Special Declaration: This article is an original work by Attorney Shao Shiwei. It represents only the personal views of the author and does not constitute legal consultation or legal advice on specific matters. For article reprints, legal consultations, or business exchanges, please add: sswls66
On April 23, 2024, the Draft Revision of the Anti-Money Laundering Law of the People's Republic of China (hereinafter referred to as the "Draft Revision") was submitted for deliberation at the Ninth Session of the Standing Committee of the Fourteenth National People's Congress.This marks the first major revision since the enactment of the Anti-Money Laundering Law in 2007.
Yan Lixin, Executive Director of the China Anti-Money Laundering Research Center at Fudan University, stated thatthe most significant, urgent, and necessary issue to be addressed at the legal level is money laundering involving virtual assets. The use of crypto assets and virtual assets for money laundering is gradually becoming a mainstream trend; however, Chinese law lacks clear definitions regarding the connotation and extension of virtual assets.
As a typical application of blockchain technology, virtual currencies are increasingly being used as tools for money laundering in criminal activities due to their characteristics such as anonymity, cross-border nature, non-traceability, and high liquidity. According to statistical data from the Key Laboratory of Information Network Security under the Third Research Institute of the Ministry of Public Security and OKLink Research Institute, money laundering, fraud, pyramid schemes, and gambling were the four most common forms of virtual currency crimes in 2022. Among these, 54.72% of virtual currency crimes were related to money laundering, and 21.13% were related to fraud. According to incomplete statistics, currently more than 60% of funds from telecom fraud are ultimately laundered through virtual currencies.
Although countries around the world have significantly different understandings and attitudes towards blockchain, Web3, virtual currencies, etc., and regulatory policies vary across nations, there is a global consensus on anti-money laundering and crime prevention. China became an official member of the FATF (Financial Action Task Force,the most influential intergovernmental organization on anti-money laundering and counter-terrorist financing internationally) in 2007. In February 2019, China basically passed the FATF's fourth round of mutual evaluation. In its follow-up report on China's fourth round of mutual evaluation, the FATF pointed out deficiencies in areas such as anti-money laundering measures for designated non-financial businesses and professions, beneficial ownership regimes, financial sanctions for anti-money laundering, and on-site inspections by regulatory authorities. China will undergo the FATF's fifth round of mutual evaluation between 2025 and 2027.
In the future, the use of virtual currencies for money laundering will become a mainstream trend and should be a key focus of China's future regulatory efforts.In January 2022, the Ministry of Public Security announced at a press conference in Beijing that in 2021, nationwide authorities solved 259 cases involving money laundering with virtual currencies, seizing virtual currencies worth over RMB 11 billion. According to relevant statistical data, 70%-80% of new types of cybercrimes are currently related to virtual currencies. According to statistics from Chengdu Lian'an, losses from money laundering using virtual currencies exceeded RMB 27.3 billion in 2023.
For entrepreneurs in the Web3 industry, against the backdrop of the first major revision of China's Anti-Money Laundering Law, it is necessary to comprehensively understand potential security risks such as money laundering within the industry, legal risks, and their possible severe consequences, and to take corresponding measures to prevent and mitigate these risks. This concerns not only the stable operation of projects and the healthy development of the entire industry, but also national security, social public interests, and financial order.
Author of this article | Attorney Shao Shiwei
This topic is divided into three main parts:
-
Current Status of Security Risks in the Six Major Sectors of the Web3 Industry
-
Both Domestic and International Web3 Entrepreneurs Should Prioritize Anti-Money Laundering Compliance
-
How Should Web3 Entrepreneurs Respond Amidst the Global Trend of Stricter Anti-Money Laundering Regulation?
This article is the first part of this topic:
'Current Status of Security Risks in the Six Major Sectors of the Web3 Industry'
This section examines the inherent security risks of the Web3 industry and the risks of these sectors being used as tools for money laundering, from the perspective of the six major industries within Web3. It aims to reveal potential threats within the industry and raise awareness among practitioners regarding anti-money laundering risks and legal compliance.
Public chains, cross-chain bridges, trading platforms, wallets, DeFi, and NFTs are the six major sectors of the Web3 industry. A total of 435 security incidents occurred in these sectors in 2023,resulting in losses of approximately USD 7.983 billion(approximately RMB 57.8 billion).
01
Public Chains
Overview:
A public chain is a decentralized cloud server built using blockchain technology, used to host and run various decentralized applications. It serves as the foundational network service for Web3, with typical examples including BTC, ETH, BSC, and SOL. Achieving high decentralization, strong security, and high performance simultaneously is the goal pursued by all public chains, but this constitutes an "impossible trinity." For instance, the BTC public chain sacrifices performance to achieve decentralization and security, while ETH sacrifices security to achieve decentralization and performance.
According to incomplete statistics, as of December 2023, there are currently 194 public chains. In terms of ecosystem market capitalization, data from CoinGecko shows that Ethereum, BNB Chain, and Solana ecosystems rank in the top three. Currently, the total market capitalization of public chain ecosystems exceeds one trillion US dollars. As of December 2023, statistics indicate that 13 security incidents occurred in the public chain sector, with cumulative asset losses exceeding USD 280 million.
Currently, numerous public chains achieve interoperability through cross-chain bridge technology. This characteristic means that once a problem occurs on one public chain, its impact can rapidly spread to other connected public chains, creating a chain reaction. This rapid propagation is not only serious in nature but also difficult to handle, posing a severe threat to the stability and security of the entire public chain ecosystem.
Typical Case:
On October 7, 2022, the smart contract platform Binance Chain (BNB Chain) suffered a hacker attack. Within just two hours, hackers artificially minted 2 million BNB tokens, bridged them to other public chains, and then exchanged the inflated "fake BNB" for real money through DEX markets on respective public chains, amounting to over USD 700 million.
02
Cross-Chain Bridges
Overview:
Since each public chain is isolated from others, when investors engage in activities such as investment and staking across different public chains, they are constrained by the consensus mechanisms of different chains. When investors need to consolidate or transfer assets, cross-chain technology is required to facilitate this. A cross-chain bridge is the essential "bridge" for technical and asset transmission. It is not a physical "bridge" but rather utilizes certain protocols and technologies to enable users to transfer assets between different public chains. According to statistics, in the first half of 2022 alone, seven cross-chain bridge attacks occurred, resulting in total losses of approximately USD 1.13599 billion.
According to Chainalysis data, in 2023, illicit actors significantly increased their use of bridging protocols for money laundering, particularly in cryptocurrency thefts. As shown in the figure, bridging protocols received USD 743.8 million in cryptocurrency from illicit addresses in 2023, compared to only USD 312.2 million in 2022. For example, the North Korean hacker group Lazarus Group has combined cross-chain bridges with mixer technology as a significant means of money laundering.
Typical Cases:
1. Theft of Funds on the Ronin Chain
On the evening of March 29, 2022, funds on the Ronin chain, which underpins the blockchain game Axie Infinity, were stolen. The theft occurred on March 23 but was not discovered until March 29. The loss from this attack was approximately USD 624 million (including 173,600 ETH and 25.5 million USDC), making it the most devastating cross-chain bridge security incident to date. The stolen funds from Ronin were not recovered, and compensation was ultimately provided to users by Axie Infinity and Sky Mavis, the development company behind the Ronin chain.
2. Cross-Chain Projects Used for Money Laundering
On August 10, 2022, blockchain analytics firm Elliptic stated that the cross-chain protocol RenBridge was used for money laundering transactions involving at least USD 540 million in illicit funds.
On May 21, 2023, Zhao Jun, CEO of the well-known cross-chain project Multichain, was taken away by domestic police from his home and lost contact with the global Multichain team. According to public media reports, Multichain's arrest involved money laundering for criminal groups, with amounts involved being substantial.
03
Trading Platforms
Overview:
Trading platforms, also known as digital currency exchanges or cryptocurrency exchanges, primarily function to provide users with services for buying and selling virtual currencies, storing and managing virtual assets, and providing lending services for virtual assets. According to CoinGecko data, as of December 2023, there were a total of 887 cryptocurrency exchanges, including 224 centralized exchanges, 663 decentralized exchanges, and 94 derivatives exchanges. Statistics show that in 2023, 19 security incidents occurred at cryptocurrency exchanges, with cumulative asset losses exceeding USD 1.2 billion.
Typical Case:
On November 21, 2023, the U.S. Department of Justice website published an article stating thatBinance Holdings Limited (hereinafter referred to as Binance), which operatesthe world's largest cryptocurrency exchange, Binance.com, admittedto participating in acts involving suspected money laundering, unlicensed money transmission, and violations of sanctions, and agreed to pay a fine of USD 4.3 billion (USD 2.5 billion in forfeiture and USD 1.8 billion in criminal fines). Meanwhile, Binance founder and Chief Executive Officer (CEO) Changpeng Zhao admitted to failing to maintain an effective anti-money laundering program and has resigned from his position as CEO of Binance.
At 4:36 PM on November 21, Binance founderChangpeng Zhaoposted on Twitter that he had resigned from his position as CEO of Binance on that day, stating, "I made mistakes, and I must take responsibility."
The U.S. Department of Justice pointed out that Binance failed to implement an effective anti-money laundering program.For many years, Binance allowed users to open accounts and conduct transactions without submitting any identity information other than an email address. Meanwhile, U.S. sanctions laws prohibit Americans from transacting with customers subject to U.S. sanctions, including customers in fully sanctioned jurisdictions such as Iran. Despite this, Binance did not implement controls to prevent U.S. users from trading with Iranian users. From January 2018 to May 2022, Binance's intentional dereliction of duty resulted in transactions exceeding USD 898 million between U.S. users and users typically residing in Iran.
"Binance turned a blind eye to its legal obligations in its pursuit of profit. Its intentional dereliction of duty allowed funds to flow through its platform to terrorists, cybercriminals, and child abusers," said U.S. Treasury Secretary Janet Yellen. "To ensure compliance with U.S. laws and regulations, today's historic penalties and oversight mark a milestone for the virtual currency industry. Any institution seeking to benefit from the U.S. financial system, regardless of its location, must comply with requirements designed to protect us all from terrorists, foreign adversaries, and criminals, or face consequences." According to the technology website GeekWire, Judge Jones stated in court that Binance's specific violations of the federal Bank Secrecy Act were "unprecedented in number, scope, and scale," and that it had "basically turned a blind eye" to potential terrorist financing and drug trafficking.
On April 30, 2024, Binance founder and former Chief Executive Officer (CEO) Changpeng Zhao was sentenced to four months in prison for failing to prevent money laundering on the exchange.
04
Wallets
Overview:
Web3 wallets, also known as cryptocurrency wallets or digital asset wallets, are tools for storing, managing, and using digital currencies. According to statistics, as of December 2023, there were a total of 153 digital wallet projects. In 2023, 35 security incidents occurred involving digital wallets, with cumulative asset losses exceeding USD 600 million.
Money laundering crimes related to digital wallets are mainly reflected in two aspects. First, insufficient security performance of the wallets themselves leads to hacker attacks and loss of user assets. Second, because digital wallets do not require KYC (Know Your Customer) and only require an address (composed of a string of numbers and letters), without the need for intermediary services from banks, their anonymity and cross-border characteristics naturally make them suitable tools for criminals to launder money.
Typical Cases:
1. Theft of Hot Wallets
2. First Domestic Case Solved Involving Money Laundering with Digital Renminbi
05
DeFi: A Hard-Hit Area in Blockchain Anti-Money Laundering
Overview:
DeFi, or Decentralized Finance, is a decentralized protocol used to build open financial systems. In the current DeFi ecosystem, there is a wide variety of projects. Classified by function, they mainly include trading, lending, asset management, stablecoins, financial infrastructure, insurance, derivatives, and trading platforms. According to statistics, among the various sectors of Web3 projects, DeFi remains the area most frequently attacked. In 2023, there were a total of 282 DeFi security incidents, accounting for 60.77% of the total number of incidents, with losses reaching USD 773 million.
Most DeFi products are built based on smart contracts and interaction protocols, with code generally being open-source. In the increasingly vast DeFi ecosystem, the combination, circulation, and asset sharing among different DeFi products have led to an increasing number of security issues. According to report data from the foreign blockchain company Chainalysis, the proportion of DeFi in the total amount of funds sent from illicit addresses to crypto asset service providers is growing. In 2021, illegal funds received by DeFi projects increased by approximately 1900% compared to 2020, accounting for 19% of all monitored illegal funds. By 2022, DeFi protocols had become the largest recipients of illegal funds, accounting for 69% of all funds sent from addresses associated with criminal activities.
Typical Case:
North Korean Hackers Use DeFi Protocols for Money Laundering
06
NFT
Overview:
NFT (Non-Fungible Token) is a type of digital asset stored on the blockchain, characterized by uniqueness, scarcity, and indivisibility. It is mainly applied in gaming, art, and domain names. According to incomplete statistics, as of December 2023, a total of 44 security incidents occurred in the NFT sector, with cumulative asset losses amounting to approximately USD 62 million.
Typical Case:NFT Wash Trading
According to Chainalysis statistics, in the third and fourth quarters of 2021, the vast majority of illicit crypto assets involving NFTs originated from addresses associated with fraud. These addresses purchased NFTs with cryptocurrency, and a large amount of stolen funds was also sent to NFT markets.
Based on analytical data confirming the profits of wash traders, 262 address users were identified as habitual NFT wash traders. Among them, 152 made no profit, while the other 110 profited nearly USD 8.9 million through wash trading.
Note: Statistical data in this article is sourced from industry research reports by OKLink, SlowMist, Chengdu Lian'an, Zhifan Technology, and others.
The next article is the second part of this topic: "Both Domestic and International Web3 Entrepreneurs Should Prioritize Anti-Money Laundering Compliance"
Recommended Reading
