Tether and sanctions: what’s coming for Paolo’s beautiful launderette

  • By Amy Castor and David Gerard

Tether has long played financial shell games to keep its dollar stablecoin USDT up and running. It’s also been happy to ignore money laundering laws for most of its existence.

But we think Tether’s day of reckoning is on the horizon due to USDT’s latest use case: sanctions evasion.

How sanctions work

The international financial sanctions system, led by the US and Europe, aims to cut off cash flows to serious bad actors — terrorists, enemy countries, major criminals, and so on.

As Congressman Juan Vargas told Mark Zuckerberg of Facebook in the Libra hearings: “The dollar is very important to us as a tool of American power and also a tool of American values. So we would much prefer to put sanctions on a country than send our soldiers there.”

The US regards the power of the dollar and the sanctions system as part of the national defense. Sanctions are taken very seriously

The Office of Foreign Assets Control at the US Treasury keeps a list of sanctioned individuals, countries, and companies. [OFAC]

Doing business with an OFAC-sanctioned entity is a strict liability offense that can result in massive fines. That hasn’t stopped Tether.

Use case for Tether: North Korea, Hamas, Russia

Tether’s sanction violations started hitting the papers two years ago. 

In August 2022, the US sanctioned Tornado Cash — the favorite crypto mixer of North Korea’s Lazarus Group for laundering stolen ETH to help the country get hard currency. OFAC posted a list of sanctioned Ethereum blockchain addresses for the Tornado Cash smart contract.

Tether flat-out ignored the sanctions. The  company posted that it “does not operate in the United States or onboard U.S. persons as customers,” so is not obliged to comply with US sanctions. [Tether, archive]

(This theory doesn’t quite hold, as we detail later.)

The Palestinian Islamic Jihad received $93 million in crypto between August 2021 and June 2023, according to Elliptic. Wallets connected to Hamas received $41 million over a similar period, almost all in USDT, according to Israeli blockchain firm Bitok. [WSJ, archive]

Chainalysis found that stablecoins like Tether were used in the vast majority of crypto-based scam transactions and sanctions evasion in 2023. [Wired, archive; Chainalysis]

TRM Labs concurred, saying that Tether was the most used stablecoin in illicit crypto flows in 2023. Tether on the Tron blockchain in particular had “cemented its position as the currency of choice for use by terrorist financing entities.” [TRM; Bloomberg, archive]

In April 2024, Reuters reported that PDVSA, Venezuela’s state-run oil company, was steering users to USDT and asking for half of each payment upfront in tethers to avoid having their money frozen in foreign bank accounts. US President Biden lifted sanctions in October — but said he would be reimposing them as Venezuelan President Nicolas Maduro had failed to uphold his commitment to free and fair elections. [Reuters, archive; CoinDesk]

Also in April, the Wall Street Journal reported that tethers had become “indispensable” to fund the Russian invasion of Ukraine. Russian middlemen used USDT to skirt US sanctions and procure parts for drones and other equipment. [WSJ, archive]

Bloomberg reported that the US and the UK were investigating $20 billion in tethers that passed through Garantax, a Russian-based crypto exchange that both the US and the UK have sanctioned. [Bloomberg, archive

Russians were using tethers to skirt sanctions quite soon after the invasion of Ukraine in February 2022. You would buy tethers in Russia with rubles and sell them in London for pounds. [CoinDesk]

The Counter ISIS Finance Group is a group of countries aiming to cut off funding to the Islamic State of Iraq and Syria. Most of ISIS’s funding is in cash — but the US Treasury fact sheet on the CIFG’s January 2024 meeting has a whole section on their fondness for tethers, particularly in Western Africa. [Press release; fact sheet, PDF]

Liberty Reserve

Liberty Reserve was a digital currency service run out of Costa Rica, active from 2006 to 2013. It issued dollar-backed liabilities called “LR.” These were just entries in a ledger at Liberty Reserve — everything was centralized. But otherwise, LR worked very like a stablecoin.

Customers purchased LR through middlemen — such as Gerry Cotten and Michael Patryn, who ran Midas Gold before starting the now-collapsed Quadriga crypto exchange. These “exchangers” bought LR in bulk directly from Liberty Reserve and sold them to secondary users. This helped obscure the money trails.

LR and its ilk ushered in a new era of cyber money laundering. Gone were the days of crossing borders with suitcases full of cash. You could simply set up an LR account and send dollar equivalents digitally!

Liberty Reserve was a bustling laundromat for seven years — until the DOJ seized its website and arrested its merry band of founders in Spain and New York. The US charged them under the Patriot Act with money laundering and running an unlicensed money transmitter. Liberty Reserve’s founder, Arthur Budovsky, is currently serving a twenty-year sentence. [DoJ; DoJ

Liberty Reserve Junior

Tether is Liberty Reserve but on the blockchain.

Tether has large clients who purchase USDT in bulk — or maybe borrow it, the tethers being created out of thin air with the loan being the “backing reserve.”

Secondary users buy the tethers on offshore crypto exchanges, such as Bitfinex, Binance, and Huobi.

Tether disclaims any responsibility for what these secondary users do with their tethers — even as Tether has complete control over all USDT and can freeze or destroy individual tethers at any time.

Tether is an improvement over Liberty Reserve because it runs on a blockchain — 15 different blockchains, in fact, with Tron being its main blockchain.

As well as DeFi shenanigans local to each chain, this also facilitates chain hopping — where you take a pile of tethers from multiple customers, mix them up, and move them to a new chain, making the funds harder to trace. 

Tether routinely creates hundreds of thousands of tethers at a time on one chain, so they can “swap” them from another chain. Sometimes they actually burn the old tethers on the original chain! [Tether]

While Liberty Reserve was mainly used by fraudsters, hackers, and traffickers, it never grew to the scale that Tether has — and it never became popular as a tool for sanctions evasion, not just crime. 

Why hasn’t Tether been shut down yet?

Shutting down Liberty Reserve was a huge job — it took a multi-year investigation spanning 17 countries. Tether is even more complex.

Tether is not very linked to the US. None of its principals are US citizens. The company is registered in the British Virgin Islands. The CEO, Paolo Ardoino, lives in El Salvador. Tether’s main bank is Deltec in the Bahamas. A major owner is based in Thailand. 

Tether has a long and sketchy history, back to its launch in 2015. They operated under the radar for years. By 2017, federal enforcement agencies were too busy tackling the ICO boom to take notice. So Tether grew unchecked.

In 2018, the New York Attorney General charged Tether and its crypto exchange sibling Bitfinex with fraud when they tried to cover up $850 million in missing reserves. The companies settled in February 2021 for $18.5 million, a small slap on the wrist. 

In the process of investigating Tether and Bitfinex, the NYAG accumulated quite a lot of dirt on the companies. You might think they would have passed this pile of evidence to the Feds with a bow on top — and they did try.

In his book Number Go Up, Zeke Faux writes how New York reached out to the SEC, the DOJ, and the CFTC about Tether in early 2021 — but the Feds just weren’t interested?! The CFTC did eventually act against Tether later in 2021.

It wasn’t until 2022 that the Feds finally started to pay attention — when they noticed Tether’s role in sanctions evasion.

A bigger hammer

Despite Tether’s claims to have no links to the US, the company has more than a little US exposure — they have substantial backing reserves held in the US in dollars, such as their Treasury notes at Cantor Fitzgerald. This makes them at least slightly subject to US law.

In any case, non-US entities who work around US sanctions risk being sanctioned themselves. This may be applied to individuals as well as companies. [OFAC, PDF]

An entity may be cut off from the US dollar system altogether — and from any entity elsewhere in the world that wants to keep its access to US dollars. This is a financial death penalty. It’s a big stick.

If Tether remains noncompliant, this could put their banking and reserve relations at risk. Having Tether as a client could become too risky even for Cantor. 

By 2023, Tether had wised up a bit. They froze 32 wallets that were linked to terrorism and warfare in Ukraine and Israel in October 2023. In December, Tether froze 41 wallets tied to sanctions as a “precautionary” measure. [Tether; Tether]

By this time, the Feds were keeping a close eye on Tether. 

Ardoino wrote public letters to US senators in November and December proclaiming Tether was now in “alignment” with OFAC, and they were fine with freezing secondary addresses. Also, Tether had “onboarded” the Secret Service onto their platform — though it’s not clear just what that meant — and they were working with the FBI and the DOJ. [Yahoo; Tether; Letter, PDF; Letter, PDF]

Seriously, stop it

While Tether was blocking addresses and trying to convince the world it was in full compliance, the US government was making its annoyance more explicit.

Treasury Secretary Wally Adeyemo gave a speech at the November 2023 Blockchain Association Summit. This was the earliest example we could find of the government using the words “national security” about cryptocurrency: [Treasury]

While some have heeded our calls and taken steps to prevent illicit activity, the lack of action by too many firms—both large and small—represents a clear and present risk to our national security.

Adeyemo doesn’t name Tether in the speech, but it’s clear who he’s talking about:

We cannot allow dollar-backed stable coin providers outside the United States to have the privilege of using our currency without the responsibility of putting in place procedures to prevent terrorists from abusing their platform.

He gave this speech just after the Binance settlement dropped.

Senators Elizabeth Warren (D-MA) and Roger Marshall (R-KS) sent a letter to the Treasury, the Department of Defense, and the White House in April 2024 saying that they were concerned about Russia, Iran, and North Korea using Tether to evade sanctions: [Letter, PDF; WSJ]

The national security threat posed by cryptocurrency requires a commensurate response by our country’s defense community. We seek information on the additional authorities you may need in order to neutralize this threat.

The US has decades-old laws in place for dealing with sanction violators. The Bank Secrecy Act, the Patriot Act, and the International Emergency Economic Powers Act give the US sweeping powers. 

The government is also working on new stablecoin regulations — and any effective regulation on US dollar stablecoins would likely be fatal to Tether. 

What happens next?

Binance already learned this lesson after supplying services to Iran. They had to settle fines of more than $4 billion for violating the BSA, money transmitter laws, and the IEEPA. Former Binance CEO Changpeng Zhao was sentenced to four months in prison. Binance is getting a monitor.

We expect something similar to happen to Tether — large fines, compliance requirements, and the possibility of jail time for Tether principals.

If the heat gets too much, Tether might try to unwind the entire fund and shut down. The tricky parts will be how to do this while keeping as much of the money as possible and how to realize and return the dollar value of what reserves actually exist in any tangible sense.

But most importantly, they have to not unduly upset any of the more demanding sort of Tether customer who knows where they live.

___________________

  • You can sponsor our efforts to produce more work like this. Here’s Amy’s Patreon and here’s David’s. For casual tips, here’s Amy’s Ko-Fi and here’s David’s.
  • Help our work: if you liked this post, tell just one other person.

Crypto collapse: Tornado Cash arrests, Federal Reserve shuts down Farmington Bank, Prime Trust played Terra-Luna

Our latest post on the crypto collapse is on David’s site. [David Gerard]

In this edition:

  • The US charges Tornado Cash co-founders with laundering over $1 billion in criminal proceeds.
  • Federal and State regulators shut down FTX-affiliated Farmington State Bank 
  • Prime Trust files its first-day motion — they had been gambling on Terra-Luna!
  • Everybody still hates Binance
  • Sam Bankman-Fried says his lawyers told him to do it.

Axie-Ronin hackers and the crypto laundromat — will they succeed in cleaning 174,000 ETH?

Axie Infinity, a popular play-to-earn game, suffered a breach, losing $625 million in crypto — 173,600 ETH and 25.5 million USDC, a popular stablecoin.

It’s the biggest hack ever in the GameFi sphere and a bit of a public relations problem for P2E promoters, such as VC firm Andreessen Horowitz (a16z), who ambitiously describes P2E as “the future of games and really, the Web as we know it.”

The hack took place on Ronin, the Ethereum sidechain that Axie runs on. Ronin uses proof of authority, a modified version of proof of stake, where it only has nine validator nodes, all officially whitelisted — so it’s not even decentralized. 

Via a backdoor, the hacker got a hold of four nodes that were controlled by the game’s Vietnamese developer Sky Mavis, and a fifth node controlled by the Axie DAO.

Because Sky Mavis wants to distance itself from Axie Infinity and in-game tokens, like AXS and SLP (smooth love potion), it created a decentralized autonomous organization. 

Once the hacker controlled the majority of nodes, they were able to forge transactions, and simply remove the money from the Ronin bridge, without a hitch.

Axie said in a tweet that the hack was the result of social engineering combined with human error from December 2021, but did not elaborate. Axie promised to add new validators to the network to make it more decentralized. 

Social engineering suggests something along the lines of a phishing scam. 

This is different from other recent bridge attacks, like Wormhole, wherein the attack was a result of a vulnerability in the smart contract. 

Six days to run for the hills

Ronin reported the hack on March 29 — but according to a Ronin blog post, the theft occurred six days earlier. Sky Mavis unwittingly discovered the breach after a user reported having trouble withdrawing funds from the network. 

How on earth do you lose hundreds of millions of dollars in crypto and nobody notices for nearly a week? Axie developers not only left the door open, but they also neglected to turn on the security cameras!  

All eyes are on the stolen crypto, as internet sleuths watch to see how the hackers will pull off the next part of this massive heist: laundering the funds. Clean crypto is always worth more than dirty crypto.

As soon as you convert stolen crypto to cash in your bank account, you risk revealing your identity. (Recall the two individuals recently nabbed after trying to launder bitcoin stolen from Bitfinex in 2016.)

Stablecoins can be frozen by the issuer — in this case, Circle. So the Ronin hacker laundered them quickly as possible, sending the ill-gotten USDC to decentralized exchanges Uniswap, and 1inch, and swapping it for ether. 

Most of the stolen ETH remains in the attacker’s wallet, but so far, the Axie-Ronin hacker has sent 3,750 ETH ($12 million) to Huobi and 1,220 ETH ($4 million) to FTX, according to Dirty Bubble Media. Funds were also sent to Binance and Crypto.com. 

Tornado Cash 

Once centralized exchanges realize where the funds are coming from, they can freeze accounts and even route the money back to Ronin — if they want to, and if the funds haven’t already been chain swapped away. 

Chain swapping, or chain hopping, involves sending the funds to an exchange, swapping them for another crypto, and then quickly moving those funds to another exchange. Many offshore exchanges have lax KYC controls.

Still, why didn’t the hackers use a mixer like Tornado Cash to scramble up the ETH instead? 

A mixer takes funds from different users and jumbles them all together, making it difficult to track the movement of funds on a blockchain. 

Tornado Cash works as a series of pools, each for a different value. You deposit coins in a pool, and sometime later, you can withdraw an equal number of coins.

The problem is, once you send crypto to a mixer, you have to wait for deposits and withdrawals from other users to achieve any real anonymity. That takes time.

And, since pretty much all of the big flows are identified as dirty, any large withdrawal is likely to be dirty as well. Also, exchanges may be reluctant to touch crypto coming out of a mixer, believing it’s all just tainted money.

“Exchanges are probably starting to get wise and just blocking Tornado Cash for non-KYC accounts because it is just SO cesspool even for them,” Nicholas Weaver, a researcher at the International Computer Science Institute in Berkeley, told me. 

Binance, which integrated the Ronin wallet in September, said that as of Tuesday, it has suspended all deposits and withdrawals on Axie Infinity’s Ronin network, and it is on the lookout for unusual transactions — but again, the hackers were already ahead of the game, so it’s unclear what good this does.

(Update, April 4: The Ronin hacker is now routing funds through Tornado Cash, according to an address associated with the hack — a combined total of 2,000 ETH, or roughly $6.9 million.)

Refunding the money

Sky Mavis needs to find a way to refund Axie players, many of whom are now sitting on unbacked WETH — the ERC20 token that represents the ETH on the Ronin network.  

If the game developer can’t refund players, it may have to retire the game or face insolvency, putting the entire P2E space to shame. Right now, the firm has no idea how it is going to come up with the money. 

“We are fully committed to reimbursing our players as soon as possible,” Aleksander Leonard Larsen, Sky Mavis COO, told Bloomberg. “We’re still working on a solution, that is an ongoing discussion.”

The stolen funds include the deposits of players and speculators and the Axie Infinity Treasury, used to create a base revenue for the AXS token. Of the ETH stolen, 56,000 belonged to the Axie Infinity Treasury, Bloomberg said.   

The real losers

Play-to-earn games are exploitive. They promise users the ability to earn money while playing. But to play, you have to first purchase expensive NFTs, which not everyone can afford. 

In the case of Axie Infinity, that means purchasing three Axies — cartoon monsters that live on the Ethereum blockchain as ERC721 tokens — at a cost of up to a thousand dollars. Players pay because they see it as an income opportunity. 

In the Philippines, many players resort to borrowing Axies, and becoming indentured servants, playing for weeks on end just to recoup their initial investment. Playing the game becomes a mindless slog for those trying to earn a living wage, so they can buy food and keep a roof over their heads. The game itself functions as a pyramid scheme. 

Many of these players sold their in-game NFTs for ETH, which they hoped to turn into cash. Only now, the WETH in their Ronin wallets is worth nothing because there is no ETH to cover it, and they have nothing to show for all the days, weeks, and months of endless game playing. They are the real losers in all of this. 

As for the P2E boosters, Axie Infinity is too important to fail. In December, Sky Mavis closed a $152-million Series B led by FTX and a16z. That was on top of a $7.5 round six months earlier with contributions from billionaire investor Mark Cuban.

A16z-backed Yuga Labs, the firm behind the popular Bored Apes Yacht Club, is also making moves into the P2E space. Its APE token will serve as the in-game currency for Animoca Brand’s Benji Bananas. The firm also recently dropped hints of another game called Otherside, where virtual land will be sold as NFTs.  

Unless the Ronin hacker has a change of heart and returns the money, it looks like a superhero may have to step in to save the day. In the world of crypto, more often than not, that means pulling more money out of thin air in the form of tokens. 

If you like my work, consider supporting my writing by subscribing to my Patreon account for as little as $5 a month.