Continued on page 4

Please feel free to send your questions and comments 

to the editors of the Cornerstone Report at: cornerstone@ice.dhs.gov

V O L U M E X I I I : N O . 1 — S U M M E R 2 0 1 7

T

he use of virtual currency is 

rapidly becoming more accepted 

throughout the world. Virtual 

currencies function as a method of 

value exchange; a peer-to-peer 

cashless ecosystem that seeks to 

remove the intermediary financial 

institution. Bitcoin is the most 

adopted form of virtual currency with 

a current market of $38 billion. In the 

last several years many companies 

worldwide have embraced Bitcoin as 

an alternative payment method. As 

this virtual form of value continues to 

gain legitimacy, methods to exploit it 

for criminal purposes will become 

more prevalent as well. 

Bitcoin use is described as an 

anonymous transaction because it is 

possible to send and receive bitcoins 

without revealing any personally 

identifiable information. In reality, 

bitcoin is actually pseudonymous. 

Every user has a public address used 

to buy, sell, or transfer bitcoin and 

every transaction conducted with 

bitcoin is recorded on a public ledger 

known as the Blockchain. Because of 

this pseudonymity, Bitcoin is a 

popular manner to buy and sell illicit 

goods and services found on both the 

internet, as well as darknet market 

places. 

One area that presents a significant 

challenge to law enforcement is 

unlicensed Peer to Peer (P2P) 

exchangers. Exchangers of currency, 

including virtual currencies, are 

considered money transmitters under 

federal law and are required to 

register and comply with federal antimoney laundering regulations if they 

Volume XIII No. 2 Summer 2017

Inside This Issue

Virtual Currency.........................1

IFPCU/ Definitions......................2

Case Study of 

Operation Denial........................3

Virtual Currency Cont’d............4

Cornerstone is U.S. 

Immigration and Customs 

Enforcement’s (ICE) 

comprehensive investigative 

initiative for fighting financial 

crime.

The Cornerstone Report is a 

quarterly bulletin 

highlighting key issues related 

to ICE Homeland Security 

Investigations (HSI) financial, 

narcotics and special 

operations investigations.

Toll Free Tip Line:

1-866-DHS-2-ICE

www.ice.gov/cornerstone

Virtual Currency
HSI Illicit Finance and Proceeds of Crime Unit 

T

he HSI Illicit Finance and Proceeds of Crime Unit (IFPCU) maintains a proactive approach 

to virtual currency recognizing that virtual currency will become more mainstream as the 

technology is embraced globally. IFPCU conducts outreach to major virtual currency 

exchangers operating within the U.S. to clarify and emphasize the need for a collaborative partnership between 

members of the compliant virtual exchange industry and HSI. During these meetings, HSI special agents 

discuss the Cornerstone Outreach Initiative, HSI’s outreach effort with the financial industry to combat the 

movement of illicit funds through financial service businesses. The forging of partnerships between HSI and 

financial sector businesses is beneficial to enhance operational abilities for HSI virtual currency investigations. 

Expanding the Knowledge Base

 HSI dedicates itself to overcoming the technological obstacles special agents face when they conduct 

investigations involving emerging technologies such as virtual currency. 

 Investigator training is the central element of HSI’s multi-tiered approach to virtual currency investigations. 

 HSI procures equipment that field offices need to successfully investigate virtual currency violations.

 HSI collaborates with industry leaders to identify and acquire access to the most effective forensic tools 

available to analyze and identify information through the blockchain.

Page 2 of 4

Volume XIII No 2

Virtual currency: The International Money Fund (IMF) defines virtual currency as digital representations of 

value, issued by private developers and denominated in their own unit of account. Virtual currencies can be 

obtained, stored, accessed and transacted electronically, and can be used for a variety of purposes, as long as 

the transacting parties agree to use them. The concept of virtual currencies covers a wide array of “currencies,” 

ranging from simple IOUs of issuers (such as Internet or mobile coupons and airline miles), backed by assets 

such as gold, and “cryptocurrencies” such as Bitcoin. As digital representations of value, virtual currencies fall 

within the broader category of digital currencies. 1

Blockchain: A blockchain is a ledger of facts, replicated across several computers assembled in a peer-to-peer 

network. Facts can be anything from monetary transactions to content signature. Members of the network are 

anonymous individuals called nodes. All communication inside the network takes advantage of cryptography 

to securely identify the sender and the receiver. When a node wants to add a fact to the ledger, a consensus 

forms in the network to determine where this fact should appear in the ledger; this consensus is called a block.

Pseudonymous: meaning that funds are not tied to real-world entities but rather digital currency addresses.

Cryptocurrency: a digital currency in which encryption techniques are used to regulate the generation of 

units of currency and verify the transfer of funds, operating independently of a central bank.

Fiat currency: currency which derives its value from government regulation or law.

1

IMF Staff Discussion Note– Virtual Currencies and Beyond: Initial Considerations– January 2016

Virtual Currency Definitions
T

he Operation Denial investigation began with a fentanyl overdose death of 18-year-old 

Bailey Henke from Grand Forks, North Dakota on January 3, 2015. Further investigation by 

state law enforcement agencies revealed four additional fentanyl overdoses in North Dakota, 

one of which was fatal. As the investigation continued it was linked to the darknet market site 

Evolution and a fentanyl vendor who went by the user name PDXBlack. In March 2015, PDXBlack was 

identified as Brandon Hubbard and arrested by HSI agents in Portland, Oregon. HSI agents seized fentanyl and 

packages with fentanyl ready to be shipped to additional customers. HSI and DEA investigators learned the 

fentanyl was coming from various international sources to Hubbard, who at the time of his arrest, claimed he 

was the largest powdered fentanyl dealer in the United States. At the time of Hubbard’s arrest, he had sold 

approximately 1.5 million U.S. dollars’ worth of fentanyl. The international investigation quickly centered on 

Daniel Vivas-Ceron, a Colombian citizen who was incarcerated in a Canadian prison. Vivas-Ceron ran a 

continuing criminal enterprise while in prison which included being a major broker for Chinese fentanyl. HSI 

investigators working in an undercover capacity were able to buy large quantities of fentanyl from Vivas-Ceron 

using bitcoin as the preferred currency. Vivas-Ceron was the major source of supply for fentanyl for Hubbard’s 

online darkmarket narcotics selling scheme fueled by digital currencies. Vivas-Ceron was deported from 

Canada to Colombia, but was detained in Panama during a layover and extradited to the U.S. to face 

prosecution. 

Based on information received during the investigation, it is estimated that up to 2 kilograms of fentanyl were 

purchased from Canada and China using fiat currency and bitcoins. The value of the fentanyl was estimated at 

9 million USD over a period of two years. Investigators discovered Hubbard had made bitcoin to fiat currency 

exchanges via bitcoin ATM and P2P exchangers. Even though investigators believe Hubbard earned millions of 

dollars running his darknet market scheme, no additional funds were seized. Investigators believe Hubbard 

was the victim of several money rips. 

The sales of fentanyl on the darknet market sites were being conducted using bitcoin as currency to pay for 

purchases. Operation Denial linked Hubbard to sales on additional darknet markets such as Silk Road and 

Agora, indicating he was operating for several years undetected. 

Operation Denial found 12 fentanyl-related overdose victims attributable to Hubbard and Vivas-Ceron, four of 

the overdoses were fatal. Eight more individuals were tied to the investigation as purchasers, money launderers 

or conspirators in the narcotics distribution network. Operation Denial also shut down one of the most prolific 

vendors of synthetic opioids on the darknet resulting in an undeterminable amount of lives saved.

On July 13, 2016, Hubbard was sentenced to life in Federal prison after pleading to three charges: 21 U.S.C. § 841-

Conspiracy to Distribute Controlled Substances Resulting in Serious Bodily Injury and Death; 21 U.S.C. § 841-

Distribution of a Controlled Substance Resulting in Death and 18 U.S.C. § 1956- Money Laundering Conspiracy.

Vivas-Ceron’s case is ongoing.

More information on the case can be found: https://www.justice.gov/usao-nd/pr/georgia-man-pleads-guiltyrole-overdoses-operation-denial

Page 3 of 4

Volume XIII No 2

Operation Denial
do substantial business in the U.S. 

Currency exchangers must also 

register with the government as a 

money services business.

Bitcoin and other virtual currencies 

are the preferred payment method in 

darknet markets. It is common for unlicensed P2P 

exchangers to obtain their bitcoin from selling illicit 

goods and services on darknet markets. The biggest 

problem darknet market vendor’s face is converting 

virtual currency into traditional fiat currency. To 

avoid reporting requirements, illicit vendors turn to 

P2P exchangers or become P2P exchangers 

themselves in order to liquidate their virtual 

currency. Often, for fees of 10 to 15 percent above 

what a licensed and compliant exchanger would ask. 

HSI targets illicit P2P exchangers for money 

laundering and money services business violations. 

Investigators can often identify the Bitcoin wallet 

address of the exchanger and use blockchain analysis 

tools and techniques to trace the Bitcoin transaction.

P2P investigations identify exchangers (both 

registered and unregistered) who have violated 18 

U.S.C. § 1960 – Prohibition of unlicensed (or licensed 

but non-compliant) money transmitting business and 

31 U.S.C. § 5330 – Registration of money transmitting 

business. P2P exchangers generally market their 

business on internet sites or virtual wallets with P2P 

features. This includes websites designed to connect 

buyers with sellers or mobile applications that 

identify buyers and sellers near your current location. 

Properly licensed and AML-compliant entities, 

including banks and exchangers, attempt to identify 

virtual currency transactions with connections to 

darknet markets, which are inherently illicit. If a 

connection to a darknet market is discovered, the 

financial institutions will deny the transaction and 

often close the customer’s account. The financial 

institution will also report its findings to regulators 

and law enforcement. These leads often include 

specific and accurate information regarding the 

identity of the customer, which remove 

pseudonymity in order to identify targets.

Page 4 of 4

Volume XIII No 2

Virtual Currency continued from page 1

HSI – A Diverse, Global Force

HSI is a critical investigative arm of the 

Department of Homeland Security and is a vital 

U.S. asset in combating criminal organizations 

illegally exploiting America's travel, trade, 

financial and immigration systems.

DHS/ ICE

Homeland Security Investigations

500 12th Street, SW

Washington, DC 20536

E-mail: cornerstone@ice.dhs.gov

Web: www.ice.gov

Flow of 

Bitcoin 

and Cash

Bitcoin Miner

Validates

Blockchain

Sender Receiver

(with Private Key)

Receivers

Banks Exchanges

Money Transfer Services

 ACH Transfers between bank account and bitcoin exchanges and trading platforms

 Unexplained bulk cash deposits

 Unexplained wire transfers from foreign locations or wires to businesses in China

 Blockchain transactions indicating Bitcoin transactions to and from Peer-to-Peer Bitcoin exchange sites

Red Flag Indicators