James Stanley

BTC-e, Alexander Vinnik, and the missing MtGox Bitcoins

Wed 26 July 2017
Tagged: bitcoin, cybercrime

Q: How do you launder the Bitcoins you stole from MtGox?
A: Set up your own exchange and sell them on there

A Russian chap named Alexander Vinnik was arrested in Greece today on suspicion of "running a $4 billion Bitcoin-laundering ring".

BTC-e is a Bitcoin exchange run anonymously that has been down for a couple of days. I'm not sure if it has been taken down by the authorities or not.

But it turns out Alexander Vinnik is the person (or at least, one of the people) behind BTC-e. It also turns out that the BTC-e wallet contains a huge amount of Bitcoin that was stolen from MtGox a few years ago, and some of it "seems to have moved straight to internal storage rather than customer deposit addresses".

There's a good writeup by WizSec (who you may recognise from their previous investigation into the MtGox theft and the Willy bot) with more in-depth analysis, worth a read: http://blog.wizsec.jp/2017/07/breaking-open-mtgox-1.html.

Anyway it looks like this guy Vinnik hacked MtGox, stole a load of their money, and then had to work out how to launder it. His method was to setup a rival exchange and sell the BTC on his own exchange. You don't have to satisfy anybody's anti-money laundering requirements if you run the exchange! He then just sells the stolen BTC to unsuspecting BTC-e customers and walks away with clean money.

Quite a fascinating story.

At minimum, it currently looks like Vinnik is likely to have at least been in on the laundering of the MtGox Bitcoin, even if he didn't actually steal it himself. Although it is, of course, possible that he's been framed by somebody else involved with BTC-e.

It's still not clear whether BTC-e was taken down by the authorities, or whether authorities have taken the money. If so, I hope they give innocent customers of BTC-e all of their money back, but I'm not holding my breath.

Fascinating story anyway.

If you like my blog, please consider subscribing to the RSS feed or the mailing list: