your Customer: Know-your-customer (KYC) standards help protect the financial services industry
against fraud, money laundering, corruption and terrorist financing. They involve the checking and verifying
of a client’s identity both at the onboarding stage and as part of continuing obligations.
LooksRare: A marketplace selling non-fungible tokens.
Malware: Malicious software which bad actors will look to deploy onto a target’s computer with the aim ofstealing sensitive information.
MetaMask: A popular in-browser crypto wallet where cryptoassets can be sent, received and stored. For
many crypto applications and services, users must connect via their MetaMask to access the functionality.
Minting Contract: The smart contract which creates new tokens – fungible or non-fungible – for a project.
NFT Marketplace: A marketplace where users can buy, sell and browse different non-fungible tokens (NFTs).

44

The Future of Financial Crime in the Metaverse

Non-fungible Tokens (ERC721/ERC1155): A non-fungible token (NFT) is a type of cryptoasset that records
ownership of a digital item and unlike cryptoassets such as Ether (ETH) and bitcoin (BTC), it is not mutuallyinterchangeable. Each NFT is a unique asset in the digital world and can be bought and sold like any otheritem.
Office of Foreign Assets Control (OFAC): The Office of Foreign Assets Control (OFAC) of the US
Department of the Treasury administers and enforces economic and trade sanctions based on US foreign
policy and national security goals. It works against targeted foreign countries and regimes, terrorists,
international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass
destruction, and other threats to the national security, foreign policy or economy of the United​States.
OpenSea: The leading marketplace selling non-fungible tokens (NFTs).
Phishing: This is when illicit actors send emails pretending to be from recognized companies or senders in
the hope of tracking the recipient to share personal or sensitive information.
Profile Picture Projects (PFPs): A collection of non-fungible tokens (NFTs) – often 10,000 – where eachavatar has a combination of unique attributes. These images are usually from the shoulders up and tend toresemble either humans or animals. Owners use these as their profile picture on social media platforms for
cultural kudos.
Rug Pull: Where a project will raise capital and then disappear with the money before delivering any
roadmap promises.
Smart Contract: A smart contract is a computer program or a transaction protocol which is intended toautomatically execute, control or document legally-relevant events and actions according to the termsof a contract or an agreement. It was initially concepted by Nick Szabo in 1998 and later implemented onblockchains such as Ethereum.
Virtual Asset Service Provider (VASP): The Financial Action Task Force (FATF) describes a virtual asset
service provider (VASP) as an entity that facilitates any of these five business activities: the exchange
between virtual assets and fiat currencies; the exchange between one or more forms of virtual assets; thetransfer of virtual assets between crypto wallets; the safekeeping and/or administration of virtual assets or
instruments enabling control over virtual assets; or the participation in and provision of financial services
related to an issuer’s offer and/or sale of a virtual asset.
Telegram: A mobile and web-based messaging platform which offers enhanced security and end-to-end
encryption.
Token: The term token refers to a programmable unit of value which is recorded and transferred on a
blockchain. However, it is distinct from the native asset which is the cryptoasset created by the protocol
and used to pay fees, created as a block subsidy or used in the consensus protocol. The most popular token
standard is ERC-20 on the Ethereum blockchain. Tether (USDT) is an example of a token on the Ethereum
blockchain. Ether (ETH) is the native asset of Ethereum.

45

The Future of Financial Crime in the Metaverse

Wallet: A wallet is a collection of cryptoasset addresses and the corresponding private keys. They allow
digital assets to be stored – keeping them safe and accessible. They also allow you to send, receive andspend cryptoassets. Wallets can be self-hosted – where you retain control of the private keys – or hosted,which is where a custodian stores the private keys on your behalf.
Wearables: Wearables are clothing and accessories for avatars in the metaverse.

46

The Future of Financial Crime in the Metaverse

Citations
1.

https://www.coindesk.com/business/2022/03/16/hsbc-enters-the-metaverse-through-partnershipwith-the-sandbox/2.

https://fintechmagazine.com/banking/jp-morgan-becomes-the-first-bank-to-launch-in-themetaverse

3.

https://www.bloomberg.com/news/articles/2021-12-14/barbados-tries-digital-diplomacy-withplanned-metaverse-embassy

4.

https://cointelegraph.com/news/from-within-dubai-s-virtual-asset-regulator-plans-to-open-hq-inmetaverse

5.

https://artplugged.co.uk/philip-colbert-launches-lobsteropolis-city-on-decentraland/

6.

https://www.thrillist.com/news/nation/jimmy-johns-metaverse-sandwich-contest

7.

https://www.gartner.com/en/newsroom/press-releases/2022-02-07-gartner-predicts-25-percentof-people-will-spend-at-least-one-hour-per-day-in-the-metaverse-by-20268.

https://www.gartner.com/en/newsroom/press-releases/2022-02-07-gartner-predicts-25-percentof-people-will-spend-at-least-one-hour-per-day-in-the-metaverse-by-20269.

https://nwn.blogs.com/nwn/demographics/

10. https://danielvoyager.wordpress.com/sl-stats/11.

https://www.businessofapps.com/data/fortnite-statistics/

12. https://about.me/vitalik_buterin
13. https://www.xrtoday.com/virtual-reality/what-is-decentraland/#:~:text=There%20are%20
several%20reasons%20why,is%20a%20relatively%20new%20concept.
14. https://market.decentraland.org/contracts/0x959e104e1a4db6317fa58f8295f586e1a978c297/
tokens/4594
15. https://etherscan.io/nft/0xf87e3 1492faf9a91b02ee0deaad50d51d56d5d4d /11579208923731619542
3570985008687907841700384190328656281702847355233010450443
16. https://www.nft-stats.com/collection/decentraland
17. https://decrypt.co/98488/nike-rtfkt-reveal-cryptokicks-ethereum-nft-metaverse-sneakers
18. https://www.voguebusiness.com/technology/gucci-goes-deeper-into-the-metaverse-for-next-nftproject
19. https://www.epicgames.com/fortnite/en-US/news/high-digital-fashion-drops-into-fortnite-withbalenciaga
20. https://uk.finance.yahoo.com/news/snoop-dogg-enters-nft-metaverse-223716874.html
21. https://www.nft-stats.com/collection/decentraland-wearables
22. https://www.ledgerinsights.com/citi-report-values-metaverse-at-10-trillion-plus-by-2030/
23. https://coinmarketcap.com/view/metaverse/
24. https://www.nft-stats.com/collection/decentraland47

The Future of Financial Crime in the Metaverse

25. https://trends.google.com/trends/explore?q=metaverse
26. https://www.theblock.co/post/153299/tech-giants-opt-into-newly-formed-metaverse-standardsforum
27. https://opensea.io/assets/0xf87e31492faf9a91b02ee0deaad50d51d56d5d4d/ 204169420152563078
07802476445906092687286
28. https://gagadget.com/en/105654-metaverse-virtual-real-estate-sales-top-500m-and-could-reach1b-by-year-end/
29. https://www.reuters.com/markets/currencies/virtual-real-estate-plot-sells-record-24million-2021-11-23/
30. https://cointelegraph.com/news/virtual-land-in-the-metaverse-dominated-nft-sales-over-past-week
31. https://www.theblockcrypto.com/linked/143535/yuga-labs-otherside-metaverse-land-auctionimposes-kyc-checks?utm_source=rss&utm_medium=rss
32. https://arxiv.org/abs/2204.10243
33. https://www.nft-stats.com/collection/decentraland-wearables
34. https://etherscan.io/tx/0xe2d0f128c5f2424b43f626455f1993b07016dea270b11d5414d69172cd9ebbb5
35. https://opensea.io/assets/0x4581ce7b456a4254c98e1e32a3e59dd135061c17/ 341647274989675292
413269219146690986323957005
36. https://opensea.io/assets/0xa342f5d851e866e18ff98f351f2c6637f4478db5/ 692687218515188512034
77350973661279010842020632441619262890672708376456069120
37. https://www.marketwatch.com/press-release/on-demand-metaverse-wearables-fashion-as-nfts-isnew-trend-2022-04-18
38. https://beincrypto.com/95-trading-volume-looksrare-linked-wash-trading/
39. https://www.interneteconomist.com/crypto-exchanges-and-wash-trading/
40. https://cryptoslam.io/nfts
41. https://medium.com/@jpthor/bitcoins-market-dominance-a9693ff604bf
42. https://statmodeling.stat.columbia.edu/2021/07/15/using-benfords-law-to-detect-bitcoinmanipulation/
43. https://time.com/nextadvisor/investing/cryptocurrency/common-crypto-scams/
44. https://twitter.com/NFTGurus/status/1480895020098072580
45. https://cointelegraph.com/news/did-you-fall-for-it-13-ico-scams-that-fooled-thousands
46. https://decentraland.org/blog/announcements/decentraland-security-update/
47. https://www.reddit.com/r/TheSandboxGaming/comments/ttqvg5/sandbox_beta_email_is_this_a_scam/
48. https://m.facebook.com/groups/tsbmalaysia/posts/Almost-got-scam.-haha/814814829225679/
49. Decentraland official OpenSea page: https://opensea.io/collection/decentraland
50. Decentraland copycat project: https://opensea.io/collection/decentrelend
51. https://www.theverge.com/2022/5/11/23067192/opensea-nfts-copying-plagiarism-copymint-

48

The Future of Financial Crime in the Metaverse

verification-bayc?scrolla=5eb6d68b7fedc32c19ef33b4
52. https://coinmarketcap.com/
53. https://www.linkedin.com/posts/david-carlisle-b218aa12_crypto-ofac-crypto-activity6904037242537680896-t52e?utm_source=linkedin_share&utm_medium=member_desktop_web
54. https://www.trendmicro.com/en_gb/what-is/ransomware/ryuk-ransomware.html
55. https://www.google.com/url?q=https://www.elliptic.co/blog/crypto-addresses-holding-nfts-worth532k-are-among-latest-sanctioned-by-ofac&sa=D&source=docs&ust=1651006990894348&usg=AOv
Vaw2t5j-9udFZN_2SVSJ6tuhR
56. https://matrixworld.org/home
57. https://mobile.twitter.com/Flamingocasino3/with_replies
58. https://opensea.io/collection/flamingocasino
59. https://www.elliptic.co/hubfs/Elliptic_Using%20Blockchain%20Analysis%20to%20Mitigate%20
Risk%202022%20sanctions.pdf?utm_campaign=Report%20%7C%20Sanctions%20Compliance%20
In%20Cryptocurrencies&utm_medium=email&_hsmi=206023480&_hsenc=p2ANqtz-8y_59J1ec_
K2QxJgDz3iAibxWTLEzm8PqnSkTtx-pUeNAlFq0kyGbtC4WhrBv49dWsRZRytO7D09s20jv1tFuuWfp_2
Q&utm_content=206023480&utm_source=hs_automation
60. VeriChains Lab. “Someone Has Just Hacked $1M From Wanaka Farm (WANA)?”. Medium, 25 Nov 2021.
Available at: https://medium.com/verichains/someone-has-just-hacked-1m-from-wanaka-farm-wanaafaeb8c32ab0
61. https://www.benzinga.com/markets/cannabis/21/12/24796691/you-can-now-buy-cannabis-in-themetaverse-and-get-it-delivered-to-your-real-home
62. https://www.forbes.com/sites/ajherrington/2022/01/05/startup-plans-psychedelic-trips-in-themetaverse-with-sandbox-virtual-land-deal/?sh=702a7613536
63. https://www.youtube.com/watch?v=AcAyXrdDUFY
64. https://www.vice.com/en/article/wxdd74/zuckerbergs-metaverse-is-screwed-if-it-doesnt-allow-sex
65. https://www.wired.com/2015/05/we-sent-a-dick-pic-to-the-moon/
66. https://nftplazas.com/decentraland-districts/district-x/
67. https://www.theguardian.com/technology/2007/may/08/secondlife.web20
68. https://www.linkedin.com/pulse/hidden-folders-threat-i-what-true-depth-metaversechristofoletti/?trk=pulse-article_more-articles_related-content-card
69. https://stealthoptional.com/news/facebooks-metaverse-child-predators/
70. https://www.jumpstartmag.com/should-we-ban-porn-in-the-metaverse/?mc_cid=444d34c45e&mc_
eid=e09737a341
71. https://www.vice.com/en/article/j5yzpk/they-cant-stop-us-people-are-having-sex-with-3d-avatarsof-their-exes-and-celebrities
72. https://www.wired.com/story/crime-metaverse-virtual-reality/

49

The Future of Financial Crime in the Metaverse

About the Author

Tara Annison
Head of Technical Crypto Advisory
Tara is a global cryptoasset subject matter expert
specializing in Bitcoin, blockchain technology andcompliance issues. She regularly publishes thought
leadership pieces, and opines on the intersection oftechnical crypto matters, innovation and traditional
finance. Tara has spent years honing product at both
Elliptic, crypto startups and HSBC, and is a prolific writer,
speaker and entrepreneur.

50

The Future of Financial Crime in the Metaverse

Bad actors continue to find new ways
to support their criminal activities.
Between editions of this report you willfind the latest insights and trends around money
laundering and terrorist financing
using cryptoassets in the metaverse on

Elliptic Connect.

elliptic.co/connect

51

The Future of Financial Crime in the Metaverse

About Elliptic
Elliptic is the global leader in cryptoasset risk management for crypto
businesses and financial institutions worldwide. Recognized as a WEF
Technology Pioneer and backed by investors including Evolution Equity
Partners, J.P. Morgan, SoftBank Vision Fund 2 and Wells Fargo Strategic
Capital, Elliptic has assessed risk on transactions worth several trillion
dollars, uncovering activities related to money laundering, terrorist
fundraising, fraud, and other financial crimes. Elliptic is headquartered in
London with offices in New York, Singapore, and Tokyo. To learn more, visit
www.elliptic.co and follow us on LinkedIn and Twitter.

London ● Tokyo ● New York ● Singapore

Connect on LinkedIn

Follow us on Twitter

Contact us at hello@elliptic.co